Terminology Index

Glossary

2953 terms

Workload Risk Prioritization

Workload risk prioritization combines affectedness, exploitation, exposure paths, identity privilege, data consequence, business criticality, current controls, deployment count, and response readiness.

Workload Security Boundary

A workload security boundary separates provider-managed platform responsibilities from customer-managed image, operating system, code, identity, data, configuration, telemetry, network, and recovery responsibilities.

Workload Security Operating Model

A workload security operating model assigns ownership for secure patterns, exceptions, coverage, detections, incidents, remediation, evidence, platform change, support, and retirement.

Workload Security at Scale

Operating workload protection across many cloud workloads sustainably, automation, standardization, self-service, that distinguishes a working program from one that breaks under growth.

Workload-to-Workload Authorization

Workload-to-workload authorization grants a verified service or application identity specific operations on a resource without relying only on IP address, subnet, or cluster membership.

Writable Path

A file or directory location modifiable by an identity, which becomes an escalation risk when a more privileged process loads code, configuration, or commands from it.

Writable Paths

Filesystem paths an account or process can write to, which on Windows and Linux can become privilege-escalation paths if the contents are later executed or read by something more privileged.

Writable paths matter because what an unprivileged process writes can be picked up by a privileged one later. Classic abuses: dropping a malicious DLL where a service searches, writing into a path included in root's PATH, or modifying a configuration file consumed by a privileged daemon. Defenders audit writable paths during hardening reviews and watch for write events to sensitive locations. As an OS-defenders topic, writable-path analysis is core to recognizing many privilege-escalation paths.

Introduced in: Operating Systems for Defenders

Examples

Auditing world-writable paths during a Linux hardening review.
Identifying writable directories on Windows that elevated services search.
Watching for unexpected writes to sensitive paths during investigation.

Privilege Escalationrelates_to Unquoted Service Pathrelates_to File Permissionsrelates_to Hardening Guidesrelates_to User Spacerelates_to Windows Event Logrelates_to Windows SIDrelates_to WMI Event Subscriptionsrelates_to

Written Testing Authorization

Written testing authorization identifies who grants authority, who may test, the exact assets and environments, dates, permitted techniques, data access, third parties, constraints, and approvals.

X-Frame-Options

An HTTP response header that controls whether a page may be embedded in a frame, defending against clickjacking by preventing other sites from iframing the page.

XSS

Cross-Site Scripting: a class of vulnerability where attacker-controlled content is rendered as code by the victim's browser, enabling theft, account takeover, or other client-side attacks.

XSS Testing

Testing a web application for cross-site scripting vulnerabilities by probing inputs with crafted payloads to find where untrusted content reaches the browser as code.

YARA Condition Design

YARA condition design combines structural checks, string groups, counts, offsets, sizes, modules, and logical relationships to express what must be true for a rule to match.

YARA Rule Quality

YARA rule quality balances precision, coverage, performance, explainability, maintainability, and operational consequence for a declared target corpus.

YARA Rule Testing

YARA rule testing compiles and evaluates a rule against positive, related, clean, malformed, packed, unpacked, and performance corpora with recorded provenance and results.

Yara Rules

Pattern-matching rules for identifying malware and files of interest by content, strings, byte patterns, conditions, used widely in malware analysis, hunting, and incident response.

Yara String Selection

The craft of choosing strings for YARA rules that are distinctive, durable, and unlikely to false-positive, the difference between a rule that catches a family and one that catches noise.

ZTA Assessment Process

From a security-architecture-review lens, the process of assessing a system or program for zero-trust posture, identifying gaps against ZTA principles and providing concrete recommendations.

ZTA Decision Logging

Zero trust decision logging records the subject, resource, operation, enforcement point, policy version, bounded input references, decision, obligations, session, changes, termination, and errors.

ZTA Governance

Zero trust architecture governance assigns accountable ownership for resources, identities, devices, workloads, data, policy, enforcement, signals, exceptions, privacy, evidence, operations, incidents, and resilience.

ZTA Logical Components

The logical building blocks of a zero-trust architecture as defined by NIST SP 800-207, Policy Engine, Policy Administrator, Policy Enforcement Point, that describe how access decisions and enforcement work together.

ZTA Maturity Assessment

An assessment of how mature an organization's zero-trust implementation is, often using CISA's Zero Trust Maturity Model with stages from traditional to optimal across identity, device, network, applications, data.

ZTA Maturity Model

A model describing stages of zero-trust adoption, typically CISA's traditional / initial / advanced / optimal across pillars, that gives organizations a structured way to assess progress and plan next steps.

ZTA Migration Pitfalls

The common traps organizations hit while moving to zero-trust, treating ZTA as a product, breaking productivity with overzealous controls, neglecting identity foundations, that derail ZTA programs.

ZTA Migration Roadmap

A zero trust migration roadmap sequences enabling capabilities and bounded resource use cases by risk, dependency, feasibility, evidence, and measurable exit criteria.

ZTA Policy Administrator

The zero trust policy administrator executes a policy-engine decision by establishing or terminating a communication path through enforcement points and coordinating any session artifact.

ZTA Policy Enforcement Point

A zero trust policy enforcement point enables, monitors, and terminates a subject-resource path according to an authorized policy decision.

ZTA Policy Engine

The zero trust policy engine is the logical component that evaluates enterprise policy and available evidence to grant, deny, or revoke a subject's access to a resource.

ZTA Privilege Escalation Controls

Zero-trust controls that limit privilege escalation, just-in-time elevation, strong MFA at elevation, device-trust requirements for admin actions, scoped tokens, that reduce what an attacker can do with a foothold.

ZTA Trust Algorithm

A zero trust trust algorithm is the documented policy process that evaluates a resource request and available inputs to reach an access decision and obligations.

ZTNA (Zero Trust Network Access)

Zero Trust Network Access provides policy-controlled connectivity to specific applications or resources rather than broad membership in an internal network.

ZTNA Architecture

Zero Trust Network Access architecture: the design pattern that replaces VPN with identity- and device-aware brokered access to specific applications, granting only what's needed per session.

ZTNA Scope and Limitations

ZTNA scope and limitations describe the users, workloads, devices, applications, protocols, destinations, operations, platforms, telemetry, revocation, and outage behavior a zero trust network access design actually supports.