WBP SI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Rules of engagement

A document defining authorized targets, test windows, permitted techniques, prohibited actions, escalation contacts, and emergency stop procedures before any security inspection begins.

Black-box testing

An assessment performed with no prior knowledge of the target's architecture, source code, or credentials, simulating an external attacker with only publicly observable information.

Grey-box testing

Testing with partial knowledge such as user-level credentials or architecture documentation, balancing realistic attacker perspective against efficient coverage of internal weaknesses.

False positive

A reported finding where the described condition does not actually exist on the target, often caused by banner matching, version inference, or unverified scanner signatures.

CVSS base score

A 0.0 to 10.0 rating of intrinsic vulnerability characteristics covering exploitability and impact, independent of the target environment or current threat activity.

Shadow IT

Assets or services operating outside the authoritative inventory and governance process, discovered by reconciling scan and cloud enumeration results against inventory records.

Asset criticality

A ranking derived from data classification, business process dependency, and network exposure that determines remediation priority and testing depth for each inventoried asset.

CMDB reconciliation

The process of comparing discovered hosts and cloud resources against configuration management records to identify unmanaged assets and stale inventory entries.

Certificate transparency logs

Public append-only records of issued TLS certificates, used during reconnaissance to enumerate hostnames and subdomains that never appear in DNS zone data.

Authenticated scan

A vulnerability scan that logs into the target with credentials, reading installed packages and local configuration rather than inferring versions from network responses.

Configuration drift

Divergence between an asset's current configuration and its approved baseline or infrastructure-as-code definition, often introduced by manual changes after deployment.

Benchmark compliance state

The recorded status of each hardening control as compliant, non-compliant, or not applicable, referenced to a published baseline and retained as assessment evidence.

Least privilege verification

Enumeration of group memberships, role assignments, sudo rights, and service account permissions to confirm accounts hold only the access their function requires.

TLS configuration review

Assessment of enabled protocol versions, cipher suites, certificate chain validity, key strength, and whether deprecated protocols remain available on the service.

Backported patch

A vendor fix applied to an older version without changing the version string, causing version-based scanners to report a false positive for that vulnerability.

EPSS score

An estimated probability that a given CVE will be exploited in the wild within the next 30 days, used to prioritize findings beyond static severity ratings.

CISA KEV catalog

A maintained list of vulnerabilities known to be actively exploited, used as a strong signal to escalate remediation priority regardless of CVSS base score.

IDOR

Insecure Direct Object Reference, where an application exposes an internal identifier and fails to verify the requesting user is authorized for that object.

Session fixation

An attack where the attacker supplies a known session identifier and the application fails to rotate it after authentication, allowing session hijacking.

Stored XSS

Cross-site scripting where attacker-supplied script persists in server storage and executes in the browsers of users who later view the affected content.

CSRF token validation

A control requiring an unpredictable per-session or per-request token on state-changing requests, preventing forged requests from other origins.

SSRF verification

Confirming server-side request forgery using an out-of-band interaction server that records the target's outbound request, avoiding access to internal production systems.

Mass assignment

An API weakness where client-supplied fields bind directly to internal object properties, allowing modification of attributes such as role or account balance.

Order of volatility

The collection priority ranking evidence by how quickly it is lost, from CPU registers and memory through disk to archived media and remote logs.

Chain of custody

A documented, signed record of every person who handled an evidence item, when, and where, demonstrating continuity from acquisition through final disposition.

Evidence integrity hash

A cryptographic digest such as SHA-256 computed at acquisition and recomputed before analysis, proving the artifact was not altered in storage or transit.

Blind spot

An attack technique or asset for which no log source or detection rule exists, meaning malicious activity would occur without generating any reviewable record.

Time-to-detect

The elapsed interval between a simulated or real malicious event and the moment an alert is generated, used to measure detection program effectiveness.

Log retention baseline

The defined period logs remain searchable and archived, commonly 90 days hot and one year cold, set by investigative need and regulatory requirement.

Remediation SLA

A contracted maximum time from finding to verified fix, scaled by severity, used to measure program performance and compliance with agreed service levels.

Risk acceptance

A formal decision by an accountable owner to leave a finding unpatched, documented with rationale, compensating controls, and an expiry date for re-evaluation.

Retest verification

Re-execution of the original reproduction steps plus a regression check on related assets, recorded by the verifying party before a finding is closed.