WBP SI key terms

A written agreement defining the scope, targets, timing, allowed techniques, and emergency contacts for a security test, so testers act with explicit authorization and avoid unintended disruption.

The documented list of in-scope and out-of-scope assets, networks, and techniques. It prevents testing of third-party or production systems without permission and anchors all later findings.

A signed document from an accountable owner granting permission to test specified systems during a defined window. It is the primary legal evidence that activity was sanctioned.

An assessment performed with no prior knowledge of internal design, credentials, or architecture, simulating an external attacker who must discover everything from scratch.

An assessment where testers receive source code, architecture diagrams, credentials, or configuration data, allowing deeper coverage and more precise root-cause identification.

A hybrid approach giving testers partial internal knowledge, such as a low-privilege account or network diagram, balancing realistic attacker simulation with efficient coverage.

A reported finding that does not actually represent a real weakness, often caused by scanner signatures, version banners, or misread responses. It must be verified before reporting.

A real weakness that the assessment failed to detect, typically from incomplete coverage, missing credentials, or tool limitations. It understates risk and is harder to measure than a false positive.

A maintained record of hardware, software, cloud resources, and data assets with owners and attributes. It defines what exists so discovery and testing can be measured against it.

The process of actively or passively identifying unknown or unmanaged devices and services on a network, often through scanning, DNS records, or traffic analysis.

Systems, cloud services, or applications deployed without central IT approval or documentation. They create blind spots because they are absent from the official inventory.

A repository storing configuration items and their relationships, used as an authoritative reference for asset ownership, dependencies, and change history during assessments.

A scan across an address range to identify live hosts, typically using ICMP or TCP probes, forming the first step before port and service enumeration.

Probing TCP or UDP ports on a host to determine which are open, closed, or filtered, revealing reachable services and potential entry points.

Identifying the software, version, and configuration of services listening on open ports, which supports matching against known vulnerabilities and weak configurations.

Collecting the identifying text a service returns on connection, such as server or version strings, to fingerprint software. Banners can be spoofed and must be corroborated.

A documented, approved set of settings for a system or platform. Assessments compare live configuration against it to identify drift and hardening gaps.

The gradual divergence of a system's actual settings from its approved baseline, often caused by manual changes, patches, or deployments outside change control.

A prescriptive set of security settings for an operating system, application, or device, covering services, permissions, authentication, and logging to reduce attack surface.

A published, consensus-based checklist of secure configuration settings for a specific product, used as a reference when measuring hardening compliance.

The total set of exposed entry points an adversary could use, including open ports, interfaces, accounts, and application features. Reducing it lowers overall risk.

Granting only the permissions required for a task, so accounts and services cannot exceed their intended function. It limits the impact of compromise or misuse.

An access model where permissions are assigned to roles rather than individuals, and users receive roles. It simplifies review and reduces excessive access.

Determining the exact software version in use through banners, headers, file hashes, or behavior, enabling accurate mapping to known vulnerabilities.

A public catalog assigning unique identifiers to specific disclosed vulnerabilities, enabling consistent reference across tools, advisories, and reports.

A framework producing a numeric severity score from characteristics such as exploitability, impact, and environmental context. Scores aid prioritization but do not replace business judgment.

A minimal, controlled demonstration that a vulnerability is exploitable in the target environment, providing evidence beyond a scanner's assertion.

Reproducing a suspected weakness under controlled conditions to establish it is real and exploitable, distinguishing genuine findings from scanner noise.

Human review of a suspected finding by inspecting requests, responses, configuration, or code, used to validate automated results and assess real-world impact.

A class of flaw where untrusted input is interpreted as code or commands by a downstream component, such as SQL, command, or template injection.

A flaw where attacker-supplied script executes in another user's browser, enabling session theft or page manipulation. Variants include reflected, stored, and DOM-based.

A failure to enforce who may perform an action or view a resource, enabling access to other users' data or privileged functions through direct requests.

An access flaw where a user-controlled identifier, such as an account or file number, grants access to another party's object because authorization is not checked.

Weak or default settings in servers, frameworks, or cloud services, such as verbose errors, open directories, or default credentials, that expose unnecessary risk.

Checking and constraining user-supplied data against expected type, length, format, and range before use, reducing malformed or malicious input reaching sensitive components.

Transforming data for the context where it is rendered, such as HTML or JavaScript, so special characters are treated as text rather than executable syntax.

An HTTP response header instructing browsers which sources of scripts, styles, and other content are allowed, limiting the impact of script injection flaws.

An HTTP response header that instructs the browser to enforce protections, such as HSTS, X-Content-Type-Options, or frame restrictions, reducing common client-side attacks.

Any system, application, or sensor that generates event records, such as operating systems, firewalls, or web servers, feeding detection and investigation activities.

The collection and transport of log data from sources into a central platform, including parsing and normalization so events can be searched and correlated.

Keeping clocks across systems aligned, usually via NTP, so events from different sources can be ordered correctly during correlation and incident reconstruction.

Logic that flags specified event patterns or conditions in log data, producing alerts for analyst review. Rules require tuning to balance coverage and noise.

Reviewing and prioritizing generated alerts to decide whether each is a true incident, a benign event, or a rule needing adjustment.

Recording artifacts that substantiate a finding, such as screenshots, command output, request and response pairs, and timestamps, in a form suitable for review.

A documented record of who handled evidence, when, and how, preserving integrity from collection through storage and analysis so it remains defensible.

Computing a cryptographic digest of evidence at collection and again later to demonstrate it has not been altered, supporting integrity claims in reports.

Assigning severity to a finding by combining technical impact with exploitability and business context, guiding remediation priority and owner attention.

A concise report section stating overall posture, key risks, and recommended priorities for leadership, written without jargon or excessive technical detail.

A structured list of actions to fix findings, including owners, target dates, and verification steps, forming the bridge between reporting and tracked closure.

An agreed maximum time to fix findings by severity, providing measurable deadlines that support tracking, escalation, and compliance reporting.

A formal decision by an accountable owner to tolerate a known finding without fixing it, documented with rationale, scope, and an expiry or review date.

Rechecking previously reported findings after remediation to confirm the fix works and did not introduce new weaknesses, closing the loop on the report.

Ordering events from multiple sources by time to understand how an activity unfolded, supporting both incident analysis and validation of test evidence.