Glossary terms starting with W

21 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.

WPA3Information Security: The latest Wi-Fi Protected Access security protocol providing enhanced encryption, protection against brute force attacks, and improved security for open networks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Walk-ThroughAudit: An audit procedure in which the auditor traces a single transaction from initiation through final recording to verify that controls are in place and operating as described. Walk-throughs are used to understand and document business processes.Used in: ISO 27001:2022, PCI DSS v4.0
War RoomInformation Security: A dedicated physical or virtual space where incident response teams gather during major security incidents to coordinate response activities.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Warm SiteBusiness Continuity: A backup facility that has some but not all the hardware and connectivity needed for operations, requiring some setup before becoming fully operational.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Water DetectionInformation Security: Sensors and monitoring systems that detect water leaks or flooding in facilities to prevent damage to IT equipment and infrastructure.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Watering Hole AttackInformation Security: A targeted attack strategy where the attacker compromises a website frequently visited by the intended victims. When targets visit the compromised site, they are infected with malware tailored to exploit their specific vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Web Application FirewallInformation Security: A security solution that monitors, filters, and blocks HTTP/HTTPS traffic to and from web applications to protect against web-based attacks.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Web Application Firewall (WAF)Information Security: A security solution that monitors, filters, and blocks HTTP/HTTPS traffic to and from a web application. WAFs protect against web-based attacks including SQL injection, cross-site scripting, and other OWASP Top 10 threats.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, NIST SP 800-53 Rev 5
Web Application ScanningInformation Security: Automated security testing of web applications to identify common vulnerabilities such as SQL injection, XSS, and authentication weaknesses.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Web SecurityInformation Security: Security measures for protecting websites, web applications, and web services from attacks including injection, cross-site scripting, and authentication bypass.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
WhalingInformation Security: A highly targeted phishing attack aimed at senior executives or other high-profile individuals within an organisation. Whaling attacks are carefully crafted to appear as legitimate business communications.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Whistleblower ProtectionCompliance and Regulatory: Legal safeguards and organizational policies that protect individuals who report illegal, unethical, or non-compliant activities from retaliation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
White Box TestingInformation Security: A security testing approach where the tester has full knowledge of the target system including source code, architecture, and credentials.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Wi-Fi SecurityInformation Security: Security protocols and practices for protecting wireless local area networks, including WPA3 encryption, access control, and rogue AP detection.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Window SecurityInformation Security: Physical measures to protect windows in facilities from break-in attempts, including security film, bars, sensors, and shatter-resistant glass.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Wireless Penetration TestingInformation Security: Authorized security testing of wireless networks and their security controls to identify vulnerabilities in wireless infrastructure and configurations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Wireless SecurityInformation Security: Protocols and practices for protecting wireless networks from unauthorized access and attacks, including WPA3 encryption, SSID management, and rogue AP detection.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Work Area RecoveryBusiness Continuity: The provision of alternative workspace for employees when primary office facilities are unavailable due to a disruption or disaster.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
WorkaroundBusiness Continuity: A temporary alternative process or procedure used to maintain operations when normal systems or processes are unavailable.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Workforce IdentityInformation Security: The digital identity management of employees, contractors, and partners who need access to organizational systems and resources.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
WormInformation Security: A type of malware that self-replicates and spreads across networks without requiring user interaction or a host programme. Worms can consume bandwidth, overload systems, and deliver additional malicious payloads.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Terms starting with V All letters Terms starting with Z