Hardening, Firewalls and Intrusion Detection

Glossary

203 terms from Hardening, Firewalls and Intrusion Detection, in plain words, each with the chapter that teaches it.

Search the glossary

#

802.1X: A standard for controlling network access one switch port at a time. Each port asks for authentication before it gives a working connection, so a rogue access point that someone plugs in gets no access.

A

Access controls: Rules that decide which subject (a person, device or program) may reach which object (a file, server or segment) and what it may do there. When Alex removed the Everyone entry from the Payroll folder, Alex was fixing an access control.
Access point (AP): The device that provides Wi-Fi to nearby devices. A WIPS checks every access point it hears against the company's list of approved ones.
Account lockout: An account setting that locks an account after a number of failed logins, which stops password guessing. It does not stop someone who already has the correct password, and setting it too strictly locks out real staff.
ACL (access control list): A list of entries attached to an object. Each entry names a subject and the permissions it gets. Network ACLs filter traffic, and file system ACLs protect files and folders.
Agent: A small program installed on each computer. It collects that computer's logs or activity and sends them to a central system, such as a SIEM or a HIDS console.
Alert fatigue: What happens when people receive so many alerts, mostly false positives, that they stop reading them and miss the real one. Alex's system sent 300 emails a day and Alex missed a real alert in the pile.
Alerting: The second half of monitoring. When a rule finds an event that needs a person, the system tells the right person quickly, with a severity level. A good alert is actionable: the person knows what to check and what to do.
Allow list: An application control list of the programs that may run. Everything else is blocked, which means even brand-new malware cannot run. It fits fixed-purpose systems such as the Kettle & Crane shipping station.
Anomaly scoring: A WAF method that adds points for each rule a request matches and blocks the request once the total reaches a limit. In Alex's lab, four CRS matches gave a score of 20, well over the limit of 5.
Anomaly-based detection: Detection that first learns what normal activity looks like (the baseline) and then flags anything very different. It can catch new attacks but raises more false positives.
Antivirus: Software that finds known malware by comparing files with signatures. It can quarantine suspicious files. Gateway antivirus in a UTM scans files as they are downloaded.
API (application programming interface): The way programs request data from another system, such as the shop. Rate limiting protects an API from abuse.
App Control for Business: The application control feature built into Windows that Microsoft recommends as of 2026. Its rules can allow or block programs by publisher, hash or path.
Application control: A control that decides which programs may run on a device. The operating system refuses to start anything the rules do not allow. It comes in two styles: an allow list and a block list.
AppLocker: The older Windows application control feature, still widely used. Like App Control for Business, its rules work by publisher, hash and path.
Attack surface: All the ways an attacker could try to get into a system added together. Every running service, open port, account and program makes it bigger, and hardening makes it smaller.
Audit mode: A first rollout step for application control. The rules only log what they would have blocked and block nothing yet, so Alex can find legitimate programs before switching to enforcement.

B

Baseline: In monitoring and anomaly detection, the normal pattern of activity that new activity is compared with. For example, Jo usually downloads about 50 MB a day.
Benchmark: A published hardening guide that lists the secure settings for a type of system, such as the CIS Benchmarks. Alex follows one to harden SSH on the order server.
BIOS (Basic Input/Output System): The firmware older computers run before the operating system starts. Its settings decide things such as which disk the computer starts from. Many people also call UEFI the BIOS.
Block list: An application control list of the programs that may not run. Everything else is allowed. It is easy to run but stops only what is listed, so Alex uses one for the varied sales laptops.
Blocking mode: The WAF mode that actually stops requests matching its rules. In Alex's lab test it returned a 403 status code.
Brute force: An attack that tries password after password until one works. Rate limiting to a few tries a minute makes it far too slow to succeed.
BYOD (bring your own device): Staff using their own phones for work, as Priya does. MDM manages only a work profile on these devices and can selectively wipe it.

C

Canary account: A fake user account in the directory that looks real but is never used, such as Alex's "backup-admin". Any attempt to log in to it, successful or failed, triggers an alert.
Certificate: A digital credential that proves a server's identity and is used for encryption. Devices that check the Wi-Fi server's certificate resist evil twins, and a WAF holds the shop's certificate so it can decrypt requests.
Chain: In nftables, an ordered list of rules that is read from the top, like any firewall rule table.
CIS (Center for Internet Security): An organization that publishes the CIS Benchmarks, widely used hardening guides.
Configuration drift: The slow way a hardened system moves away from its secure settings over time, for example a port opened for a test and then forgotten. Regular checks against a secure baseline catch it.
Containment: Limiting the harm something can do instead of judging whether it is bad, which is how a sandbox works. A WIPS also contains a rogue access point over the air by stopping company devices from staying connected to it.
COPE (corporate-owned, personally enabled): Company-owned devices that staff may also use personally. They can still be fully managed and fully wiped.
counter: An nftables keyword that counts the packets and bytes each rule matches. Alex read the counters to see that 52 packets of the burst were dropped.
ct state: The nftables connection-tracking match. "established,related" lets in replies to connections already allowed (the stateful part), and "new" picks out new connections.
CYOD (choose your own device): The user picks a model from an approved list of company devices, and it is then managed as a company-owned device.

D

Data capture: One job of a honeynet's gateway: recording all traffic and activity so analysts can replay the attack later.
Data control: The other job of a honeynet's gateway: limiting outgoing traffic so attackers cannot use the honeynet to attack real systems or the internet.
DDoS (distributed denial of service): An attack that floods a service with traffic so real users cannot use it. A distributed attack comes from thousands of addresses, each staying under a per-address rate limit, so very large attacks need help from the internet provider or a cloud service.
Deauthentication attack: A flood of fake Wi-Fi "disconnect" messages that knocks devices off the network, often to push them toward an evil twin. Protected Management Frames make it fail.
Deception technology: Fake systems, files, data and accounts that look valuable but that nobody legitimate uses. Any touch is almost certainly an attacker, so the alert is very reliable.
Default password: A well-known login a device ships with, such as admin and 1234 printed in the manual. Attackers try these first, so changing them and removing unneeded built-in accounts is the first hardening step.
Deny by default: Starting from "no access" and adding only what is needed, as a firewall that blocks everything except listed traffic does. An allow list follows it, while a block list is allow by default.
Detection mode: A WAF mode that only logs what it would block, so false positives can be found before switching to blocking mode.
Detective control: A control that reveals harm or attacks rather than stopping them. IDSs, decoys and detonation sandbox reports are detective.
Detonation sandbox: A sandbox that a security product uses to open or run unknown files on purpose and judge them by what they do. The email service detonated Jo's "invoice_Oct" spreadsheet and saw it start PowerShell.
Digital signature: Proof of which publisher made a file and that the file has not changed since. Publisher rules in application control trust it, and Secure Boot uses it.
Directory: The central list of accounts that staff log in with. Canary accounts are planted there.
Directory traversal: A web attack that tries to reach files outside the website's folder. A WAF blocks it.
Disruption: Slowing an attacker down or sending them the wrong way, for example by keeping them busy on fake servers. DNS sinkholes, tarpits and fake telemetry disrupt more actively.
DNS sinkhole: A disruption tool that answers lookups for known bad domains with an address the defenders control. Malware calling home reaches the sinkhole instead, and the sinkhole's log shows which machines are infected.
Domain controller: A Windows server that holds the directory and checks logins. Kerberos and NTLM login checks for a canary account show up there as events 4771 and 4776.

E

EDR (endpoint detection and response): Endpoint protection software that watches for attacks on a computer and responds to them. Host-based intrusion detection and prevention is usually part of an EDR product today.
Egress filtering: Firewall rules that control traffic leaving a network or host. They can stop malware from calling out to its operator. Alex lets the Devices segment out only to the vendors' update servers.
Encrypted traffic: Traffic protected so that only the endpoints can read its content, as with HTTPS. Network sensors see only the addresses, ports and scrambled data (ciphertext) unless the traffic is decrypted first.
Endpoint: Any device a person uses at the edge of the network, such as a laptop, phone or tablet.
Enrollment: Joining a device to the MDM system so it can receive policies and apps. Company devices can be enrolled automatically on first start, while a personal device's owner installs the company's profile or app.
Event: A record that something happened, such as "user sam logged in at 08:02". Monitoring looks through many events to find the few that matter.
Event ID: The number Windows gives each kind of log entry: 4663 is an access to an audited object such as a honeyfile, 4624 and 4625 are successful and failed logins, 4771 is a failed Kerberos attempt and 4776 is an NTLM credential check on a domain controller.
Evil twin: An attacker's access point that copies the name of the company Wi-Fi to trick devices into joining it, so the attacker can watch their traffic.

F

Fail open and fail closed: What an inline NIPS does when it breaks down. Fail open lets traffic pass (availability first), and fail closed blocks everything (security first).
Fake telemetry: False data fed to attackers or malware, such as invented network maps or system details, so they make wrong choices.
False negative: A real attack that raises no alert. It is the most dangerous outcome, because nobody knows the attack happened.
False positive: An alert on something harmless, such as Sam mistyping a password or an antivirus scan opening a honeyfile. Too many of them cause alert fatigue, and in a NIPS they block real traffic.
FCC (Federal Communications Commission): The US agency that regulates radio. It has fined businesses for using Wi-Fi containment to block other people's hotspots.
File auditing: A Windows setting that records each access to a chosen file or folder in the Security log, with the account name. Alex turns it on for a honeyfile so that any opening writes event 4663 and raises an alert.
File integrity monitoring (FIM): A host-based feature that keeps a hash of important files and alerts when one changes. A changed system program is a classic sign of an intruder.
File system ACL: An ACL on files and folders. On Windows it lists users and groups with permissions such as Read, Modify and Full control. On Linux, a string such as -rw-r----- gives permissions to the owner, the group and everyone else.
Firewall: A device or program that allows or blocks traffic by rules. At Kettle & Crane it controls what may cross between the office VLANs and what may reach the shop.
Firmware: The software built into a device, such as a printer's control software or a computer's BIOS/UEFI. It needs updating like any other software.
Flat network: One big network where every device can talk to every other device. One infected device can reach everything else.
FTP (File Transfer Protocol): An old protocol for moving files without encryption, usually on port 21. Hardening means disabling it when it is not needed, as on the order server.
Full wipe: Erasing a whole device from afar and returning it to factory settings. It fits company-owned devices such as Sam's lost phone.

G

Geofencing: An MDM feature that changes a device's settings based on where it is, such as turning off the camera in the warehouse.
grep: A Linux command that keeps only the lines of text matching a pattern. Alex used it to pick out the SSH settings to check.

H

Hardening: Setting up a system so it has fewer weaknesses: changing defaults, removing what is not needed, using secure protocols, patching and turning on protections. Alex hardened the new label printer before it went into use.
Hash: A short, fixed-length fingerprint calculated from a file's contents. Changing one byte changes it completely. A hash rule in application control matches one exact file but breaks on every update.
Header: The label at the front of a packet that holds addresses, the protocol and ports. A layer 4 firewall reads only the header.
HIDS (host-based intrusion detection system): Software on one computer (the host) that watches its logs, files, programs and decrypted traffic and raises alerts. Alex put one on the order server because its traffic is encrypted.
High-interaction honeypot: A honeypot that is a real operating system with real services, built to be broken into. It teaches more about attackers but is riskier.
HIPS (host-based intrusion prevention system): A HIDS that can also block harmful actions on its host, such as a program writing into system folders or changing startup settings.
Honeyfile: A fake file with a tempting name, such as "Salaries 2026 FINAL.xlsx", watched with file auditing. It trips when someone opens it.
Honeynet: A network of honeypots behind a gateway. It shows how attackers move between systems and which tools they use.
Honeypot: A fake system that looks like a real server or device but holds nothing of value. It exists to attract attackers and record what they do, like Alex's fake "kc-files" login on port 23.
Honeytoken: A fake piece of data, such as a customer record with a unique email address or a fake cloud access key, planted among real data. It trips when the data is used, even far away and much later.
Host: A single computer, such as the order server, as watched by host-based tools.
Host-based firewall: Firewall software on one computer that filters that computer's own traffic, like the nftables rules on the shop server.
HTTP (Hypertext Transfer Protocol): The web protocol, usually on port 80. It sends data, including passwords, as plain text.
HTTP status codes: Numbers a web server sends back with each answer. 200 OK: answered normally; 403 Forbidden: refused, as when the WAF blocked an attack; 429 Too Many Requests: over the rate limit, slow down.
HTTPS: The encrypted form of HTTP, usually on port 443. It protects passwords and data, but network sensors cannot see inside it unless it is decrypted.

I

IDS (intrusion detection system): A tool that watches activity, recognizes attacks and raises an alert but does not stop them. It is a detective control, like a burglar alarm.
Implicit deny: The invisible final rule at the end of an ACL or firewall rule list that blocks anything no earlier rule matched. Priya's request to open the Payroll folder fell to it.
Inbound rules: Firewall rules that control traffic coming into a network or host.
Incident response plan: The company's written steps for handling an attack. Alex followed it after two decoys tripped from Sam's laptop.
Inline: Placed so that all traffic passes through the device, like a checkpoint on a road. A NIPS must be inline to drop packets.
Intrusion: Any attempt to get into or misuse a system or network without permission.
IoT (Internet of Things): Smart devices such as cameras, printers and thermostats. Many cannot run security software and get few updates, so they rely on segmentation and hardening.
IP (Internet Protocol): The protocol that gives devices addresses such as 10.40.0.15. Firewall rules and subnets are written in IP addresses.
IPS (intrusion prevention system): A tool that does everything an IDS does and can also stop the attack as it happens, by dropping traffic or blocking actions. It is a preventive control.

J

Jailbreaking: Removing the iPhone maker's restrictions so the owner can run anything. This also removes app sandboxing, so MDM marks such devices noncompliant.

K

Kerberos: A network login (authentication) protocol that Windows domains use, checked by the domain controllers. A failed Kerberos attempt for a canary account appears as event 4771.
Kiosk mode: An MDM setting that locks a device to one app, like the trade show tablets that run only the newsletter sign-up app.

L

Lateral movement: An attacker moving sideways from the first device they break into toward more valuable ones. Segment boundaries and internal honeypots stop it or reveal it.
Layer 3: The network layer of the layered model, which carries the IP header with source and destination addresses and the protocol.
Layer 4 firewall: A firewall that decides by addresses, protocol, ports and connection state. It is fast, but it cannot tell apart two apps that use the same port.
Layer 7 firewall: A firewall that also reads content and identifies the application. It can allow approved cloud storage but block a file sharing app, even though both use port 443.
Least privilege: Giving each subject only the permissions it needs for its job and nothing more, for example by granting permissions to groups and using separate admin accounts.
Low-interaction honeypot: A honeypot that only pretends to run services, answering on a few ports and logging attempts. It is simple and safe because there is no real system to take over.

M

Macro: A small program inside a document. Clicking "enable content" runs it, as Jo's fake invoice spreadsheet wanted.
Malware: Harmful software. Ransomware, for example, encrypts files and demands payment.
MDM (mobile device management): Software that lets an organization enroll, configure, check and remotely lock or wipe mobile devices from one central console.
Microsegmentation: Putting a boundary around each single server or workload, such as letting the shop database accept only the web servers' security group on port 5432.
Mirror port: A switch port set to send out a copy of the traffic from other ports. A NIDS attached to it can watch but cannot block.
Mitigating controls: Controls that make a risk smaller, either less likely to happen or less harmful when it does. They are the subject of objective 4.1.
ModSecurity: A WAF engine that works with the OWASP CRS rules. Alex ran it as a module in nginx.
Monitoring: Collecting information about systems, networks and users all the time and checking it for signs of trouble. Alerting then tells a person about what matters.

N

Network ACL: An ordered list of allow and deny entries on a router or firewall, checked against each packet's addresses and ports. The first match wins, and the implicit deny catches the rest.
Network firewall: A firewall device that sits between networks, such as between the internet and the office or between two segments.
Network tap: A small device that copies the traffic on a cable for a NIDS.
nftables: The firewall built into Linux. Alex's shop.nft file uses it for the shop server's host-based firewall and rate limit.
NGFW (next-generation firewall): An application-aware (layer 7) firewall combined with intrusion prevention.
nginx: A common web server. Alex used it with the ModSecurity module for the WAF lab test.
NIDS (network-based intrusion detection system): A sensor beside the network that gets a copy of the traffic from a mirror port or tap and alerts on attacks. It can never break traffic, but it cannot block either.
NIPS (network-based intrusion prevention system): A network sensor placed inline so every packet passes through it and attacks can be dropped. Its mistakes affect real traffic.
NIST (National Institute of Standards and Technology): The US standards body. Its server guide says to install only what is needed and to patch.
Noncompliant: The MDM status for a device that breaks a policy, such as an old operating system or a jailbreak. The company can block it from email until it is fixed.
NTLM: An older Microsoft login (authentication) protocol, still checked by Windows domain controllers. An NTLM check for a canary account appears as event 4776.

O

Object: In access control, the thing being reached, such as a file, folder, server or segment.
OWASP (Open Worldwide Application Security Project): A project that publishes free web security resources, including the Core Rule Set for WAFs.
OWASP CRS (Core Rule Set): A widely used free WAF rule set from OWASP that flags attacks such as SQL injection and blocks requests by anomaly scoring.

P

Packet: A small unit of network traffic, made of a header (addresses, protocol, ports) and a payload (the actual data). Firewalls and network ACLs check traffic packet by packet.
Password spraying: Trying one common password against many accounts. It will also hit a canary account and give it away.
Patching: Installing the vendor's updates that fix known flaws in the operating system, programs and firmware. It is one step inside hardening, not the whole of it.
Payload: The actual data inside a packet, behind the header. A layer 7 firewall reads it.
pcap: A recorded capture of network traffic saved as a file. Alex replayed one through Suricata to test the SQL injection rule.
PCI DSS (Payment Card Industry Data Security Standard): The card industry's security standard. It does not require segmentation, but good segmentation can reduce how many systems an assessment has to cover.
Permissions: What a subject may do with an object, such as read, change, delete, connect or run.
policy drop: The nftables default action for a chain. It drops anything no rule accepted, which acts as the implicit deny.
Port: A numbered door through which a network service listens, such as 22 for SSH, 443 for HTTPS or 554 for camera video. The word also means a physical socket on a switch.
PowerShell: A Windows command tool. The malicious macro in Jo's invoice started it to download a program.
Preventive control: A control that stops harm before it reaches real systems, such as a sandbox or an IPS.
Production: The real systems the business runs on, kept apart from test sandboxes.
Protected Management Frames (PMF): A Wi-Fi protection that WPA3 requires. It makes deauthentication floods fail.
Publisher rule: An application control rule that trusts a vendor's digital signature, so it keeps working after that vendor's updates. Alex used publisher rules on the shipping station.

Q

Quarantine: An antivirus action that moves a file already judged suspicious to a locked area where it cannot run at all, until someone deletes or releases it.

R

Rate limiting: Capping how many requests one client may make in a period, such as 5 login attempts a minute. Requests over the cap are delayed or refused. It slows brute force, scraping and floods.
RFC: One of the internet's official standards documents. RFC 6585 defines the 429 Too Many Requests status code.
Rogue access point: An access point connected to the company network without approval, such as the "KC-Warehouse" AP. It opens a hole straight past the firewall.
Root: The all-powerful admin account on Linux. It should never log in directly over the network.
Rooting: The Android version of jailbreaking: removing the maker's restrictions so the owner can run anything.
Rule shadowing: A firewall mistake where a general rule placed too high matches first and hides a more specific rule below it, as when the allow for port 443 hid the deny for 192.0.2.66.
Rule-based firewall: A firewall that compares each packet with an ordered list of rules (source, destination, protocol, port, action). The first match decides, and the implicit deny catches the rest.

S

Sandbox: An isolated, throwaway space where a program or file can run but cannot reach real files, settings or networks. Examples are browser and app sandboxes, disposable desktops, detonation sandboxes and test sandboxes.
Scraping: A program copying a whole website's content, such as the shop's catalog and prices. Rate limiting slows it.
Screened subnet: The small network between the internet and the internal network where public servers, such as the shop, live.
Secure baseline: The written set of settings each type of system must have. Alex checks systems against it after every change and on a schedule.
Secure Boot: A UEFI feature that lets only signed, trusted startup software run.
Security groups: In the cloud, firewall rules attached to each server. The shop's database security group allows only the web servers on port 5432.
Segmentation: Splitting a network into smaller parts and controlling the traffic between them, as Alex did with the four office VLANs. It stops lateral movement and contains incidents.
Selective wipe: Removing only the work container, its apps and its data from a device and leaving personal data alone. It fits personal phones like Priya's.
Severity: The level an alert is given (critical, high, medium or low), which decides how it reaches a person. A critical alert goes to a phone at any hour, while a low one goes into a daily report.
SIEM (security information and event management): The central system that gathers security events from many sources and checks them against rules to raise alerts.
Signature: A pattern of known malware or a known attack, used by antivirus and IDS/IPS rules. Brand-new malware has no signature yet.
Signature-based detection: Detection that compares activity with a list of known attack patterns. It gives few false positives when well tuned but misses attacks with no signature.
Single point of failure: One part whose failure stops everything it does, as with a UTM. A second unit in a failover pair fixes this.
Site-to-site VPN: An encrypted tunnel between two sites. Office admins reach the shop over one, so their traffic arrives from the office's private addresses.
SQL (Structured Query Language): The language used to talk to databases, with commands such as UNION SELECT.
SQL injection: An attack that hides database commands such as UNION SELECT inside a web request. Suricata detected it in Alex's lab and the WAF blocked it with a 403.
SSH (Secure Shell): An encrypted remote login protocol on port 22, the secure replacement for Telnet. Alex hardened its settings on the order server.
SSH key: A secret key file on a person's own computer, used to log in over SSH instead of a password.
sshd: The SSH server program. "sshd -t" checks its settings files for mistakes, and "sshd -T" prints the settings it will really use.
Stateful firewall: A firewall that remembers each connection it allowed and lets the replies back in without a separate rule.
Stateless firewall: A firewall that checks each packet on its own, with no memory, so it needs rules for both directions.
Subject: In access control, whoever is asking for access: a person, a device or a program.
Subnet: A range of IP addresses, such as 10.20.0.0/24, given to one segment so the router and firewall rules can tell the segments apart.
sudo: A Linux command prefix that runs a command with admin rights, as in "sudo sshd -t" or "sudo python3 honeypot.py".
Suricata: A free, open source IDS and IPS. Its rules start with an action (alert or drop) and match patterns. In IDS mode it detected Alex's SQL injection test but let it through.

T

Tarpit: A disruption tool that deliberately answers connections very slowly, so a scanner or spam sender wastes its time.
TCP (Transmission Control Protocol): One of the two common ways to carry data between programs, using connections and numbered ports. In nftables, "tcp dport" means the TCP destination port.
Telnet: An old remote login service on port 23 that sends passwords in plain text. Hardening turns it off, and Alex's honeypot imitates it.
Threshold: An alert rule type that fires when a count passes a limit, such as 10 failed logins in 5 minutes; a threshold of 1 fires on a single event, such as any touch on a decoy. The other two rule types are change rules (something important changed) and anomaly rules (something differs from the baseline).
Time-of-day restriction: An access control condition that allows logins only inside a set window, like the warehouse temps' 7 a.m. to 4 p.m. It refuses even a correct password outside those hours.
TLS (Transport Layer Security): The encryption behind HTTPS. A WAF usually terminates the site's TLS, meaning it holds the certificate and decrypts each request.
TLS inspection: A layer 7 firewall decrypting HTTPS traffic, checking it and encrypting it again. Staff devices must trust the firewall's certificate.
True negative: Normal activity that correctly raises no alert.
True positive: An alert on a real problem, which is the goal of alerting.

U

UDP (User Datagram Protocol): The other common way, besides TCP, to carry data between programs on numbered ports.
UEFI (Unified Extensible Firmware Interface): The modern firmware that replaced the BIOS. Hardening it means setting an admin password, booting only from the internal disk and turning on Secure Boot.
UEM (unified endpoint management): A management tool like MDM that also manages laptops.
UTM (unified threat management): One appliance that bundles a firewall, IPS, gateway antivirus, web filtering, VPN and spam filter under one console. It suits a small team like Alex's but is a single point of failure.

V

Virtual machine (VM): A complete computer simulated in software, running on a real one. Sandboxes often use one and reset it after each use.
Virtual patch: A WAF rule that blocks requests exploiting a known flaw until the vendor's real fix is installed.
VLAN (virtual local area network): A way to make one physical switch act as several separate switches. Kettle & Crane's staff (20), guest (30), servers (40) and devices (50) each get their own VLAN.
VPN (virtual private network): An encrypted connection back to the company network, used by staff working remotely such as Sam on the road.

W

WAF (web application firewall): A layer 7 firewall in front of a web server that reads every request and blocks attacks such as SQL injection, XSS and directory traversal. It usually terminates TLS, so it can read HTTPS requests.
Web filtering: Blocking categories of websites, a common UTM feature.
WIDS (wireless intrusion detection system): A wireless sensor system that only alerts on Wi-Fi threats and does not act.
Windows Sandbox: A disposable desktop sandbox built into the Pro, Enterprise and Education editions of Windows 10 and 11. It runs a fresh, lightweight copy of Windows in a small VM and deletes everything when closed.
WIPS (wireless intrusion prevention system): Sensors that listen to the Wi-Fi radio space and compare what they hear with the approved access points. They find and contain rogue APs and evil twins, for example by shutting the switch port a rogue AP is plugged into.
Work profile: A separate, encrypted area on a phone that holds work apps and data. The company can manage and wipe only that area. Android calls it a work profile, and Apple calls this kind of enrollment User Enrollment.
WPA2/WPA3 Enterprise: Wi-Fi security where each user or device logs in to an authentication server instead of sharing one Wi-Fi password. When devices are set to check that server's certificate, they will not hand their passwords to an evil twin.
WPA3: The current Wi-Fi security standard. It requires Protected Management Frames, which defeat deauthentication floods.

X

XSS (cross-site scripting): A web attack that slips a script into a page other users will see. A WAF blocks it.

Z

Zero-day: Malware or a flaw nobody has seen before, so it has no signature yet. Detonation sandboxes and allow lists can still stop it.