Check Point CCCS key terms

A division of security duties between a cloud provider and its customer. The provider secures the physical infrastructure and managed services; the customer secures data, identities, configurations, and workloads they deploy.

Three delivery tiers of cloud computing. IaaS supplies virtual machines and networks, PaaS supplies managed runtimes and databases, SaaS supplies finished applications. The boundary of customer responsibility shifts with each model.

The cloud provider's system for defining users, roles, policies, and permissions over resources. Misconfigured IAM policies are a leading cause of cloud breaches and a frequent posture finding.

Granting only the permissions needed for a task, for the shortest practical time. In cloud environments this means narrow IAM policies, scoped roles, and avoidance of wildcard administrative grants.

An identity or service role holding far more rights than its function requires, such as full administrator access on a workload that only reads one bucket. It widens blast radius if compromised.

An isolated software-defined network inside a public cloud, with its own address range, subnets, route tables, and gateways. Equivalent concepts exist as VNet in Azure and VPC in Google Cloud.

A range of IP addresses carved out of a VPC and tied to an availability zone. Subnets are labeled public or private depending on whether their route table reaches an internet gateway.

A set of rules that decides where traffic leaving a subnet is sent. Security inspection designs typically steer traffic through a firewall endpoint by editing routes.

A stateful virtual firewall attached to individual cloud resources that permits or denies traffic by protocol, port, and source. It is allow-list based and evaluated before network ACLs in most providers.

A stateless subnet-level filter that permits or denies traffic by rule order. Because it is stateless, return traffic must be explicitly allowed in both directions.

A horizontally scaled cloud component that connects a VPC to the public internet. Instances reach it only when their subnet route table points to it and they hold public addresses.

A managed service that lets private-subnet resources initiate outbound internet connections without accepting inbound ones. It translates source addresses so internal ranges stay hidden.

A direct private network link between two VPCs that routes traffic over the provider backbone. It is non-transitive, so hub-and-spoke designs need a transit gateway instead.

A regional network hub that connects many VPCs, on-premises links, and VPNs through a single attachment point. It supports transitive routing and centralized inspection architectures.

A topology where spoke networks send traffic to a central hub VPC that hosts firewalls, then onward to destinations. It centralizes policy, logging, and egress control.

A provider construct that transparently redirects traffic to a fleet of third-party virtual appliances using encapsulation. It enables scale-out firewall insertion without changing application addressing.

Network traffic moving between workloads inside the same cloud environment or data center. It often bypasses perimeter controls, so internal segmentation and inspection are required.

Traffic crossing the boundary between the cloud environment and external networks such as the internet or on-premises data centers. It is the traditional focus of perimeter firewalls.

Granular workload-level policy that permits only specific application flows between individual instances or services. It limits lateral movement after a compromise.

Controlling and inspecting outbound traffic from cloud workloads. It blocks data exfiltration and command-and-control callbacks that would otherwise pass through permissive outbound rules.

A Check Point virtual security gateway image deployed into a public cloud to enforce firewall, IPS, application control, and threat prevention policy on cloud traffic.

The Check Point component that stores policy, manages gateways, and distributes installed policies. In cloud deployments it may run in the cloud, on-premises, or as a managed service.

The act of compiling a security policy on the management server and pushing it to gateways. Gateways enforce only the last policy successfully installed on them.

A named collection of rulebases and inline layers that a management server installs onto selected gateways. Different packages can serve different environments or tenants.

A Check Point mechanism where a gateway fetches its configuration and policy from the management server at first boot using a one-time key or profile, removing manual steps.

A plugin that lets Terraform declare and manage infrastructure such as cloud networks and Check Point gateways as code, enabling repeatable, version-controlled deployments.

Managing networks, firewalls, and cloud resources through declarative definition files rather than manual console changes. It provides repeatability, review, and drift detection.

Continuous assessment of cloud configurations against security benchmarks and policy. It detects exposed storage, weak encryption, permissive networking, and missing logging across accounts.

A published set of controls used to judge cloud environments, such as CIS Benchmarks, PCI DSS, or SOC 2. Posture tools map findings to these controls for reporting.

A cloud setting that weakens security, such as a public storage bucket, an open management port, or disabled audit logging. It is the most common root cause of cloud incidents.

The action that corrects a detected posture or threat finding, whether performed manually, through a script, or automatically by the platform. It closes the gap between detection and risk reduction.

Divergence between the deployed state of an environment and its intended, codified baseline. Drift reintroduces risk and is detected by comparing live resources to policy.

Security controls applied directly to running compute, including servers, containers, and serverless functions. It covers vulnerability scanning, runtime threat detection, and file integrity.

Inspecting container images for vulnerable packages, embedded secrets, and malware before deployment. Scanning in the build pipeline prevents flawed images from reaching production.

Compute that runs on demand without customer-managed servers, such as functions and managed containers. Protection focuses on code, permissions, and event sources rather than host hardening.

A predefined sequence of actions triggered by a security event, such as isolating an instance or revoking keys. Playbooks shorten response time and enforce consistent handling.

The former product name for Check Point's cloud posture and compliance platform, now branded CloudGuard Posture Management. Candidates may still see the older name in documentation.

The scope of resources and data reachable from a compromised identity or workload. Segmentation, least privilege, and scoped network paths all reduce it.