Check Point CCMS key terms

A security topology in which on-premises gateways, cloud virtual gateways, and remote endpoints share one policy and one management plane, so traffic can be inspected consistently regardless of where it originates or terminates.

A Check Point enforcement device that inspects traffic using blades such as firewall, IPS, application control, and threat emulation, and that reports status to a management server.

The central component that stores objects, rules, and logs, compiles policy into an installable package, and pushes it to gateways. It does not inspect traffic itself in a distributed deployment.

A deployment where one management installation serves several independent domains, each with its own administrators, objects, and policies, commonly used by service providers or large enterprises separating business units.

An isolated container inside a multi-domain management environment holding its own gateways, objects, rules, and administrator accounts, so changes in one domain cannot affect another.

The process of validating, compiling, and transferring a rulebase to an enforcement gateway, after which the gateway enforces the new ruleset and reports success or failure back to management.

The location in the traffic path where rules are actually applied, such as a gateway, a virtual switch, or an endpoint agent. Placement determines what traffic can be seen and blocked.

A licensed, independently enabled function on a gateway or management server, such as firewall, IPS, antivirus, or application control, allowing features to be turned on per deployment need.

Check Point's current gateway appliance and virtual image family, delivering firewall, threat prevention, and VPN functions with hardware or software acceleration depending on model.

An architecture that pools multiple gateway appliances behind a single virtual system, distributing traffic across them and scaling inspection capacity horizontally without changing the security policy model.

A logically separated gateway instance running on shared hardware, each with independent policy, interfaces, and logs, often used to serve multiple tenants from one appliance.

An encrypted tunnel between two gateways that lets separate networks communicate privately over an untrusted medium, typically negotiated with IKE and protected by IPsec parameters.

A service that lets individual users connect securely to corporate resources from anywhere, authenticating the user and device before granting access to internal networks or applications.

The protocol that negotiates security associations for IPsec, authenticating peers and agreeing on encryption and integrity algorithms before protected traffic can flow.

The set of local and remote network ranges whose traffic is protected by a VPN tunnel; mismatched definitions are a common cause of tunnels that establish but pass no useful traffic.

A blade that associates network traffic with a verified user or machine identity, obtained through agents, browser-based authentication, or directory integration, so rules can match people rather than only addresses.

An object that groups users or groups with network locations and time constraints, letting a single rule express identity-based access instead of enumerating many address pairs.

The ordered set of rules a gateway evaluates for each connection, where the first matching rule decides the action and implicit cleanup handles unmatched traffic.

A combined gateway capability that applies intrusion prevention, antivirus, and reputation data to traffic, blocking known malicious patterns and suspicious behavior inline rather than only alerting.

Protection of the collaboration and productivity layer, including email, browsers, SaaS applications, and endpoint data, so users can work anywhere without exposing sensitive information or falling for phishing.

Inspection of inbound and outbound mail for malware, phishing links, impersonation, and unwanted content, applying detonation and reputation checks before messages reach the user inbox.

Policy and inspection controls that detect sensitive information such as credentials, financial records, or personal data leaving the organization, then block, encrypt, or alert on the transfer.

An access model that grants users reachability only to the specific applications they need, verifying identity and device posture per request instead of trusting a network location.

Visibility and control over cloud applications used by staff, covering sanctioned and unsanctioned services, sharing settings, and data movement between the organization and third-party platforms.

Applications and services adopted by employees without security review, creating unmonitored data flows and requiring discovery through traffic analysis rather than policy enforcement alone.

Classification and enforcement over which applications and categories may be used on the network, including granular actions for specific functions inside an otherwise allowed application.

Agent-based protection on user devices covering malware, exploitation, disk encryption, and posture reporting, often the last enforcement point when traffic is encrypted end to end.

An evaluation of device state, such as patch level, encryption status, or running agent version, used to decide whether a device may access a resource or must be remediated first.

A controlled exercise that sends realistic but harmless lure messages to staff and measures who clicks or reports them, producing training targets and a reporting-culture metric.

Structured education that builds staff recognition of social engineering, safe data handling, and reporting habits, usually paired with measured exercises and role-specific content.

A continuous discipline that discovers internet-facing and internal assets, identifies exploitable weaknesses and misconfigurations, and prioritizes remediation by real risk rather than raw severity scores.

The total set of reachable services, ports, applications, identities, and cloud resources an adversary could attempt to use, including assets the organization has forgotten it owns.

The process of finding and inventorying hosts, domains, certificates, and cloud workloads, often combining passive traffic observation with active scanning and external reconnaissance.

Ranking findings by exploitability, exposure, asset criticality, and available threat intelligence so teams fix the issues most likely to be used against them first.

A chain of weaknesses and permissions an intruder could follow from an initial foothold to a valuable target, showing where breaking one link prevents the whole intrusion.

Observable artifacts such as malicious file hashes, domains, or addresses that suggest an intrusion, used to hunt for and block activity already seen in the wild.

Curated information about adversaries, their tools, and infrastructure, fed into detection and prevention systems so defenses reflect current campaigns rather than static signatures.

Protecting machine-learning systems and the data and infrastructure around them from manipulation, theft, and misuse, plus governing how AI tools are adopted inside the organization.

An attack where crafted input, hidden in text or documents the model reads, overrides the developer's instructions and steers the model into unintended actions or disclosures.

A technique that bypasses a model's safety or usage restrictions by reframing the request, so the model produces content its operators intended to refuse.

Tampering with training or fine-tuning data so a model learns skewed behavior, such as misclassifying specific inputs or embedding a trigger an attacker can later activate.

The policies, inventory, and approval process that determine which AI services staff may use, what data may be submitted, and how outputs are reviewed before affecting customers or systems.

Use of generative AI tools and browser extensions without organizational approval, which can leak confidential input, bypass data controls, and escape normal logging and review.