Fortinet FCA key terms

A Fortinet next-generation firewall appliance or virtual machine that inspects and controls traffic, combining firewall, VPN, intrusion prevention, antivirus, and web filtering in a single policy engine.

The operating system that runs on FortiGate devices and many other Fortinet products, providing the configuration interface, routing, security profiles, and policy enforcement logic.

Fortinet's architecture for connecting firewalls, endpoints, cloud, and management products so they share threat intelligence and coordinate response across the extended network.

A configuration setting on a FortiGate that authorizes another Fortinet device or product to join the Security Fabric and exchange telemetry and policy information.

Fortinet's internal threat research organization that discovers malware, vulnerabilities, and attack campaigns and feeds signatures and intelligence into FortiGuard subscription services.

Subscription-based updates and cloud lookups, such as antivirus signatures, IPS signatures, web categorization, and DNS filtering, that Fortinet delivers to licensed products.

Unified Threat Management: the practice of consolidating multiple security functions, such as firewall, antivirus, IPS, and content filtering, into one appliance and one policy flow.

Next-generation firewall: a firewall that goes beyond port and address filtering to identify applications and users and to apply intrusion prevention and other deep inspection within policy.

A group of inspection settings on FortiGate, such as antivirus, IPS, web filter, or application control, that is attached to a firewall policy to scan matching traffic.

The rule on a FortiGate that matches traffic by source, destination, service, and user, then decides whether to allow or deny it and which security profiles to apply.

A logical grouping of one or more FortiGate interfaces that lets policies and routing refer to the group rather than to individual physical ports.

Virtual Domain: a partitioned, independent configuration inside one FortiGate, with its own interfaces, policies, routing table, and administrators, used for multi-tenant separation.

A FortiGate object that defines what an administrator account may view or change, and whether access is limited to specific VDOMs or trusted source networks.

Intrusion Prevention System: inspection that compares traffic against known attack signatures and behavior patterns and can block sessions that match malicious activity.

The ability to identify traffic by the application generating it, regardless of port, and then allow, block, or limit that application through policy.

A service that classifies websites into categories and enforces allow or block decisions per category or URL, often using a cloud rating database.

A control that resolves domain lookups through a security service so known malicious or disallowed domains can be blocked before a connection is established.

The process of decrypting TLS traffic at the firewall, inspecting it with security profiles, and re-encrypting it, so encrypted threats and hidden applications can be detected.

A lighter form of SSL inspection that reads only the server certificate and connection metadata, such as the server name, without decrypting the payload.

Software-defined WAN: the use of multiple WAN links with policy-based path selection so business-critical traffic uses the best-performing or most reliable connection.

A standards-based tunnel that encrypts and authenticates traffic between sites or remote users, commonly configured on FortiGate for site-to-site connectivity.

A remote-access method that uses TLS to give individual users a secure connection into the network, typically through a web portal or a tunnel client.

Requiring a second proof of identity, such as a one-time code or token, in addition to a password before granting access to a system or VPN.

A security model that assumes no implicit trust based on network location and instead verifies identity and device posture for every access request.

Zero Trust Network Access: a brokered access method that grants users reach to specific applications rather than the whole network, after checking identity and device context.

Secure Access Service Edge: a cloud-delivered model that combines network connectivity services with security functions such as secure web gateway, firewall, and zero trust access.

Security Service Edge: the security-focused subset of SASE, covering cloud-delivered secure web gateway, cloud access security broker, and zero trust network access.

Cloud Access Security Broker: a control point that discovers cloud application use and enforces policy on data moving to and from SaaS services.

Secure Web Gateway: a proxy-based control that filters web traffic, blocks malicious sites, and enforces acceptable-use policy for users, whether on-site or remote.

Cloud applications and services used inside an organization without IT approval or visibility, which creates data exposure and compliance risk.

A centralized management product for administering many Fortinet devices, pushing policy and configuration, and maintaining consistent settings across an estate.

A logging, reporting, and analytics product that collects events from Fortinet devices and supports investigations, compliance reporting, and threat correlation.

An endpoint agent that provides secure remote access, endpoint protection, and posture information that can be shared with the Security Fabric.

Security Information and Event Management: a platform that aggregates logs from many sources, correlates events, and alerts analysts to suspicious activity.

Security Operations Center: the team, processes, and tooling responsible for continuously monitoring, detecting, and responding to security incidents.

Managed Detection and Response: an outsourced service in which a provider operates monitoring, detection, and response on behalf of the customer.

The structured process of preparing for, identifying, containing, eradicating, and recovering from a security incident, followed by lessons learned.

A vulnerability or exploit for which no vendor patch or public signature yet exists, making signature-based detection unreliable on its own.

Running suspicious files or code in an isolated environment to observe behavior safely and derive detection intelligence without risking production systems.

Granting users and systems only the access strictly needed for their tasks, which limits the damage an account compromise can cause.

Dividing a network into small, isolated segments with tightly scoped rules so lateral movement between workloads is blocked even after one host is compromised.