Fortinet FCF key terms

Fortinet's approach of linking firewalls, switches, access points, endpoints, and cloud tools so they share threat intelligence and coordinate a single response instead of each device acting alone.

Fortinet's firewall and gateway product line that performs stateful inspection, application control, intrusion prevention, VPN, and web filtering, and can act as the central enforcement point of the Security Fabric.

The operating system that runs on FortiGate and many other Fortinet appliances, providing the configuration interface, routing, policy engine, and logging used across the product family.

A bundle of inspection settings such as antivirus, IPS, web filter, application control, and SSL inspection that is attached to a firewall policy to scan matching traffic.

A rule that matches traffic by source, destination, service, and schedule, then defines whether to accept or deny it and which security profiles and logging apply.

Unified Threat Management: combining several security functions such as firewall, antivirus, intrusion prevention, and content filtering in one appliance, typically applied together through a profile on a policy.

An inline sensor that inspects packet streams for known attack patterns and protocol anomalies and can drop malicious traffic before it reaches the protected host, unlike a passive detection-only system.

Decrypting TLS traffic at the gateway, inspecting it with security profiles, and re-encrypting it, so encrypted attacks and data leaks can be detected; requires certificate handling to avoid client warnings.

A Fortinet SSL inspection mode where the firewall acts as a trusted intermediary, presenting its own certificate to the client so it can read and scan the full encrypted payload.

A logical grouping of one or more interfaces that share the same security posture, allowing policies to be written against the zone rather than each physical port.

Virtual Domain: a partitioned, independent configuration and routing instance inside one FortiGate, letting a single appliance serve multiple tenants or departments with separate policies and administrators.

The default behavior of dropping traffic that matches no explicit allow rule, which enforces a deny-by-default posture at the end of the policy list.

Network Address Translation: rewriting source or destination addresses and ports as packets cross a boundary, commonly used to hide internal addresses or to publish internal services.

The list of known networks and next hops a device uses to decide where to forward a packet, checked before firewall policy matching in most FortiGate forwarding paths.

A physical or logical network port on a device, such as a physical Ethernet port, VLAN subinterface, or tunnel, that carries traffic and holds addressing and administrative settings.

A scored checklist in FortiGate that reviews configuration against best practices, such as strong admin settings, logging, and profile coverage, and reports gaps with remediation guidance.

A Fortinet management appliance that collects, stores, correlates, and reports on logs from Fabric devices, supporting compliance reporting and centralized event investigation.

A centralized management platform used to configure, push policy, and monitor many Fortinet devices from one console, often through administrative domains and policy packages.

A permission set assigned to an administrator account that controls which menus and actions are available, supporting role separation and least privilege on Fortinet devices.

Requiring two or more independent proofs of identity, such as a password plus a one-time code or token, before granting access to a system or VPN.

The policy defining how long event, traffic, and security logs are stored, balancing investigation and compliance needs against storage cost and privacy obligations.

The structured process of preparing for, detecting, containing, eradicating, and recovering from a security incident, followed by lessons learned to prevent recurrence.

A documented, repeatable sequence of steps and decision points that responders follow for a given incident type, reducing improvisation and improving consistency under pressure.

Security Orchestration, Automation, and Response: tooling that connects security products and automates repetitive investigation and containment tasks through workflows and integrations.

Security Information and Event Management: a platform that aggregates logs from many sources, correlates events, and raises alerts, giving analysts a single view of activity across the estate.

Observable artifacts such as malicious file hashes, domains, IP addresses, or registry keys that suggest a system has been breached and can be used to hunt for further evidence.

Curated information about adversaries, their tools, and infrastructure that is used to inform detection rules, blocklists, and prioritization of defensive effort.

An integration point that lets a Fortinet device exchange logs, events, and threat data with other Fabric members or external platforms, enabling coordinated detection and response.

A security model that assumes no implicit trust based on network location and instead verifies identity and device posture for every request before granting access to a resource.

Granting users, services, and devices only the minimum access needed to perform their function, limiting the blast radius if an account or system is compromised.

Layering independent controls across network, endpoint, application, and identity so that failure or bypass of one control does not expose the whole environment.

Confidentiality, Integrity, and Availability: the three core goals used to reason about what a security control protects and how to classify the impact of a failure.

Identifying assets and threats, estimating likelihood and impact, and comparing the result against tolerance so that limited security resources are directed where they matter most.

A social-engineering attack that impersonates a trusted party through email, messages, or sites to trick a person into revealing credentials, approving a payment, or running malicious code.

Malware that encrypts or steals data and demands payment for restoration or non-disclosure, often spreading laterally through shared drives and unpatched services.

A copy of data kept separately from the primary system so it can be restored after loss, corruption, or ransomware; it is only useful if restoration is tested and the copy is isolated.

Secure Access Service Edge: converging network connectivity and cloud-delivered security services such as secure web gateway and zero-trust access into one policy framework for distributed users.

Cloud Access Security Broker: a control point between users and cloud services that enforces policy, discovers shadow IT, and provides visibility into sanctioned and unsanctioned application use.

A proxy that inspects and filters web traffic for malware, policy violations, and risky destinations, often delivered from the cloud for roaming users.

The division of security duties between a cloud provider and its customer, where the provider secures the platform and the customer secures data, identities, and configuration they control.

An incorrect or overly permissive cloud setting, such as a public storage bucket or open security group, that exposes resources without exploiting a software vulnerability.

The set of practices and services that create identities, authenticate them, and authorize what they may do, forming the primary control boundary in cloud environments.

Applications and services adopted by staff without IT approval, which escape normal policy and logging and therefore widen the attack surface and complicate data protection.

A signed digital document binding a public key to an identity, used to prove server authenticity and to enable encrypted sessions; clients must trust the issuer to avoid warnings.