FCSS Public Cloud Security key terms

A division of security duties between a cloud provider and its customer. The provider secures the physical infrastructure and hypervisor, while the customer secures data, identities, configurations, and workloads they place in the cloud.

A safeguard the cloud customer must implement and operate themselves, such as guest OS patching, firewall policy, IAM permissions, or encryption key handling, because the provider does not cover that layer.

A classification of how much of the stack the provider runs. Infrastructure as a service leaves OS and above to the customer, platform as a service covers runtime and OS, and software as a service leaves mainly data and identity configuration.

An architecture where one provider infrastructure serves many independent customers. Isolation between tenants depends on hypervisor, network, and identity controls, which shapes what the customer must verify and protect.

The top-level administrative container in a cloud, such as an AWS account, Azure subscription, or GCP project. It is the primary blast-radius and billing boundary and the usual anchor for guardrails and logging.

A centrally enforced constraint applied across many cloud accounts or projects, such as service control policies or organization policies, that restricts which resources or regions teams may create.

A logically isolated network inside a public cloud where you define address ranges, subnets, and routing. It behaves like a private data center network while running on provider infrastructure.

Dividing a cloud network into segments by role, such as public-facing, application, and database subnets, so that routing and security policy can control traffic between tiers.

A set of rules deciding where packets from a subnet or gateway are sent next. It determines whether traffic stays local, goes to an internet gateway, or is steered through an inspection appliance.

A provider-managed component that connects a virtual network to the public internet. Instances need a public address or outbound translation to use it for outbound and inbound traffic.

A managed service that lets private-subnet resources reach the internet without exposing inbound reachability. It translates source addresses, so external parties cannot initiate connections to those resources.

A stateful virtual firewall attached to individual network interfaces or instances. It allows or denies traffic by protocol and port and typically permits all traffic between members of the same group.

A stateless subnet-level filter that evaluates ordered allow and deny rules for both inbound and outbound directions. Because it is stateless, return traffic must be explicitly permitted.

A direct private connection between two virtual networks that routes traffic over the provider backbone. It is non-transitive, so a network peered to two others does not automatically connect them.

A regional hub that connects many virtual networks, VPNs, and on-premises links through a single attachment point. It simplifies routing and is a natural place to steer traffic for inspection.

Applying fine-grained allow rules between individual workloads or groups rather than trusting an entire subnet. It limits lateral movement after a compromise inside a cloud network.

A design approach that authenticates and authorizes every request based on identity and context instead of network location. Being inside a virtual network grants no implicit trust.

A service that brokers access to internal applications by checking user identity and device context before forwarding traffic. It removes the need to expose those applications directly to the internet.

A dedicated or partner-provided private link between on-premises networks and a cloud region that bypasses the public internet, giving predictable latency and reduced exposure.

A firewall or router image deployed as an instance inside a cloud network. It inspects or forwards traffic when routing tables direct packets through its network interfaces.

Deliberately changing routes, such as adding a default route to a firewall interface or using gateway load balancing, so that selected traffic passes through an inspection point.

A condition where the outbound and return paths of a flow take different routes. Stateful inspection devices may drop such traffic because they never see both directions.

Rewriting a packet's source address as it leaves an interface. In cloud inspection designs it can force return traffic back through the same firewall, avoiding asymmetric routing problems.

Two firewall instances configured to share state and fail over so inspection survives a zone or instance failure. Cloud designs must account for provider failure domains and address movement.

A static public address that can be reassigned between instances. It lets a replacement firewall instance keep the address that routing and peering already point to.

A licensing model where the customer uses an existing license entitlement for a cloud-deployed appliance instead of paying a bundled hourly rate. It affects cost planning and auto-scaling options.

A model where the appliance license is billed hourly or by usage through the cloud marketplace. It suits elastic deployments that scale up and down frequently.

A group of firewall instances that grows and shrinks with load, typically behind a load balancer, while sharing policy. It is used to inspect east-west and outbound traffic at scale.

A provider service that distributes traffic transparently across a pool of inspection appliances. It keeps flow symmetry and simplifies scaling and health checking of firewalls.

A tool category that continuously checks cloud configurations against benchmarks and policies, flagging risky settings such as public storage buckets or overly permissive identities.

A tool category focused on runtime protection of cloud workloads, covering vulnerability scanning, file integrity, malware detection, and behavioral monitoring for virtual machines and containers.

A converged platform combining posture management, workload protection, identity risk analysis, and code-to-cloud visibility. It aims to correlate findings across the build and runtime lifecycle in one place.

Defining cloud networks, policies, and workloads in version-controlled templates that are applied automatically. It enables repeatable deployments and policy checks before anything is created.

Expressing security requirements as machine-checkable rules evaluated in pipelines or at deploy time. Violations block or flag changes before they reach production environments.

A document granting or denying actions to principals on cloud resources. Overly broad permissions are a leading cloud risk, so least privilege and role scoping are core controls.

Inspecting container images for vulnerable packages, secrets, and misconfigurations before deployment. Findings are tied to image digests so teams can block or rebuild unsafe images.

Examining traffic between workloads inside the cloud, not just traffic entering or leaving. It detects lateral movement and is often implemented with a firewall appliance or native filtering.

Decrypting, examining, and re-encrypting encrypted sessions at a control point. It requires certificate trust on clients and careful scoping to protect privacy and avoid breakage.

Sending firewall, flow, and audit logs to a central destination such as a SIEM or storage bucket. Reliable forwarding is required for detection, investigation, and retention obligations.

Provider services that record control-plane and data-plane events, such as flow logs and audit trails. They are the baseline evidence source for cloud investigations and compliance checks.