FCSS SASE Architect key terms

A single cloud-delivered architecture that combines network security (SSE) with software-defined WAN capabilities, managed through one policy framework and one console rather than separate point products.

Secure Access Service Edge: a convergence model in which networking and security services are delivered from cloud points of presence and applied to users, devices, and branches based on identity and policy rather than network location.

Security Service Edge: the security half of SASE, comprising secure web gateway, cloud access security broker, zero trust network access, and related inspection services, delivered from cloud infrastructure without the WAN component.

Software-defined WAN with integrated security functions such as firewall, IPS, and application control enforced at the branch edge, so WAN traffic is protected without backhauling to a central data center.

A SASE deployment where networking and security functions come from one provider and share a common policy engine, agent, and management plane, reducing integration overhead compared with stitching multiple vendors together.

Point of Presence: a cloud location hosting SASE service nodes. Proximity of the PoP to the user or branch determines latency, and PoP-to-PoP peering carries traffic toward private applications.

The provider-side enforcement location where security policy is applied to traffic entering the SASE fabric. Distinct from the client edge, which runs on the endpoint or branch device.

Secure Web Gateway: inspects and controls web traffic, enforcing URL filtering, malware detection, file scanning, and acceptable-use policy for users regardless of whether they are on-premises or remote.

Cloud Access Security Broker: sits between users and cloud services to discover sanctioned and unsanctioned SaaS use, enforce data controls, and detect threats in API or inline modes.

Zero Trust Network Access: grants users access to specific private applications after identity and device posture checks, replacing broad network-level VPN access with per-application, least-privilege connectivity.

Firewall as a Service: cloud-delivered Layer 3 to Layer 7 firewall policy applied to traffic in the SASE fabric, including segmentation rules, intrusion prevention, and logging without on-premises appliances.

Digital Experience Monitoring: end-to-end measurement of user-facing performance such as device health, hop-by-hop network path quality, and application response time, used to diagnose problems before users report them.

Lightweight software on an endpoint that steers traffic to the nearest service edge, applies device posture checks, and enforces identity-aware policy for users working outside the corporate network.

An outbound-only component deployed near private applications that maintains a tunnel to the SASE fabric, allowing ZTNA access without exposing inbound ports or publishing applications to the internet.

The pattern of reaching internal applications through the SASE fabric using application connectors, so users never join the corporate network and applications stay hidden from public scanning.

A set of signals about an endpoint, such as OS patch level, disk encryption, and running security agent, evaluated before or during access to decide whether the device meets policy.

CASB mode in which cloud application traffic traverses the SASE service edge, enabling real-time blocking of uploads, downloads, and actions based on data classification and user context.

CASB mode that connects directly to SaaS provider APIs to scan stored data at rest, discover shadow IT, and remediate exposure without proxying user traffic through the security service.

Cloud services and applications used by employees without IT approval. Discovery through logs, DNS, or CASB API inspection is the first step to sanctioning or blocking them.

Decrypting outbound TLS sessions at the security service, inspecting the plaintext, then re-encrypting. Required for most content controls but must exclude categories such as financial and healthcare sites to satisfy privacy rules.

An application trusting only a specific certificate or public key. Pinned applications break under TLS inspection, so they need bypass rules or a documented exception process.

Sending branch internet-bound traffic directly from the branch to the SASE or internet instead of backhauling it to a data center, reducing latency and WAN cost while security policy is enforced in the cloud.

Forwarding branch traffic across the WAN to a central site for security inspection and internet egress. It simplifies policy but adds latency and consumes WAN capacity.

SD-WAN capability that identifies traffic by application signature and steers it over the path with the best measured quality, such as sending voice over a low-loss link and bulk transfers elsewhere.

Continuously probing available WAN links against thresholds for latency, jitter, and loss, then choosing the path that satisfies the policy for each application class and failing over when thresholds are breached.

Sending redundant packets so the receiver can rebuild lost data without retransmission. Useful on lossy links for real-time traffic such as voice and video that cannot tolerate retransmit delay.

Sending the same packet over two WAN links simultaneously and discarding the duplicate at the receiver, trading bandwidth for near-zero loss on the most delay-sensitive flows.

An encrypted logical link between branch devices or between a branch and the SASE fabric, carrying traffic across any underlay transport while hiding provider addressing and enforcing policy.

The physical or provider transport beneath the overlay, such as MPLS, broadband, or LTE. Its characteristics, including loss and jitter, drive the path decisions the overlay makes.

Deciding which traffic goes where: direct to the internet, through the SASE fabric, or across the WAN. Rules may match on user identity, application, device, or destination category.

The ordered set of rules that determines what traffic is allowed, inspected, or blocked, evaluated against identity, application, device posture, and destination context in a SASE deployment.

Access decisions that depend on combined conditions such as user identity, group, device posture, location, and risk level, granting, restricting, or stepping up authentication accordingly.

The system that authenticates users and issues assertions about them, such as SAML or OIDC tokens, which the SASE platform consumes to apply identity-based policy.

Intrusion Prevention System: inspects traffic for known exploit and malware signatures and blocks matching sessions. In SASE it runs in the cloud; in SD-WAN it runs at the branch edge.

Flows such as voice, video, and interactive sessions where added delay or jitter degrades usability. Design decisions about PoP proximity, breakout, and path selection hinge on these flows.

The branch appliance or virtual instance that terminates WAN links, forms overlay tunnels, applies local security policy, and forwards traffic according to application-aware routing decisions.

A security model that treats no network location as inherently trusted, verifying identity and device state for every request and granting only the minimum access needed for the specific application.

Policy that detects and blocks sensitive data such as personal records or credentials leaving the organization, applied inline to web and SaaS traffic or via API scanning of stored content.

Continuous export of SASE and SD-WAN events to a SIEM or data lake for correlation and retention, which is essential because cloud-delivered policy leaves no local appliance logs to inspect.