Illumio Associate key terms

The central Illumio appliance that stores policy, calculates which workloads may talk to which, and distributes that decision to enforcement points. It is the management brain and does not sit in the data path.

Lightweight software installed on a managed host or VM that reports traffic and label data to the PCE and enforces the resulting rules locally. It acts as the host-based enforcement point.

The ongoing exchange in which the PCE pushes computed policy and receives workload telemetry from each VEN. Loss of sync means a host keeps its last known rules but stops receiving updates.

A key-value pair such as Role:Web or Env:Production assigned to a workload. Labels describe what a workload is, not where it lives, so policy written against them survives IP changes and cloud moves.

A named category of labels, for example Role, Application, Environment, or Location. Each workload normally carries exactly one label per dimension, which keeps policy logic unambiguous.

Rules written between label groups rather than IP addresses, so intent such as 'web can reach app on 443' is expressed once and applies to every workload carrying those labels.

A named collection of IP addresses or subnets used in policy where labels are unavailable, such as unmanaged third-party services or legacy appliances. Useful but brittle when addresses change.

A container that scopes a set of rules to a consumer group, usually a label dimension such as all workloads with Role:Web. Rules inside apply only to consumers in that scope.

A single allow or deny statement defining which consumers may reach which providers, over which ports and protocols, and optionally with which network or process conditions.

The two sides of a policy rule. The consumer initiates the connection and the provider receives it, which is why rules are written consumer-to-provider and enforced at both ends.

The set of workloads a ruleset or rule applies to. Narrow scopes limit blast radius of a policy mistake and keep rule counts manageable in large environments.

A posture in which traffic is blocked unless a rule explicitly allows it. It is the intended end state of a segmentation program and the practical expression of least privilege on the network.

Policy that names only the traffic permitted to flow and blocks everything else. It contrasts with blocklists, which enumerate bad traffic and inevitably miss cases.

The per-workload setting that decides whether policy is merely visible or actually blocking. Common states are idle, visibility only, and full enforcement, and they can be changed per workload.

An enforcement state where the VEN reports traffic and flags flows that policy would block, but does not drop packets. It is the safe way to validate rules before turning on blocking.

Enforcing policy on a subset of workloads, often one application at a time, while others remain in visibility mode. This staged rollout limits operational risk during a segmentation project.

A condition where one side of a connection enforces policy and the other does not, so a blocked flow may still appear at the unenforced end. It causes confusing results and is usually temporary.

A containment pattern that wraps a group of workloads, such as a single application or environment, in default-deny policy to stop lateral movement in or out while leaving the rest of the estate untouched.

An attacker's technique of hopping from one compromised host to another inside the network to reach valuable data or higher privilege. Segmentation exists mainly to break these paths.

Traffic between workloads inside the data center or cloud, as opposed to north-south traffic crossing the perimeter. Most lateral movement happens here, which is why host-based segmentation targets it.

The set of systems an attacker or malware can reach after compromising one host. Tight segmentation shrinks the blast radius to the few peers a workload genuinely needs.

Dividing a network into fine-grained zones down to individual workloads, with policy enforced close to each one. It replaces coarse VLAN or firewall boundaries that are too blunt for modern east-west traffic.

Enforcing policy inside the operating system of each workload rather than at a network appliance. It works across clouds, containers, and encrypted traffic because it sees the actual socket.

Granting only the access required to do a job, nothing more. In segmentation this means each workload may reach only the specific peers and ports it truly uses.

A security model that removes implicit trust from network location and verifies every request. Being inside the corporate network grants nothing; identity and policy decide access each time.

A recorded conversation between two workloads or IPs, including ports, protocol, and byte counts. Flows are the raw material for building accurate policy and spotting anomalies.

The continuous stream of flow records that VENs send to the PCE. It powers visibility maps, policy recommendations, and detection of unusual connections.

A visualization of which workloads talk to which, built from observed flows. It lets teams see real application relationships before writing or tightening policy.

A recommended rule set generated from observed traffic over a chosen time window. Drafts accelerate policy authoring but need review, because they capture existing behavior including any bad habits.

The Illumio interface for querying flow and policy data across time. It answers questions such as which workloads talked to a given host or which flows policy would now block.

The analytics capability that studies flow and policy data to surface risks such as exposed high-value assets, risky ports, and policy drift. It turns raw telemetry into prioritized findings.

The gap between intended rules and what is actually deployed or observed over time. Drift appears as stale rules, shadowed flows, or workloads whose labels no longer match reality.

A device or system that cannot run a VEN, such as a network appliance or third-party service. It is represented by IP lists and appears in policy but enforces nothing itself.

Malware that encrypts or steals data and demands payment, typically spreading across reachable hosts. Segmentation limits its spread by cutting the paths it needs to propagate.

The act of stopping an active threat from spreading further, usually by isolating affected workloads with policy. Fast containment depends on policy already existing before the incident.

The agreed naming scheme for label dimensions and values across an organization. A consistent taxonomy is what makes policy reusable and prevents duplicate or contradictory labels.

Any compute instance Illumio manages, such as a physical server, virtual machine, or container. Workloads carry labels, run a VEN, and are the unit policy is written about.