Glossary

FAIR Factors in Depth

A detailed look at the factors in the FAIR model that combine to produce risk, breaking loss event frequency and loss magnitude into their contributing sub-factors so each can be estimated and analyzed precisely.

FAIR Methodology

FAIR (Factor Analysis of Information Risk) is a quantitative method for analyzing risk in financial terms, decomposing it into loss event frequency and loss magnitude and using calibrated estimates to produce a measured range of probable loss.

FAIR Ontology

The structured taxonomy at the heart of FAIR that defines each risk factor and how they relate, loss event frequency and loss magnitude and their sub-factors, giving a precise, shared vocabulary for decomposing and analyzing risk.

FAIR Practice Development

Building the capability to do FAIR analysis well over time, developing analysts' calibration and modeling skills, refining processes, and maturing how an organization performs quantitative risk analysis.

FAIR Program Integration

Embedding FAIR quantitative analysis into the organization's broader risk-management program, so quantified results feed risk registers, prioritization, reporting, and decisions rather than living as standalone analyses.

FAIR Program Metrics

The measures used to track the value and maturity of a FAIR quantitative-risk program, such as how many decisions it informed, the consistency and accuracy of estimates, and the program's coverage and efficiency.

FAIR Scenario Definition

Precisely framing the risk scenario to be analyzed in FAIR, specifying the asset at risk, the threat, and the type of loss event, so the analysis measures a well-bounded, meaningful risk rather than something vague.

FAIR Sensitivity Analysis

Examining which input factors most affect a FAIR analysis's result, so analysts know where estimate uncertainty matters most and where to focus effort to refine the model or reduce risk.

FAIR in Context

Understanding where the FAIR quantitative risk model fits among other risk approaches and when to use it, recognizing its strengths for financial risk analysis and its place alongside qualitative methods and broader risk frameworks.

FIDO2

An open authentication standard that enables strong, phishing-resistant, passwordless login using public-key cryptography and hardware or platform authenticators, such as security keys or device biometrics, instead of passwords.

FTP

File Transfer Protocol: an old protocol for transferring files between systems that sends data and credentials in plaintext, making it insecure and a notable risk when found, since traffic can be intercepted.

False Positive

An alert that appears suspicious but is not actually harmful.

False Positive Analysis

Investigating why a detection fired on benign activity, in detection engineering, so the rule can be tuned to reduce noise without losing its ability to catch real threats. It turns false positives into targeted improvements.

False Positive Management

In vulnerability management, the process of identifying scanner findings that are not actually exploitable or present, validating them, and suppressing them, so remediation effort focuses on real vulnerabilities rather than scanner noise.

False Positives

Alerts that flag benign activity as malicious, a detection firing when nothing bad actually happened. High false-positive rates waste analyst time, cause alert fatigue, and erode trust in detections, so reducing them is a constant goal.

FedRAMP

The US government program that standardizes security assessment and authorization for cloud services used by federal agencies, so a cloud provider authorized once can be trusted across government under a common baseline.

FedRAMP Authorization

The process and resulting status by which a cloud service achieves FedRAMP approval, completing a NIST 800-53-based control assessment and obtaining an authorization to operate so federal agencies can use it.

FedRAMP Cloud Architecture

Designing a cloud architecture to meet FedRAMP requirements, with the boundary definition, segmentation, logging, encryption, and identity controls needed for a federal authorization. It bakes FedRAMP's controls into the architecture itself.

Federated Identity

An arrangement where one system trusts another to authenticate users, so a person can use a single identity across multiple applications or organizations without separate accounts, enabling single sign-on via standards like SAML and OIDC.

Federated Identity (Cloud)

Using federation in cloud environments so identities from a trusted provider (a corporate directory or another cloud) can access cloud resources without separate cloud accounts or long-lived credentials, as configured by a cloud engineer.

Finding Aggregation

Combining related individual audit findings into consolidated, higher-level issues, so reporting highlights systemic problems and their overall significance rather than burying stakeholders in a long list of isolated observations.

Finding Documentation

Recording each assessment finding clearly and completely, what the issue is, the evidence for it, its risk, and how to remediate, so the finding is understandable, credible, and actionable to the people who must fix it.

Finding Lifecycle

The stages an audit finding moves through, from identification and verification, through severity rating and reporting, to remediation tracking and closure, so issues are managed to resolution rather than just noted once.

Finding Severity

The rating that conveys how serious an audit finding is, based on its risk and potential impact, so stakeholders can prioritize which issues to address first and allocate remediation effort accordingly.

Finding Verification

Confirming that an audit finding is real and accurate before reporting it, by checking the evidence and reasoning, so the audit does not raise false or unsupported issues that would undermine its credibility.

Findings Management

The GRC analyst's work of tracking issues, audit findings, risk-assessment results, and control gaps, from identification through remediation to closure, so nothing falls through the cracks and progress is visible.

Firewall

A control that permits or blocks traffic based on rules and context.

Firewall Rule

A configured statement that tells a firewall whether to allow or block specific network traffic, based on attributes like source and destination address, port, and protocol. Rules are how a firewall's policy is actually expressed.

First Line and Second Line

Two of the 'three lines' model: the first line owns and operates risks and controls (the business and operations), while the second line (risk and compliance functions) sets policy and oversees, advises, and challenges the first line.

First-Seen Detection

A SIEM detection technique that flags activity occurring for the first time in an environment, a new domain, a never-before-seen process, a first login from a location, since novelty often signals something worth investigating.

Flow Data

Network telemetry that records metadata about connections, source and destination, ports, protocol, bytes, and timing, without capturing packet contents. It gives broad, efficient visibility into who talked to whom across a network.

Flux ArgoCD

Two leading GitOps tools, Flux and Argo CD, that continuously deploy and reconcile Kubernetes workloads from a Git repository, making Git the source of truth and automatically correcting drift from the declared state.