Glossary

FedRAMP Authorization

The process and resulting status by which a cloud service achieves FedRAMP approval, completing a NIST 800-53-based control assessment and obtaining an authorization to operate so federal agencies can use it.

FedRAMP Cloud Architecture

Designing a cloud architecture to meet FedRAMP requirements, with the boundary definition, segmentation, logging, encryption, and identity controls needed for a federal authorization. It bakes FedRAMP's controls into the architecture itself.

Federated Identity

An arrangement where one system trusts another to authenticate users, so a person can use a single identity across multiple applications or organizations without separate accounts, enabling single sign-on via standards like SAML and OIDC.

Federated Identity (Cloud)

Using federation in cloud environments so identities from a trusted provider (a corporate directory or another cloud) can access cloud resources without separate cloud accounts or long-lived credentials, as configured by a cloud engineer.

Finding Aggregation

Combining related individual audit findings into consolidated, higher-level issues, so reporting highlights systemic problems and their overall significance rather than burying stakeholders in a long list of isolated observations.

Finding Documentation

Recording each assessment finding clearly and completely, what the issue is, the evidence for it, its risk, and how to remediate, so the finding is understandable, credible, and actionable to the people who must fix it.

Finding Lifecycle

The stages an audit finding moves through, from identification and verification, through severity rating and reporting, to remediation tracking and closure, so issues are managed to resolution rather than just noted once.

Finding Severity

The rating that conveys how serious an audit finding is, based on its risk and potential impact, so stakeholders can prioritize which issues to address first and allocate remediation effort accordingly.

Finding Verification

Confirming that an audit finding is real and accurate before reporting it, by checking the evidence and reasoning, so the audit does not raise false or unsupported issues that would undermine its credibility.

Findings Management

The GRC analyst's work of tracking issues, audit findings, risk-assessment results, and control gaps, from identification through remediation to closure, so nothing falls through the cracks and progress is visible.

Firewall

A control that permits or blocks traffic based on rules and context.

Firewall Rule

A configured statement that tells a firewall whether to allow or block specific network traffic, based on attributes like source and destination address, port, and protocol. Rules are how a firewall's policy is actually expressed.

First Line and Second Line

Two of the 'three lines' model: the first line owns and operates risks and controls (the business and operations), while the second line (risk and compliance functions) sets policy and oversees, advises, and challenges the first line.

First-Seen Detection

A SIEM detection technique that flags activity occurring for the first time in an environment, a new domain, a never-before-seen process, a first login from a location, since novelty often signals something worth investigating.

Flow Data

Network telemetry that records metadata about connections, source and destination, ports, protocol, bytes, and timing, without capturing packet contents. It gives broad, efficient visibility into who talked to whom across a network.

Flux ArgoCD

Two leading GitOps tools, Flux and Argo CD, that continuously deploy and reconcile Kubernetes workloads from a Git repository, making Git the source of truth and automatically correcting drift from the declared state.

Follow-the-Sun

A SOC staffing model where monitoring and response are handed between teams in different time zones, so coverage follows daylight hours around the globe, giving 24/7 operations without overnight shifts for any single team.

Foothold

The initial access an attacker establishes on a system or network, the beachhead from which they expand. Gaining a foothold turns an external threat into an internal one and starts the clock on dwell time.

Forced Browsing

A web attack technique of directly requesting URLs or resources that are not linked or shown in the interface, to reach hidden pages, files, or functions that the application failed to properly protect.

Forensic Analysts

Blue-team specialists who investigate compromised systems in depth, collecting and analyzing evidence, disk, memory, logs, to reconstruct what an attacker did. They provide the deep analysis that supports incident response and lessons learned.

Forensic Considerations

The factors a cloud engineer must plan for so containers and workloads can be investigated after an incident, capturing ephemeral evidence, retaining logs, and enabling the visibility forensics needs before an incident occurs.

Forensics

The disciplined collection, preservation, and analysis of digital evidence to reconstruct what happened in an incident, performed soundly enough that the findings are accurate and could withstand legal scrutiny.

Forward Secrecy

A property of encrypted connections where compromising a server's long-term private key later does not let an attacker decrypt past sessions, because each session used a unique, ephemeral key that was never stored.

Fourth Party Risk

Risk arising from the vendors of your vendors, the subcontractors and service providers your third parties depend on, which can affect you even though you have no direct relationship with them.

Fragment

The part of a URL after the '#' symbol, used to point to a location within a page. It is handled by the browser and not normally sent to the server, which matters when reasoning about what a server actually receives.

Frame

The unit of data at the data-link layer of a network, wrapping a packet with addressing (MAC addresses) for delivery across a local network segment. It is the lowest-level container in the common networking models.

Framework Anti-Patterns

Common mistakes organizations make when adopting security frameworks, such as treating the framework as a checklist, chasing certification without real security, or adopting too many frameworks without mapping them, that undermine the framework's value.

Framework Mapping

Creating crosswalks between the requirements of different security frameworks, so a control implemented once can be shown to satisfy multiple frameworks and gaps across them become visible. It is the key to efficient multi-framework compliance.

Framework Purpose

Understanding what a given security framework is actually for, risk management, certification, regulatory compliance, or prescriptive guidance, so it is applied to the right ends rather than misused for a purpose it was not designed to serve.

Framework Roadmap

A phased plan for adopting and maturing security frameworks over time, sequencing which frameworks to implement, in what order, and toward what milestones, so framework adoption is deliberate rather than reactive or overwhelming.

Framework Selection

The GRC analyst's task of choosing which security framework or frameworks an organization should adopt, based on its industry, regulatory obligations, customer demands, risk, and resources, so the choice fits real needs.