Home ／ Glossary
GLOSSARYPlain-language explanations
of technical terms.
VPN, remote access, zero trust, SASE — these terms come up constantly in remote access and security discussions. This glossary explains them in plain language, without hype. What ForceLink does and does not do is stated honestly throughout.
VPN (virtual private network)
A mechanism that creates an encrypted "private tunnel" over a public network such as the internet, allowing a remote location to connect securely to an internal network. It makes it harder for third parties on the path to read the contents of the communication.
In ForceLinkForceLink encrypts the VPN segment from the employee's PC to the on-site ForceLink BOX using modern cryptography. How it works →
Remote-access VPN
A VPN type in which a single PC — at home or off-site — connects to an internal network. Each employee's device connects to the internal entry point.
In ForceLinkA Windows PC with the dedicated app installed can connect by entering an invitation code alone. Use cases →
Site-to-site VPN
A VPN type that permanently links two networks — for example, a head office and a branch office. A tunnel is maintained between the routers at each site.
In ForceLinkForceLink also handles branch-office connections. Place a BOX at the head office and each site or home worker connects via the same company-dedicated relay. Use cases →
Remote work / telework
Working from a location other than the office — home, off-site, etc. It requires a secure means of connecting to internal files and business systems.
In ForceLinkForceLink lets companies without a dedicated IT person add remote work capability by placing a BOX and distributing invitation codes. Top page →
ForceLink BOX
A small appliance placed in the office. It acts as the secure entry point to the internal network and enforces access allow/deny rules.
In ForceLinkDelivered pre-configured — just connect it to your LAN. Complex initial setup is handled by Forcenet. How it works →
Cloud relay
An intermediary point on the internet. Employee PCs connect through this relay to reach their company's ForceLink BOX.
In ForceLinkEach company's relay is isolated from others and operated in a domestic (Japan) data center. How it works →
Invitation code
A one-time, time-limited code that employees use with the dedicated app to connect. Issued from the admin console and distributed to employees.
In ForceLinkCan be distributed by email or chat. Because codes are one-time and time-limited, distribution is low-risk. Setup flow →
Zero trust
A design philosophy that does not automatically trust connections just because they originate inside the corporate network, and instead restricts who can access what to the minimum necessary.
In ForceLinkForceLink's internal resource and route control lets administrators allow only the specific internal resources each user needs. (We do not claim to deliver "complete zero trust.") Security →
Least privilege (access control)
The principle of granting users only the access rights needed for their role. Users cannot reach servers or data that are outside their scope.
In ForceLinkThe ForceLink BOX can limit each user's permitted destinations at the level of destination IP, port, and protocol. How it works →
Internal resource and route control (Secure Route Control)
A ForceLink feature name. Rather than opening the entire internal LAN after a VPN connection is established, access is permitted only to the specific internal PCs, servers, and NAS each user needs — at the destination IP, port, and protocol level. This applies a zero-trust philosophy to the post-connection segment.
In ForceLinkAccess permissions are enforced by the ForceLink BOX and do not depend on client-side configuration alone. Security →
Lateral movement
The technique by which an attacker who has gained access moves through the internal network to compromise additional devices and servers. When a VPN connection gives full access to the internal LAN, lateral movement is easier.
In ForceLinkForceLink is designed so that the internal LAN is not fully open after a VPN connection, helping to limit the scope of potential lateral movement. Security →
Ransomware
Malicious software that encrypts data and demands payment in exchange for restoring access. VPN appliance vulnerabilities and compromised credentials are common entry points.
In ForceLinkForceLink is designed to keep the attack surface small — the admin console is not publicly exposed and connections are key-based. Why it matters →
Multi-factor authentication (MFA)
A mechanism that requires a second factor — such as a smartphone app or one-time code — in addition to a password, to verify a user's identity.
In ForceLinkForceLink uses key-based connections as its primary mechanism. MFA is not currently supported (support is under consideration). FAQ →
Sensitive personal data
Personal information — such as medical history or physical / mental condition — that requires particularly careful handling. Common in healthcare and care services, and subject to stricter management requirements.
In ForceLinkAccess can be restricted to the specific systems each user needs, with immediate deactivation when employment or a contract ends. Care and welfare sector →
Trade secret
Information that is managed as confidential, is commercially useful, and is not publicly known (under Japan's Unfair Competition Prevention Act). Drawings, manufacturing know-how, etc. may qualify.
In ForceLinkAccess control contributes to establishing the "confidential management" element of a trade secret — though it alone is not sufficient. Manufacturing sector →
Insider threat
Fraudulent acts by employees, former employees, or contractors — such as unauthorized data exfiltration. Revoking permissions on departure and applying least privilege are key countermeasures.
In ForceLinkAccess for a departing employee or contractor can be deactivated from the admin console. Access management article (Japanese) →
End of life (EOL)
The point at which a vendor stops providing security patches for a product. Running an EOL device leaves known vulnerabilities unaddressed.
In ForceLinkIt is important to plan for replacement of VPN appliances and similar devices before they reach EOL. SSL-VPN vulnerability article (Japanese) →
Backup
Maintaining a separate copy of data so it can be restored if the original is encrypted, corrupted, or accidentally deleted. A cornerstone of ransomware preparedness.
In ForceLinkThe recommended approach is to maintain multiple copies across multiple locations and generations, and to test restoration regularly. Ransomware countermeasures article (Japanese) →
Double extortion
A tactic in which attackers not only encrypt data but also threaten to publish stolen data unless payment is made. Increasingly common in recent ransomware incidents.
In ForceLinkLimiting entry points and restricting post-connection reach helps contain the impact. Ransomware countermeasures article (Japanese) →
Supply chain attack
An attack that gains access to a target organization through a supplier, contractor, or third-party service. Small businesses are sometimes used as a stepping stone.
In ForceLinkLimiting contractor access to what is strictly necessary and revoking it promptly when the contract ends is an effective countermeasure. Access management article (Japanese) →
Phishing
A technique for stealing credentials — IDs, passwords, etc. — through emails or websites that impersonate legitimate services. Stolen credentials become entry points.
In ForceLinkConnection management that does not rely solely on passwords helps reduce the risk of unauthorized access through impersonation. Security →
Zero-day
An attack that exploits a vulnerability before a patch is available. Because zero-days cannot be fully stopped, a design that limits the blast radius and a policy of applying patches promptly are both important.
In ForceLinkRestricting post-connection reach helps limit the impact of a single compromised device. SSL-VPN vulnerability article (Japanese) →
Key-based authentication (public-key cryptography)
A method of verifying identity using a paired private key and public key instead of a password. It helps prevent impersonation through credential leaks.
In ForceLinkWith the standard dedicated Windows app, the private key is generated on the device and never leaves it. Key mechanism →
SASE (Secure Access Service Edge)
A large-scale framework that delivers network and security functions in an integrated cloud service. Comprehensive, but typically involves significant design, migration, and cost overhead.
In ForceLinkForceLink targets the "right-sized" scope for secure remote access to internal systems — without the weight and cost of a full SASE deployment. See comparison →
ZTNA (Zero Trust Network Access)
An umbrella term for access methods based on zero-trust principles, where each user is permitted only the connections to applications or resources they specifically need.
In ForceLinkForceLink incorporates this idea through per-user internal resource control (it does not cover all features of an enterprise-scale ZTNA product). See comparison →
SSL-VPN
A VPN method that uses SSL/TLS — via a browser or dedicated app — to connect from outside to an internal network. Easy to deploy, but appliance vulnerabilities are a common target.
In ForceLinkSimply deploying a device is not enough. Responsibility for vulnerability management and updates must be clearly assigned. SSL-VPN vulnerability article (Japanese) →
IPsec
One of the primary protocols used to encrypt communications. Commonly used in site-to-site VPNs.
In ForceLinkForceLink's design focuses on what is connected and to what extent, rather than on protocol names. Site-to-site VPN article (Japanese) →
NLA (Network Level Authentication)
A mechanism for Remote Desktop (RDP) that verifies the user before the desktop screen is displayed. Effective against brute-force attacks.
In ForceLinkThe recommended practice is to never expose RDP directly to the internet and to use it only inside a secure connection path. RDP security article (Japanese) →
Stepping-stone attack
An attack in which an adversary uses a compromised device as a relay point to attack another target or to enter an internal network. Publicly exposed devices are often used as stepping stones.
In ForceLinkA design that does not expose the admin console publicly and that limits post-connection reach helps reduce the risk of becoming an entry point or relay. Security →
SMB (file sharing)
A protocol used for file sharing on Windows and other systems. Intended for use inside a corporate network and not designed to be exposed directly to the internet.
In ForceLinkThe recommended approach is to never expose SMB directly and to access file shares only through a secure connection path. NAS secure access article (Japanese) →
Port forwarding / UPnP
Router settings that route inbound traffic from the internet to a device on the internal network. Convenient, but a common cause of unintentionally exposing devices to the internet.
In ForceLinkDevices may be publicly exposed even without a conscious configuration decision — it is worth checking. Network camera article (Japanese) →
Security patch / firmware update
Updates that fix bugs and vulnerabilities in software or hardware. Leaving them unapplied allows known weaknesses to become attack entry points.
In ForceLinkAssigning responsibility for updating VPN appliances and NAS devices is important. SSL-VPN vulnerability article (Japanese) →
MDM (mobile device management)
A system for centrally managing device configuration, updates, and lost-device response on behalf of the organization. Worth evaluating when you need visibility into and control over employee-owned devices.
In ForceLinkForceLink is not an MDM product. When BYOD is involved, device-side management should be addressed separately. BYOD article (Japanese) →
BYOD (bring your own device)
The practice of using personally-owned PCs or smartphones for work. It can reduce costs, but introduces risk from devices the company does not directly manage connecting to the internal network.
In ForceLinkThe recommended approach is to restrict the reachable destinations to limit the blast radius, while also establishing device-side rules. BYOD article (Japanese) →
RDP (Remote Desktop Protocol)
A mechanism for controlling the screen of an internal PC from a remote location. Used to operate an office accounting PC, for example, from a remote terminal.
In ForceLinkPer-user rules such as "allow RDP to the accounting PC only" can be configured. Use cases →
NAS (network-attached storage)
A storage device connected to the network for shared file access. Used to store and share company documents and assets.
In ForceLinkIt is possible to allow only access to specific NAS file shares from home. Use cases →
File server
A server that centralizes and stores company files for sharing. Folders are typically organized by department or project.
In ForceLinkPer-user or per-role restrictions on which file servers or folders are accessible can be configured. Industry-specific examples →
Network camera (IP camera)
A security or surveillance camera accessible over a network. Exposing one directly to the internet can make it a target for unauthorized viewing or takeover.
In ForceLinkThe recommended configuration keeps cameras off the public internet and allows only authorized users to connect to designated cameras. Network camera article (Japanese) →
Business system / core system
Systems that support core business operations — accounting, sales, inventory, production management, etc. Accessing them from outside requires a secure connection and minimum-necessary access.
In ForceLinkPer-user restrictions on which business systems are reachable can be configured. Use cases →
Not sure about a term? Just ask.
We will explain how everything applies to your specific environment — no jargon. Estimates are free.