CSPM flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

Division of security duties between cloud provider and customer. The provider secures physical infrastructure and managed service internals; the customer secures identities, data, configurations, and workloads they deploy.

Defense in depth

Layering independent preventive and detective controls across identity, network, compute, data, and monitoring so that failure of any single control does not expose the protected asset.

Least privilege

Granting only the permissions required for a task, for only as long as needed. In cloud environments this means scoped policies, short-lived credentials, and removal of standing administrative access.

Zero trust architecture

Security model that removes implicit trust from network location. Every request is authenticated and authorized using identity, device posture, and context signals regardless of source address.

Trust boundary

Any interface where data or control crosses between components with different trust levels, such as internet to edge, subnet to subnet, or tenant to tenant.

Federated identity

Authentication model where a trusted external identity provider asserts user identity to the cloud platform using standards such as SAML or OIDC, avoiding separate credentials per service.

Phishing-resistant MFA

Authentication factors bound to the legitimate origin, such as FIDO2 security keys, passkeys, or certificate-based authentication. These resist real-time relay of credentials to attacker-controlled sites.

Role-based access control

Authorization model that grants permissions to roles rather than individuals, and assigns users or workloads to roles. Simplifies administration but can cause entitlement creep without reviews.

Attribute-based access control

Authorization model that evaluates attributes such as resource tags, user department, or request context at decision time. Scales well in dynamic cloud estates where static roles proliferate.

Privileged identity management

Controls for elevated access: eligible rather than permanent assignments, approval workflows, time-bound activation, session logging, and periodic recertification of administrative roles.

Service control policy

Organization-level guardrail that caps the maximum permissions any account or identity can hold, even when a local identity policy grants broader access.

Separation of duties

Control ensuring no single identity can both initiate and approve a sensitive action, such as requesting and authorizing a production deployment or key deletion.

Access recertification

Periodic review in which resource owners confirm that each identity still requires its assigned entitlements. Removes orphaned accounts and entitlement accumulated through role changes.

Envelope encryption

Pattern where a data key encrypts the payload and a key encryption key held in a KMS or HSM protects the data key. Enables key rotation without re-encrypting bulk data.

Customer-managed keys

Encryption keys generated and controlled by the customer within a cloud key service, allowing independent rotation, disable, and deletion policy separate from provider-managed defaults.

Data residency

Requirement that data physically remain within specified jurisdictions. Must account for replicas, backups, caches, and logs, since replication can silently move data across borders.

Tokenization

Replacing sensitive values with non-sensitive tokens mapped in a protected vault. Reduces the scope of systems handling regulated data such as card numbers.

Data loss prevention

Controls that classify content and block unauthorized exfiltration through email, endpoint, or SaaS APIs. Effectiveness depends on classifier accuracy and tuning.

Encryption in use

Protecting data while it is being processed, using confidential computing enclaves or memory encryption so that even the host platform cannot read plaintext.

Secure deletion

Removing data so it cannot be recovered, accounting for snapshots, backups, replicas, and caches. Deleting the primary object alone does not remove derived copies.

Stateful versus stateless filtering

Security groups are stateful and automatically allow return traffic. Network ACLs are stateless, so rules must explicitly permit both inbound and outbound directions.

Private endpoint

Interface that exposes a provider service inside a private network address space, so traffic does not traverse the public internet and can be restricted by network policy.

Egress filtering

Restricting outbound traffic to approved destinations. Limits data exfiltration and command-and-control callbacks; allowlists are stronger than blocklists of known-bad domains.

Workload identity

Credential mechanism that lets a compute workload authenticate to cloud APIs using short-lived tokens tied to its runtime identity, removing long-lived secrets from code and configuration.

Immutable infrastructure

Practice of replacing rather than patching running instances. Reduces configuration drift and ensures every deployed artifact derives from a known, scanned, signed image.

Admission control

Policy enforcement point that evaluates workloads before deployment and rejects those violating rules, such as unsigned images or privileged containers.

Control plane audit logs

Records of management API calls showing who changed what configuration and when. Primary evidence source for detecting privilege changes, firewall openings, and key deletions.

Incident response lifecycle

Structured phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment precedes remediation to preserve evidence.

Cloud containment primitives

Actions that limit incident spread: revoke sessions, rotate credentials, isolate instances with security groups, snapshot volumes for forensics, and disable compromised access keys.

Mean time to detect

Average elapsed time between the occurrence of a security event and its detection. A primary metric for evaluating monitoring coverage and detection engineering effectiveness.

Provider attestation

Independent audit report such as SOC 2 or ISO 27001 certificate covering the provider's own controls. Customers inherit evidence only for the provider's scope, not their own.

CSPM

Cloud Security Posture Management continuously evaluates resource configuration against benchmarks such as CIS, flags drift and public exposure, and feeds findings into remediation and risk tracking.

Risk treatment options

Responses to assessed risk: mitigate by adding controls, transfer via insurance or contract, avoid by removing the activity, or accept with documented owner sign-off.