CCAS flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

Division of security duties in cloud: the provider secures physical infrastructure and managed service internals, while the customer secures data, identities, configurations, and application code.

Trust boundary

A point where data or control crosses between components with different trust levels, such as between tiers, tenants, or networks; each crossing requires explicit authentication and authorization controls.

Blast radius

The scope of damage a compromised component can cause. Segmentation, scoped credentials, and private endpoints reduce it by limiting what an attacker can reach from one foothold.

Multi-tenant isolation

Separating tenant data and workloads. Options range from shared tables with tenant-ID filtering to schema-per-tenant and separate accounts per tenant, trading cost against isolation strength.

OIDC ID token

A signed JWT issued by an OpenID Connect provider that asserts the authenticated user's identity. It is validated against the issuer's JWKS and its iss, aud, and exp claims.

Authorization code with PKCE

The recommended OAuth 2.0 flow for public clients such as single-page apps and mobile apps. A code verifier and challenge prevent interception and replay of the authorization code.

JWT validation checks

Verify the signature using the issuer's published keys, then check issuer, audience, expiration, not-before, and algorithm. Reject unsigned tokens and algorithm confusion attacks.

Workload identity federation

A mechanism letting workloads obtain short-lived cloud credentials by presenting a token from an external identity provider, eliminating static access keys stored in code or configuration.

RBAC versus ABAC

Role-based access control grants permissions by role; attribute-based access control evaluates attributes of user, resource, and context in policy. ABAC supports finer-grained, context-dependent decisions.

SOC 2 Type II

An independent audit report covering the trust services criteria over a period, testing whether controls operated effectively. Type I reports only a point-in-time design assessment.

CSA Cloud Controls Matrix

A cloud-specific security control catalog published by the Cloud Security Alliance, mapped to standards such as ISO 27001, NIST, PCI DSS, and HIPAA, used for provider assessment and gap analysis.

Policy as code

Expressing security and compliance rules in machine-readable form (for example OPA/Rego or cloud organization policies) so they are version-controlled, reviewed, and enforced automatically at deploy time.

NIST CSF 2.0 functions

The six core functions of the NIST Cybersecurity Framework version 2.0: Govern, Identify, Protect, Detect, Respond, and Recover. Govern was added in version 2.0.

STRIDE threat model

A threat classification scheme: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Applied per component during design to derive mitigations.

SAST versus DAST

Static analysis inspects source code without running it and tends toward false positives; dynamic analysis attacks a running application and finds runtime and configuration issues static tools miss.

Software bill of materials

A machine-readable inventory of components and dependencies in an artifact, typically SPDX or CycloneDX format, enabling rapid identification of exposure when a new vulnerability is disclosed.

Supply chain provenance

Verifiable evidence of how and where an artifact was built, such as SLSA attestations or Sigstore signatures, allowing deployment systems to reject artifacts from untrusted builders.

Envelope encryption

A data key encrypts the payload, and a key encryption key held in a key management service encrypts the data key. Rotating the key encryption key avoids re-encrypting all data.

Customer-managed key

An encryption key the customer creates and controls in a cloud key management service, giving control over key policy, rotation schedule, and revocation, unlike provider-managed keys.

Crypto-shredding

Destroying the encryption key that protects a data set so the ciphertext becomes permanently unreadable. Used to satisfy erasure requests without rewriting stored data.

Secrets manager

A service that stores credentials such as passwords and API tokens, controls access to them, supports rotation, and injects them at runtime so they never appear in code or images.

Broken object level authorization

The leading API risk: an endpoint accepts an object identifier without verifying the caller owns or is entitled to that object, letting attackers read or modify other users' records.

API rate limiting

Restricting request volume per key, user, or IP to blunt credential stuffing, scraping, and resource exhaustion. Responses typically use HTTP 429 with a Retry-After header.

Webhook signature validation

Verifying an HMAC signature on an incoming webhook payload using a shared secret, confirming the event came from the expected sender and was not altered in transit.

GraphQL query complexity limits

Controls that cap query depth and computed cost before execution, preventing expensive nested queries from exhausting server resources. Production introspection should also be disabled.

EPSS score

The Exploit Prediction Scoring System estimates the probability a vulnerability will be exploited in the wild within the next 30 days, complementing severity when prioritizing remediation.

CSPM

Cloud security posture management continuously scans cloud configurations for misconfigurations, drift, and policy violations, such as public storage buckets or overly permissive identity policies.

Container image scanning

Inspecting image layers and installed packages for known vulnerabilities before deployment, ideally in the build pipeline and again at admission, since base images gain new CVEs over time.

Remediation SLA tiers

Time limits for fixing findings by severity, for example critical within days and high within weeks, adjusted upward for internet exposure, known exploitation, and sensitive data.

Tamper-evident logging

Storing logs in a centralized, append-only location with restricted write access and integrity verification, so an attacker who compromises an application cannot erase evidence of activity.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Containment in cloud often means revoking credentials and isolating the instance.

Kubernetes Pod Security Standards

Three built-in policy levels: privileged, baseline, and restricted. The restricted profile enforces non-root execution, dropped capabilities, and read-only root filesystems.

Admission controller

A Kubernetes component that intercepts requests before objects are persisted and can reject workloads that violate policy, such as unsigned images or privileged containers.

Immutable infrastructure

A deployment model where servers and containers are replaced rather than patched in place. It removes configuration drift and makes rollback a matter of redeploying a known-good artifact.