CCAS key terms

A division of security duties between a cloud provider and its customer. The provider secures the physical infrastructure and managed services; the customer secures data, identities, configurations, and application code within their control.

A structured exercise that identifies assets, entry points, adversaries, and abuse cases before code is written, then records mitigations for each credible threat. Common methods include STRIDE and attack trees.

A threat classification scheme grouping risks into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Teams use it to prompt systematic thinking during design reviews.

A line in an architecture where data or control passes between components with different privilege or assurance levels. Every crossing point requires authentication, validation, and logging.

A design approach that removes implicit trust based on network location. Every request is authenticated, authorized, and encrypted regardless of whether it originates inside or outside the corporate perimeter.

A peer review of architecture diagrams and data flows performed before implementation, checking that controls such as segmentation, least privilege, and encryption are present and correctly placed.

The component that evaluates access requests against policy and returns a permit or deny result. It is separated from enforcement so rules can change centrally without modifying every application.

The component that intercepts a request and applies the decision returned by the policy engine, allowing or blocking traffic. Examples include API gateways, service meshes, and sidecar proxies.

An identity layer built on OAuth 2.0 that issues a signed ID token containing authenticated user claims. It lets applications verify who a user is without handling passwords directly.

An authorization framework that grants a client limited, scoped access to a resource on behalf of a user or service using access tokens, without sharing the underlying credentials.

An extension to the OAuth authorization code flow where the client sends a hashed verifier with the code exchange. It prevents interception attacks against public clients such as mobile and single-page apps.

A compact, signed token format carrying claims as base64url-encoded JSON. Verifiers must check the signature, algorithm, issuer, audience, and expiry rather than trusting the payload blindly.

The process of verifying a token's signature against trusted keys, then checking issuer, audience, expiry, and scope before granting access. Skipping any check enables impersonation or replay.

An authorization model that grants access based on attributes of the subject, resource, action, and environment, evaluated against policy. It supports fine-grained rules that roles alone cannot express.

The principle that identities receive only the permissions needed for their current task, for only as long as needed. It limits blast radius when credentials are stolen or misused.

A mechanism that gives a running service its own verifiable identity, such as a cloud-assigned role or service account token, so it can authenticate without embedded static secrets.

The practice of storing, rotating, auditing, and distributing credentials through a dedicated vault or managed service instead of configuration files, environment variables, or source code.

A tool category that continuously scans cloud accounts for misconfigured resources, exposed storage, permissive network rules, and drift from approved baselines, then reports or remediates findings.

The practice of linking internal security controls to recognized frameworks such as ISO 27001, NIST 800-53, or SOC 2 criteria, so audits, evidence collection, and gap analysis share one reference structure.

The automated capture and retention of configuration snapshots, logs, scan results, and approval records that demonstrate a control operated effectively during an audit period.

Managing cloud resources through versioned declarative templates rather than manual console changes. It enables peer review, repeatable environments, and automated policy checks before deployment.

Expressing security and compliance rules as machine-evaluable definitions that pipelines enforce automatically, blocking deployments that violate encryption, tagging, or network requirements.

Protecting the dependencies, build systems, and artifacts that produce an application, including pinned versions, signed builds, provenance attestations, and vulnerability scanning of third-party components.

A machine-readable inventory of components and dependencies in a build, including versions and licenses. It lets teams rapidly locate exposure when a new vulnerability is announced.

Cryptographically signing build outputs so deployers can verify that an image or package came from an approved pipeline and was not altered in transit or in a registry.

A scheme where a data key encrypts the content and a master key encrypts the data key. Rotating the master key avoids re-encrypting large datasets.

A managed service that generates, stores, rotates, and audits cryptographic keys, and performs encrypt and decrypt operations without exposing key material to the calling application.

An encryption key the customer creates and controls inside a provider's key service, allowing independent rotation and revocation of access to protected data.

Assigning sensitivity labels such as public, internal, confidential, and restricted to data assets, which then determines required encryption, access, retention, and logging controls.

Controls that detect and block unauthorized movement of sensitive data through email, uploads, or APIs by matching patterns, labels, or fingerprints against policy.

A reverse proxy that fronts backend services, centralizing authentication, rate limiting, request validation, logging, and routing so individual services do not each reimplement those controls.

Restricting how many requests a client may make in a time window, protecting backends from abuse, credential stuffing, and accidental overload while preserving service for legitimate users.

Checking that incoming data matches expected type, format, length, and range before use, rejecting anything else. It is the primary defense against injection and malformed payload attacks.

Scanning a project's declared and transitive dependencies against vulnerability and license databases, then reporting affected components and available fixed versions.

Testing a running application from the outside by sending crafted requests and analyzing responses for exploitable weaknesses. It finds runtime and configuration issues that static review misses.

Analyzing source or bytecode without executing it to find risky patterns such as unsanitized input reaching dangerous functions. Results require triage to remove false positives.

A manual or tool-assisted examination of source changes focused on authentication, authorization, input handling, cryptography, and error handling before the code merges.

Ranking findings by exploitability, exposure, and business impact, then deciding whether to remediate, mitigate, or accept each one within a defined service-level target.

A documented decision to tolerate a known risk because mitigation cost exceeds impact, signed by an accountable owner with an expiry date and compensating controls noted.

A platform that centralizes logs from many sources, correlates events against detection rules, and alerts analysts, forming the analytical core of a security operations center.

A logic expression evaluated against normalized telemetry that fires an alert when conditions match known attacker behavior, such as a spike in denied authorization calls.

A documented sequence of roles, communication paths, and containment steps activated when a security event is confirmed, including evidence preservation and post-incident review requirements.

Capturing a bit-for-bit copy of a disk, memory, or container filesystem with verified hashes before remediation, so evidence remains admissible and analysis is reproducible.

Storing log records in write-once or tamper-evident storage with retention locks, ensuring attackers cannot erase the trail that investigators and auditors depend on.

An exploit where code inside a container gains access to the host kernel or other containers, often through privileged mode, mounted sockets, or kernel vulnerabilities.

Inspecting container image layers for known vulnerable packages, embedded secrets, and policy violations before the image is admitted to a registry or cluster.

Monitoring running workloads for anomalous process execution, file access, and network connections, then blocking or alerting on behavior that deviates from a learned baseline.

A cluster component that intercepts resource creation requests and rejects those failing policy, such as unsigned images, missing resource limits, or privileged security contexts.