CCSK cheat sheet

NIST SP 800-145 defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service; a service must exhibit all five to be 'cloud'.

Three service models: SaaS (provider runs the whole application stack), PaaS (provider runs OS, runtime and middleware; customer deploys code and data), IaaS (provider runs virtualization and hardware; customer runs the guest OS upward).

Four deployment models: public, private, hybrid, and community; hybrid is two distinct models joined by data or application portability, not simply 'private plus public'.

Shared responsibility shifts with the model: IaaS customer owns OS and above; PaaS customer owns application, configuration, and data; SaaS customer owns data, identities, and endpoint use.

Resource pooling implies multitenancy, so tenant isolation depends on hypervisor separation, network segmentation, and correct tenant-ID validation in every request.

Elasticity creates lifecycle risk: rapid provisioning produces orphaned volumes, snapshots, and identities that persist after workloads are destroyed unless de-provisioning is automated.

NIST names five cloud actors: consumer, provider, auditor, broker, and carrier; the broker aggregates and mediates services, which adds a supply-chain trust hop.

ISO/IEC 17788 provides the standardized vocabulary and ISO/IEC 17789 the reference architecture; CSA's reference model aligns governance, operations, and service-model layers.

Risk = likelihood x impact; cloud-specific risks include shared tenancy, provider lock-in, data residency, supply-chain dependency, provider insolvency, and loss of exit capability.

CSA Cloud Controls Matrix (CCM) is a cloud-specific control set that maps to ISO 27001, NIST, and PCI DSS; the CAIQ is its matching self-assessment questionnaire.

The CSA STAR registry publishes provider assurance at Level 1 (self-assessment), Level 2 (third-party audit), and Level 3 (continuous audit-based certification).

SOC 2 Type I attests control design at a single point in time; Type II attests design and operating effectiveness across a period, typically six to twelve months.

Compliance is never fully inherited: a provider's certificate covers only the provider's scope, while customer-side controls (identity governance, data classification, configuration) must be evidenced separately.

Audit rights must be contracted explicitly: right to audit, access to reports, penetration-test summaries, notification of material changes, and breach notification windows.

Policy hierarchy: policy (mandatory intent) > standard (specific requirements) > procedure (steps) > guideline (advisory); only the first three are enforceable.

Jurisdictional data location is a legal fact, not a technical control; replication, backups, CDN caching, and support access can move or expose data across borders.

KRIs measure risk exposure (e.g., count of public storage buckets) and KPIs measure control performance (e.g., percent of assets scanned); both should feed the governing body.

A Cloud Center of Excellence centralizes standards, guardrails, and reusable patterns while business units retain accountability for their own workloads under a federated model.

The shared responsibility split must be documented per service model and per control, with exactly one Accountable owner in the RACI for each control.

Typical cloud accountability split: security owns policy; platform engineering owns guardrails and landing zones; application teams own configuration of their own workloads.

Role definitions to assign explicitly: cloud service owner, data owner, data custodian, security architect, and incident commander.

Skill shift: hardware and network operations decline while infrastructure as code, policy as code, API automation, and dependency management increase.

Tagging and showback/chargeback link cost accountability to security accountability; untagged resources are simultaneously a budget and an inventory gap.

Third-party management becomes continuous monitoring of assurance artifacts rather than one-time onboarding, because provider configurations and subprocessors change.

Change management must extend to IaC pipelines; peer review and automated policy gates supplement or replace parts of traditional change advisory approval.

Human-factor controls (phishing resistance, secrets handling, privileged access hygiene) remain the highest-yield awareness investments in cloud environments.

Cloud IAM policy evaluation order: explicit deny overrides explicit allow, and anything not explicitly allowed is implicitly denied.

Federation uses SAML 2.0 or OpenID Connect to assert identity across trust domains; OAuth 2.0 is delegated authorization and is not an authentication protocol by itself.

SCIM standardizes automated provisioning and, critically, deprovisioning between an identity provider and SaaS applications.

Prefer short-lived credentials from a security token service over long-lived access keys; static keys are the most common source of cloud credential leaks.

Least privilege is enforced with scoped roles or policies, permission boundaries, and periodic entitlement reviews; unused-permission analysis tools identify over-grant.

Privileged access requires MFA (hardware-backed for root/global admin), just-in-time elevation, and session logging; root accounts should not be used for daily operations.

Zero trust replaces network-location trust with per-request authentication and authorization based on identity, device posture, and context.

De-provisioning is incomplete unless it also removes API keys, service accounts, federated trust relationships, and OAuth consent grants.

Separation of duties applies to cloud too: the identity that deploys infrastructure should not also be able to alter audit logging or key policies.

Core log planes: control plane (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs), network (VPC flow logs), workload agents, and application logs.

Management-plane logs are the highest-value cloud telemetry because API abuse by a compromised principal looks like ordinary administrative traffic.

Aggregate logs to a dedicated security account or subscription with restricted write access; store in object-lock/WORM storage to preserve forensic integrity.

SIEM pipeline: normalization, enrichment, correlation rules, alert triage, and tuning; MITRE ATT&CK for cloud supplies technique-level detection mapping.

Cloud-native detection services (GuardDuty, Security Hub, Defender for Cloud, Security Command Center) complement rather than replace customer correlation.

Default retention (often 90 days hot) usually fails both regulatory minimums and investigation needs; set retention from legal and incident-response requirements.

Baseline normal API behavior per identity, then alert on new regions, new user agents, disabled logging, key creation, and mass data egress.

Providers cannot see inside customer workloads; guest-level and application telemetry must be collected and shipped out by the customer.

Clock synchronization matters: correlate events across services and providers using NTP-synchronized UTC timestamps.

Security groups are stateful, instance-level virtual firewalls with allow-only rules; network ACLs are stateless and subnet-level with ordered allow and deny rules.

Standard VPC pattern: public subnets only for ingress tiers, private subnets for workloads and data, outbound traffic through NAT or an inspecting proxy with logging.

Private connectivity options include VPC peering, transit gateways, private endpoints/PrivateLink, and dedicated interconnect; use them instead of routing sensitive traffic over the internet.

Plan non-overlapping CIDR ranges before deployment; overlapping address space blocks peering, merger, and hybrid connectivity later.

Software-defined networking makes all network controls API-driven, so misconfiguration rather than hardware failure is the dominant network risk.

Layered protections: provider DDoS absorption at layers 3/4, security groups and NACLs for segmentation, WAF for layer 7 HTTP(S), and identity-aware proxies for application access.

Zero trust networking uses micro-segmentation and per-request authorization; no implicit trust is granted from being inside a VPC or subnet.

Infrastructure as code requires version control, peer review, drift detection, and policy-as-code guardrails (OPA, AWS Config rules, Azure Policy).

Harden with CIS Benchmarks for the specific OS and service versions in use; immutable images reduce drift compared with in-place configuration.

Workload categories differ in control surface: VMs (full OS control), containers (shared kernel), serverless functions (code, role, and event source only), and managed PaaS runtimes.

Containers share the host kernel, so isolation depends on namespaces, cgroups, seccomp/AppArmor profiles, and non-root execution; a kernel exploit escapes every container on the host.

Scan images for vulnerabilities at build time and continuously in the registry, sign them, and enforce admission control so only trusted images run.

Immutable infrastructure means rebuild rather than patch: golden images must be regenerated on each patch cycle and the old ones retired.

For serverless, the provider secures the runtime; the customer secures function code, its IAM role, third-party dependencies, and event-source permissions.

CSPM finds configuration drift and misconfiguration; CWPP protects running workloads; both should feed the same risk register rather than separate queues.

Ephemeral workloads lose local logs on termination, so telemetry must be shipped off-instance in near real time.

Secrets must never be baked into images, user data, or environment files; use a secrets manager or workload identity with short-lived tokens.

Agentless scanning extends vulnerability coverage to instances that cannot host agents, but agent-based telemetry remains necessary for runtime detection.

Data lifecycle: create/classify, store, use, share, archive, destroy; each phase has distinct controls and different accountable owners.

Encryption states: at rest (AES-256 or equivalent), in transit (TLS 1.2+), and in use (confidential computing, enclaves, or privacy-preserving computation).

Envelope encryption: a data key encrypts the data and a KMS master key encrypts the data key; the wrapped data key is stored alongside the ciphertext.

Key custody models progress from provider-managed to customer-managed (BYOK) to hold-your-own-key (HYOK) to client-side encryption, each shifting control and operational burden to the customer.

Crypto-shredding - destroying the key so ciphertext is unrecoverable - is an accepted sanitization method for encrypted data, but only if no plaintext copies or key backups remain.

Classification drives control selection: labels enable DLP, CASB policy enforcement, and access decisions based on data sensitivity.

Data residency (where data is stored) and data sovereignty (which laws apply) are distinct; replication, backups, and support access can violate residency assumptions.

Sanitization of shared storage should follow NIST SP 800-88; verify the provider's documented media destruction process for the storage class used.

Tokenization and masking shrink compliance scope (notably PCI DSS) by removing sensitive values from systems that do not need them.

Shift-left toolchain: threat modeling at design, SAST on source, SCA on dependencies, DAST on running environments, and IAST/RASP for runtime protection.

Secrets sprawl is the top cloud application risk; enforce a secrets manager with short-lived tokens and automate commit and image scanning for credentials.

The CI/CD pipeline is a high-value target: harden build agents, isolate runners per trust level, sign artifacts, and give deploy identities least privilege.

IaC scanning catches insecure cloud configuration (public buckets, open security groups, unencrypted volumes) before resources are created.

API security requires authentication, authorization per object, rate limiting, schema validation, and an inventory that catches shadow and deprecated endpoints.

Serverless attack surface is event-driven: validate event payloads, restrict function role permissions, and treat event sources as untrusted input.

Broken access control on object storage and SSRF to the instance metadata service are cloud-specific additions to the OWASP Top 10 baseline.

SaaS risk concentrates in OAuth consent grants, third-party integrations, and external sharing settings that bypass the application's own access checks.

Secure SDLC gates must be automated and blocking in the pipeline; documented manual review processes degrade without enforcement.

NIST SP 800-61 phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Cloud IR lacks physical access and media seizure; use provider APIs for disk snapshots, memory capture where supported, and log export as the evidence path.

Preserve before remediating: isolate an instance by tightening its security group and snapshot volumes, because termination destroys volatile evidence permanently.

Pre-negotiate provider escalation: contract SLAs, support tier contacts, law-enforcement request procedures, and the provider's own incident notification commitments.

RTO is maximum tolerable downtime and RPO is maximum tolerable data loss; both derive from a business impact analysis, not from technical convenience.

Multi-AZ addresses availability within a region; multi-region addresses disaster recovery; the two are not substitutes for each other.

Backups must be tested for restore and protected with object lock or air-gapped copies to resist ransomware deleting the primary and replicas.

Failover tests must include identity provider, DNS, and key management - the most common single points of failure in cloud DR designs.

Breach notification clocks (e.g., GDPR 72 hours) start at awareness, not at conclusion of the investigation, so parallel legal escalation is required.

Containers virtualize the operating system and share the host kernel; virtual machines virtualize hardware and each carry a full guest OS.

Function as a service is event-driven, auto-scaling, stateless, billed per invocation and duration, and bounded by a maximum execution time.

Big data platforms shift the control focus to data-lake access control, lineage, metadata cataloging, and encryption of both raw and derived datasets.

IoT devices are constrained, long-lived, and poorly patchable; security depends on unique device identity, gateway segmentation, and lifecycle replacement planning.

DevOps is culture plus automation plus measurement plus sharing; DevSecOps inserts automated security gates into that pipeline rather than adding a separate review stage.

Zero trust architecture per NIST SP 800-207 separates the policy decision point from the policy enforcement point and evaluates every request on context.

SASE and SD-WAN converge networking and security at the edge, moving inspection from a central data center to the user and workload location.

Cryptographic agility is a design requirement: algorithm and key length choices must be replaceable without re-architecting data protection.