CCSK key terms

A widely used model describing cloud computing as on-demand network access to a shared pool of configurable computing resources that can be provisioned and released rapidly with minimal provider interaction or management effort.

The five traits NIST uses to define cloud: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A service must show all five to count as cloud computing.

A single instance of software or infrastructure serves multiple customers, with each tenant's data and activity logically isolated. Pooling resources this way lowers provider cost but makes isolation controls and misconfiguration the main security concern.

The three delivery categories - Infrastructure as a Service, Platform as a Service, and Software as a Service - defined by how much of the stack the provider manages versus the customer. Higher-level models shift more security responsibility to the provider.

The four arrangements for hosting cloud services - public, private, hybrid, and community - describing who owns the infrastructure and who shares it. The choice affects control, cost, compliance obligations, and exposure to other tenants.

The division of security duties between a cloud provider and its customer. The provider secures the underlying facilities and platform; the customer secures data, identities, configuration, and whatever the service model leaves in their control.

The policies, decision rights, and oversight mechanisms an organization uses to direct cloud adoption - approving services, setting standards, managing cost and risk, and holding teams accountable across business units.

The Cloud Security Alliance's catalog of security control objectives mapped to industry standards, used to assess cloud providers and build control frameworks. It gives a common vocabulary for comparing provider assurances.

CSA's public repository of provider self-assessments via the Consensus Assessments Initiative Questionnaire, third-party audits, and certifications. Buyers use it for preliminary due diligence before requesting more detailed evidence.

A U.S. government program that authorizes cloud services for federal use through standardized security assessments, continuous monitoring, and a shared repository of authorization packages. Many commercial buyers treat it as evidence of maturity.

Rules and practices that keep data physically stored or processed within specified geographic or legal boundaries. It stems from law, contract, or policy and must be checked against where a provider replicates and backs up.

A cross-functional team that sets cloud standards, builds shared landing zones and guardrails, and coaches product teams. It centralizes expertise early while pushing day-to-day delivery into business units.

A documented plan for moving data, workloads, and identities off a provider - covering export formats, deletion confirmation, transition timelines, and dependencies on proprietary services - agreed before the contract is signed.

An arrangement where a trusted identity provider authenticates users and passes assertions to cloud applications, so accounts and credentials are managed centrally rather than per service. It relies on standards such as SAML and OpenID Connect.

An XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider. It is common for browser single sign-on to enterprise cloud applications.

Tools and processes that control, vault, and record high-privilege accounts such as cloud administrators and root users. It limits standing access, enforces approval workflows, and creates an audit trail of administrative actions.

Secure storage and controlled retrieval of credentials such as API keys, tokens, and database passwords, usually through a dedicated vault with rotation and short-lived issuance. It removes hard-coded secrets from code and configuration.

A policy enforcement point placed between users and cloud services that provides visibility into sanctioned and unsanctioned app use, plus controls for authentication, encryption, data loss prevention, and malware.

A platform that collects, normalizes, correlates, and alerts on log and event data from many sources. In cloud environments it must ingest provider control-plane logs, workload logs, and identity events to detect attacks.

A tool that continuously compares cloud configuration against policy and benchmarks, flagging risky settings such as public storage buckets or overly permissive roles. It works from provider APIs rather than host agents.

A logically isolated network within a provider's shared infrastructure where you define subnets, routing, and address ranges. It is the boundary for many network controls and peering relationships.

A stateful, resource-level firewall rule set that permits or denies traffic to cloud resources. Because rules are allow-lists attached to resources, overly broad rules are a frequent finding in assessments.

Granular network control that isolates individual workloads or groups from one another rather than relying only on a perimeter. It limits lateral movement after a compromise and is often enforced through policy tied to workload identity.

A dedicated private network link between an organization's data center and a cloud provider, bypassing the public internet. It improves predictability and reduces exposure but does not by itself encrypt traffic.

A security product focused on protecting running workloads - virtual machines, containers, and serverless functions - through vulnerability scanning, behavioral monitoring, and runtime protection. It complements posture tools that assess configuration.

Automated inspection of container images for known vulnerabilities, embedded secrets, and policy violations before deployment. Scanning in the build pipeline and registry catches problems before they reach production.

Protecting stored data with encryption keys and protecting data moving across networks with protocols such as TLS. Both are baseline controls, but key custody and configuration determine how much protection they actually provide.

A managed service for creating, storing, rotating, and controlling access to cryptographic keys. It centralizes key policy so that encryption across many cloud services can be audited and revoked consistently.

A tamper-resistant hardware device that generates and stores keys and performs cryptographic operations inside a protected boundary. Cloud providers offer them as managed or dedicated services for high-assurance key custody.

Assigning data to sensitivity categories so that handling, access, retention, and protection requirements follow the label. Effective classification is a prerequisite for scoping encryption, monitoring, and loss-prevention controls.

Controls that detect and block sensitive data leaving approved boundaries, using pattern matching, labels, or context. In cloud, DLP is applied at endpoints, email, SaaS APIs, and storage services.

Residual copies of data left on storage media after deletion or reassignment. In cloud, customers must rely on provider sanitization commitments, crypto-shredding by destroying keys, and contractual deletion terms.

Moving security activities earlier in the development lifecycle - into design, coding, and build - so defects are cheaper to fix and controls are built in rather than audited afterward.

Two application testing approaches: static analysis inspects source or binaries without running the program, while dynamic analysis attacks a running application. They find different flaw classes and are usually combined.

Examining infrastructure-as-code templates for insecure defaults, missing controls, and policy violations before deployment. It prevents misconfigurations - a leading cloud risk - from being provisioned in the first place.

A documented set of roles, escalation paths, communication channels, and procedures for detecting, containing, eradicating, and recovering from a security incident. It must account for provider dependencies and shared responsibilities.

Collecting and preserving evidence from cloud systems, where logs and snapshots may be volatile, provider-controlled, or spread across regions. It requires pre-arranged provider cooperation and legally defensible acquisition procedures.

Recovery Time Objective is the maximum acceptable downtime; Recovery Point Objective is the maximum acceptable data loss measured in time. Both drive backup frequency, replication choices, and failover architecture.

A security model that grants access per request based on identity, device, and context rather than assuming a trusted network. It replaces perimeter trust with continuous verification and least privilege.

Integrating security practices, automation, and ownership into DevOps delivery so controls run continuously in pipelines and teams share accountability for security outcomes rather than handing off to a separate team.