CCSP cheat sheet

NIST SP 800-145 defines five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

Three service models: SaaS (provider manages application through infrastructure), PaaS (provider manages platform; consumer deploys applications), IaaS (provider manages virtualization through infrastructure; consumer manages guest OS and above).

Four deployment models: private (single organization), community (shared by organizations with common concerns), public (open to general public), and hybrid (composition of two or more distinct models).

Shared responsibility: the CSP secures the cloud itself; the customer secures what it puts in the cloud. Customer scope decreases from IaaS to PaaS to SaaS.

ISO/IEC 17788 defines cloud computing vocabulary; ISO/IEC 17789 defines the cloud computing reference architecture (CCRA).

Jericho Forum de-perimeterization: boundary defenses erode as data and services move outside the network perimeter; identity-centric and data-centric controls replace perimeter controls.

Decision rule: select IaaS for OS-level control, PaaS for standardized runtime without OS management, and SaaS when minimal customization is acceptable.

Cloud benefits include elasticity, measured service, and a shift from capital to operating expense; risks include multi-tenancy, loss of control, and vendor lock-in.

A cloud reference architecture separates provider layers (physical, resource abstraction) from consumer layers (service, access), with security and management as cross-cutting functions.

Data lifecycle phases (ISO/IEC 27040, CSA): create, store, use, share, archive, destroy. Controls must be defined for every phase because protection requirements change as data moves.

Three data states: at rest, in transit, and in use. Controls map respectively to encryption at rest, TLS/IPsec, and memory protection or confidential computing.

Data classification drives control selection. Typical tiers are public, internal, confidential, and restricted.

DLP inspects content and context to detect and block exfiltration; CASB provides inline proxy or API-based DLP for cloud services.

Tokenization replaces sensitive data with a non-sensitive token mapped to a vault value, reducing PCI DSS scope; format-preserving encryption retains the original data format.

Envelope encryption: a data encryption key encrypts data, and a key encryption key encrypts the data key. The KEK resides in a KMS or HSM.

Key custody models: provider-managed, customer-managed (BYOK), and hold-your-own-key (HYOK); the model determines who can decrypt and who controls key lifecycle.

Crypto-shredding destroys keys to render ciphertext unrecoverable; it fails as a destruction method if unencrypted copies or backups remain.

Data residency and sovereignty constrain where data is stored and processed; eDiscovery requires legal hold, defensible collection, and preservation of metadata.

Infrastructure layers are compute, network, storage, and virtualization; each layer has distinct hardening, isolation, and monitoring controls.

Hypervisor types: Type 1 runs bare-metal; Type 2 is hosted. VM escape and hyperjacking are key threats, so hypervisors require patching and minimal management exposure.

Security groups are stateful instance-level virtual firewalls with allow-only rules; network ACLs are stateless subnet-level firewalls evaluated in numbered order with allow and deny rules.

Storage controls include encryption at rest, bucket or container ACLs, pre-signed URLs with expiry, versioning, and MFA delete for resilience.

Management-plane access belongs on a private network path; bastion/jump hosts, VPN, or zero-trust access replace direct public exposure of administrative interfaces.

Immutable infrastructure and golden images reduce configuration drift; CIS benchmarks and provider hardening guides supply configuration baselines.

Virtual sprawl and unmanaged snapshots increase attack surface, cost, and compliance risk; lifecycle policies and inventory enforcement are the countermeasure.

Software-defined networking separates the control plane from the data plane; a software-defined data center virtualizes compute, storage, network, and management.

In IaaS, the customer patches the guest OS, middleware, and applications; the provider patches the hypervisor, host OS, and physical infrastructure.

Secure SDLC integrates threat modeling, secure coding, security testing, and deployment gates into requirements, design, build, test, deploy, and operate phases.

STRIDE categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Each category maps to specific mitigations.

SAST analyzes source or bytecode without execution (white box); DAST probes a running application (black box); IAST combines runtime instrumentation; SCA scans third-party dependencies for known vulnerabilities.

OAuth 2.0 delegates authorization with access tokens; OpenID Connect adds an authentication layer and a signed ID token on top of OAuth 2.0.

SAML 2.0 uses XML assertions for browser-based single sign-on federation; WS-Federation is an alternative federation protocol.

A WAF filters HTTP traffic against patterns such as the OWASP Top 10; RASP instruments the runtime to detect and block attacks inside the application.

Secrets management: credentials are never hardcoded; vaults and short-lived credentials with CI/CD injection replace static secrets in code and pipelines.

API security requires authentication on every call, input and schema validation, rate limiting, and least-privilege token scopes.

CASB deployment modes are forward proxy, reverse proxy, and API-based; the mode determines whether it can inspect encrypted traffic inline or only via provider APIs.

Monitoring data types are logs, metrics, and traces; centralize them in a SIEM and set retention to satisfy both operational and legal requirements.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Cloud forensics: capture volatile data first, use provider APIs and snapshots, preserve hashes and logs, maintain chain of custody, and account for data jurisdiction.

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss. Both drive backup frequency, replication, and failover architecture.

Backup 3-2-1 rule: three copies, on two media types, with one offsite or immutable; restore tests validate that backups are usable.

Change management with configuration baselines and infrastructure-as-code scanning reduces drift; approval gates enforce separation of duties.

SecDevOps automates SAST, DAST, SCA, IaC scanning, and continuous compliance checks within CI/CD pipelines.

Availability design: multi-AZ within a region for resilience, multi-region for disaster recovery; composite SLA is the product of dependent component SLAs.

Capacity and performance controls include autoscaling policies, service quotas, and throttling limits; quota exhaustion is a common cloud outage cause.

GDPR requires a lawful basis for processing, data subject rights, breach notification to the supervisory authority within 72 hours, processor contracts, and a transfer mechanism for cross-border data.

HIPAA protects PHI; covered entities and business associates need business associate agreements, and the Security Rule requires administrative, physical, and technical safeguards.

PCI DSS has 12 requirements for cardholder data; tokenization and network segmentation reduce the scope of systems subject to compliance.

ISO/IEC 27001 defines an ISMS; 27017 adds cloud-specific controls; 27018 covers PII protection in public clouds; 27036 addresses supply chain security.

SOC 1 covers financial reporting controls; SOC 2 covers the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy); SOC 3 is a public summary.

Cloud contracts define SLAs and service credits, a data processing addendum, audit rights, subprocessor notification, and exit or data portability terms.

Risk treatment options are mitigate, transfer, avoid, and accept; risk is assessed as likelihood multiplied by impact against defined criteria.

eDiscovery process: legal hold, preservation, collection, processing, review, and production; failure to preserve creates spoliation risk.

Data is subject to the laws of the jurisdiction where it is stored or processed; transfer mechanisms such as SCCs and adequacy decisions govern cross-border movement.