CCSP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST cloud essential characteristics

NIST SP 800-145 lists five: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These distinguish cloud computing from traditional hosting.

Infrastructure as a Service

IaaS provides virtualized compute, storage, and networking. The provider manages physical and virtualization layers; the customer manages the guest OS, middleware, runtime, applications, and data.

Platform as a Service

PaaS provides a managed runtime and development platform. The provider manages infrastructure through the runtime; the customer deploys and secures applications and data without managing servers or the OS.

Software as a Service

SaaS delivers a complete provider-managed application over the network. The provider manages infrastructure through the application; the customer manages users, access, and its own data configurations.

Shared responsibility model

Divides security duties between cloud provider and customer. The provider secures the cloud infrastructure; the customer secures what it puts in the cloud. Customer scope shrinks from IaaS to SaaS.

Cloud deployment models

NIST defines private (single organization), community (shared by organizations with common concerns), public (open to the general public), and hybrid (composition of two or more distinct models).

Cloud data lifecycle

Phases are create, store, use, share, archive, and destroy. Security controls must be applied at every phase because data protection requirements change as data moves.

Envelope encryption

A data encryption key encrypts the data, and a key encryption key encrypts the data key. The KEK stays in a KMS or HSM, limiting plaintext key exposure.

Tokenization

Replaces sensitive data with a non-sensitive token mapped to the original value in a secure vault. It reduces compliance scope, such as PCI DSS, because the token is not cardholder data.

Data loss prevention

DLP inspects content and context to detect and block unauthorized data movement. In cloud, it can be inline through a proxy or API-based against SaaS repositories.

Crypto-shredding

Destroys or renders unavailable the encryption keys protecting data, making ciphertext unrecoverable. It is effective only if all copies are encrypted and no plaintext remnants exist.

Security group

A stateful virtual firewall applied to cloud instances or network interfaces. Return traffic is automatically allowed; rules are allow-only and evaluated as a whole.

Network ACL

A stateless subnet-level firewall. It evaluates rules in order by number, supports allow and deny, and requires explicit rules for both inbound and outbound traffic.

Type 1 hypervisor

A bare-metal hypervisor that runs directly on hardware and hosts guest virtual machines. It offers stronger isolation and performance than hosted Type 2 hypervisors; patching is critical.

Bastion host

A hardened, monitored jump server used to access private cloud resources. It centralizes administrative access, logging, and MFA, reducing direct exposure of management interfaces.

Virtual sprawl

Uncontrolled proliferation of virtual machines, snapshots, and images. It expands attack surface, consumes resources, and complicates inventory, patching, and compliance.

STRIDE

Threat modeling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Each category maps to specific mitigations such as authentication and integrity controls.

SAST

Static application security testing analyzes source code, bytecode, or binaries without executing the application. It finds coding flaws early but produces false positives and cannot see runtime configuration.

DAST

Dynamic application security testing probes a running application from the outside, simulating attacks. It finds runtime and configuration issues but has limited code-level visibility.

OAuth 2.0

An authorization framework that issues access tokens so a client can access protected resources on behalf of a user, without sharing the user's credentials.

OpenID Connect

An identity layer built on OAuth 2.0. It adds an ID token, a signed JWT with user identity claims, enabling authentication and single sign-on for client applications.

CASB

Cloud access security broker that sits between users and cloud services to enforce policy. Deployed as forward proxy, reverse proxy, or API-based, it provides visibility, DLP, and threat protection.

Recovery time objective

The maximum acceptable time to restore a service after disruption. It drives architecture choices such as warm standby or multi-region failover and is measured in time.

Recovery point objective

The maximum acceptable amount of data loss measured in time before a disruption. It determines backup frequency and replication lag tolerances.

SIEM

Security information and event management platform that aggregates and correlates logs from many sources, supports alerting, and retains evidence for investigations and compliance.

Incident response lifecycle

Phases are preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Cloud incidents additionally require provider coordination and API-based evidence collection.

Chain of custody

Documented, unbroken record of who handled evidence, when, and how. It preserves admissibility; in cloud, use hashed snapshots, provider logs, and documented acquisition procedures.

GDPR

EU data protection regulation requiring a lawful basis for processing, data subject rights, breach notification within 72 hours, and safeguards for cross-border transfers of personal data.

HIPAA

US law protecting protected health information. Covered entities and business associates must implement administrative, physical, and technical safeguards and execute business associate agreements for cloud processing.

PCI DSS

Payment Card Industry Data Security Standard with 12 requirements for protecting cardholder data. Tokenization and network segmentation reduce the scope of systems requiring compliance.

SOC 2

An attestation report on a service organization's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Type I covers design at a point in time; Type II covers operating effectiveness.

ISO/IEC 27017

International standard providing cloud-specific information security controls and implementation guidance for cloud service providers and customers, extending ISO/IEC 27002.