CSPCC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

Division of security duties between cloud provider and customer. Provider secures physical facilities, hardware, and managed-service internals; customer secures data, identities, configurations, and, in IaaS, the guest operating system.

Defense in depth

Layering independent controls so failure of one does not expose the asset. In cloud design this means combining identity, network, encryption, and monitoring controls rather than relying on a single perimeter.

Zero trust architecture

Model that grants no implicit trust based on network location. Every request is authenticated, authorized, and encrypted, with continuous verification and least-privilege access decisions.

Blast radius

Scope of impact if a component is compromised. Cloud architects reduce it by isolating accounts, environments, and network zones so lateral movement is contained.

Risk register

Record of identified risks with owner, likelihood, impact, existing controls, residual rating, and treatment decision. Cloud entries should include provider dependency and misconfiguration scenarios.

Residual risk

Risk remaining after controls are applied. It must be compared against the organization's risk appetite and formally accepted by an authorized owner when it exceeds tolerance.

Policy hierarchy

Ordered set of governance documents: policy states intent, standards state mandatory requirements, procedures give steps, guidelines are recommendations. Cloud rules should exist at each level.

Concentration risk

Exposure from depending heavily on one provider, region, or service. Mitigations include documented exit plans, portable data formats, and tested alternate-region capability.

Least privilege

Granting only the permissions needed for a task, for the shortest time. In cloud IAM this means narrow actions on specific resources with conditions, reviewed regularly.

Role assumption

Mechanism where a principal obtains temporary credentials for a role via a trust policy. It replaces long-lived access keys and produces auditable, time-limited sessions.

Federated identity

Trust relationship letting an external identity provider authenticate users or workloads. SAML 2.0 and OpenID Connect are common; SCIM handles automated provisioning and deprovisioning.

Phishing-resistant MFA

Authentication bound to origin, such as FIDO2/WebAuthn security keys or passkeys. It resists real-time relay attacks that defeat one-time codes and push approvals.

Envelope encryption

Pattern where a data key encrypts the data and a key encryption key wraps the data key. Rotation and access control apply to the wrapping key in a KMS or HSM.

Crypto-shredding

Destroying encryption keys so ciphertext becomes unrecoverable. It supports erasure requests but requires key design per tenant or per data subject.

Data minimization

Privacy principle limiting collection to what is necessary for a stated purpose. Cloud implementations require inventory of stores, retention limits, and deletion propagation to replicas.

Data residency

Requirement that data remain within specified geographic or legal boundaries. Enforced through region-pinned storage, tenant isolation, and controls on replication and support access.

Security group vs NACL

Security groups are stateful and attached to resources; network ACLs are stateless and applied at subnet level. Both should default to deny with explicit allow rules.

Private endpoint

Interface that connects a virtual network to a provider service without traversing the public internet. It reduces exposure and supports data-exfiltration controls.

Instance metadata service

Endpoint exposing credentials and configuration to a running instance. It must require session tokens and be blocked from workloads that do not need it, to prevent SSRF credential theft.

Origin shielding

Configuration ensuring a CDN or WAF is the only path to the origin. The origin accepts traffic solely from the edge, preventing direct-to-origin bypass of protections.

Pipeline credential federation

Using OIDC trust so CI/CD jobs obtain short-lived cloud credentials instead of stored keys. It removes long-lived secrets from build systems and logs.

Policy as code

Expressing guardrails in machine-readable rules evaluated in pipelines and at runtime. It blocks noncompliant infrastructure before deployment and detects drift afterward.

Software bill of materials

Machine-readable inventory of components and dependencies in an artifact. It supports rapid identification of affected systems when a supply-chain vulnerability is disclosed.

Secret scanning

Automated detection of credentials committed to repositories or build logs. Findings require immediate revocation, because removing the commit does not invalidate the exposed secret.

Control-plane audit log

Record of management API activity showing who changed what and when. It is a primary detection source for IAM changes, key deletion, and public exposure events.

Incident containment in cloud

Limiting damage using API actions: revoke credentials, disable keys, isolate instances with security groups, and snapshot volumes before termination for later analysis.

MTTD and MTTR

Mean time to detect and mean time to respond. These operation metrics measure detection and recovery effectiveness and depend on log coverage and tested runbooks.

Chain of custody

Documented, tamper-evident record of evidence handling from collection through presentation. Cloud forensics requires hashing snapshots and logging every access to evidence.

SOC 2 Type II

Assurance report on operating effectiveness of controls over a period against trust services criteria. Customers must still evaluate complementary user entity controls and report scope.

Complementary user entity controls

Controls a provider assumes the customer implements for the overall control environment to work. They appear in assurance reports and must be mapped to the customer's own controls.

Data processing agreement

Contract governing processing of personal data on behalf of a controller. It specifies purpose, security measures, subprocessors, breach notification, and deletion obligations.

Legal hold

Obligation to preserve data relevant to litigation or investigation. It suspends normal deletion and retention schedules and must extend to backups and third-party stores.