CSA (Other exams) key terms

Layering independent preventive, detective, and corrective controls so that a single failure or bypass does not expose the whole system. Layers typically span identity, network, host, application, and data tiers.

An architecture principle that grants no implicit trust based on network location; every request is authenticated, authorized, and continuously evaluated using least privilege and explicit policy decisions.

The division of security duties between a cloud provider and its customer. The provider secures the physical facility and hypervisor; the customer secures data, identities, configurations, and workloads it places in the cloud.

The IaaS, PaaS, and SaaS tiers that describe how much of the stack the provider manages. Higher abstraction shifts more patching and platform hardening to the provider while reducing customer control.

Software that creates and runs virtual machines, allocating CPU, memory, and devices to guests. Type 1 runs directly on hardware; Type 2 runs atop a host operating system.

An attack in which code running inside a guest virtual machine breaks out to the hypervisor or host, compromising other tenants. It is a high-impact virtualization threat requiring prompt patching.

The use of kernel namespaces, cgroups, and capability restrictions to separate containerized workloads sharing one host kernel. Weaker than virtual machines because a kernel flaw can cross boundaries.

Dividing a network into zones with enforced traffic control between them, so that compromise in one area cannot freely reach another. Controls may be firewalls, ACLs, or software-defined policy.

Granular policy enforcement at the workload level, often using identity or labels rather than IP subnets, so individual servers or containers permit only explicitly allowed flows.

A buffer network holding internet-facing services, separated from the internal network by filtering controls. It limits the reach of an attacker who compromises an exposed host.

Restricting outbound traffic from internal systems to approved destinations and ports. It blunts data exfiltration and command-and-control callbacks after an intrusion.

The component that evaluates access requests against policy and returns allow or deny. It is separated from enforcement so that rules are applied consistently across resources.

The component that intercepts a request and applies the decision returned by the policy decision point. Examples include proxies, gateways, and agents on endpoints.

Granting identities and processes only the permissions needed for their current task, for the shortest practical duration. It limits blast radius when credentials are misused.

Splitting sensitive tasks among different people so no single individual can complete a high-risk action alone, such as both creating a vendor and approving its payment.

Elevating privileges only when requested and approved, then revoking them automatically after a set window. It reduces standing administrative rights and the value of stolen credentials.

Tools and processes that vault, broker, rotate, and record administrative credentials and sessions. The goal is to control and audit the accounts that can change critical systems.

Trust between identity providers that lets a user authenticate once and access resources in another organization or domain, typically via signed assertions such as SAML or OIDC tokens.

A signed XML statement from an identity provider about a subject's authentication and attributes, consumed by a service provider to make an access decision.

A session pattern where one successful authentication grants access to multiple applications without re-entering credentials. It improves usability but concentrates risk in the primary identity.

Requiring two or more independent evidence types, such as a password plus a hardware key. Independence matters: two passwords or two knowledge questions are not true MFA.

Methods bound to the legitimate origin, such as FIDO2 security keys or passkeys, that cannot be replayed against a lookalike site. They defeat real-time credential relay attacks that OTP codes do not stop.

Stealing or fixing an active session token to act as an authenticated user without knowing their password. Mitigations include short token lifetimes, binding tokens to context, and rotation on privilege change.

Assigning permissions to job roles and then assigning users to roles, rather than granting rights individually. It simplifies review and keeps entitlements aligned with business function.

Deciding access from attributes of the subject, resource, action, and environment evaluated against policy. It supports fine-grained, context-aware rules such as device posture or time of day.

Labeling information by sensitivity and business value so that handling, storage, and access controls match its risk. Labels drive encryption, retention, and sharing decisions.

Controls that inspect content in motion, at rest, or in use and block or alert on unauthorized disclosure. Effective DLP depends on accurate classification and tuned rules.

Replacing sensitive values with surrogate tokens that map back through a protected vault. Unlike encryption, the token has no mathematical relationship to the original data.

Encrypting data with a data key, then encrypting that data key with a key-encryption key held in a managed key service. It limits how much ciphertext one key must protect and simplifies rotation.

A managed service that generates, stores, rotates, and audits cryptographic keys and controls their use through access policy, so keys never appear in application code or configuration files.

A tamper-resistant device that stores keys and performs cryptographic operations inside a protected boundary. It provides stronger key protection than software storage alone.

A key-exchange property where compromise of a long-term key does not reveal past session keys, because each session derives ephemeral keys that are then discarded.

Terminating and re-originating encrypted traffic at a proxy so content can be examined. It introduces privacy, performance, and certificate-trust considerations and should be scoped narrowly.

A structured exercise that identifies assets, entry points, threat actors, and abuse cases, then records mitigations before code ships. STRIDE and attack trees are common techniques.

Embedding security activities such as requirements, design review, static analysis, dependency scanning, and penetration testing into each phase of software delivery rather than bolting them on at release.

Scanning third-party libraries and dependencies for known vulnerabilities, license issues, and outdated versions. It is essential because most application code is assembled from external packages.

A machine-readable inventory of the components and versions in a software product. It enables rapid identification of exposure when a new dependency vulnerability is disclosed.

The sum of points where an adversary could interact with or influence a system, including exposed services, APIs, credentials, and supply chain dependencies. Reducing it lowers likelihood of compromise.

Observable artifacts such as malicious file hashes, domains, or registry keys that suggest an intrusion. They are reactive and best used for scoping and hunting known threats.

Evidence of adversary behavior or intent, such as unusual lateral movement or privilege escalation sequences. They are more durable than static compromise artifacts because behavior is harder to change.

A platform that centralizes logs, correlates events, and generates alerts against detection rules. Its value depends on complete log sources and tuned, maintained content.

The repeating phases of preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment choices balance stopping spread against preserving evidence.

Documented, unbroken record of who handled evidence, when, and how, so its integrity can be defended. It requires labeled storage, hashing, and controlled transfer.

A living record of identified risks with owners, likelihood, impact, treatment decisions, and review dates. It makes residual risk visible to leadership and supports audit evidence.

Choosing how to handle a risk: mitigate with controls, transfer via insurance or contract, avoid the activity, or accept it with documented approval. Each option carries different cost and residual exposure.

The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. It guides thresholds and escalation rather than being a single number.

Aligning controls from one standard to another, such as ISO 27001 to NIST CSF, so a single implemented control can satisfy multiple obligations and audits without duplicate work.

The ongoing practice of applying reasonable safeguards and oversight expected of a prudent organization. It is demonstrated through documented policy, training, and monitoring rather than intent alone.