CrowdStrike CCCS key terms

The division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure, while the customer secures data, identities, configurations, and workloads they deploy.

A tool category that continuously inspects cloud configurations against benchmarks and policies, flagging misconfigurations such as public storage buckets or overly permissive security groups.

Managing cloud resources through declarative templates and pipelines rather than manual console clicks, enabling repeatable, reviewable, and auditable environment provisioning.

The practice of comparing live cloud resource configurations against their intended declared state to reveal unauthorized or accidental changes made outside the deployment pipeline.

A publicly maintained set of consensus hardening recommendations for specific operating systems, cloud platforms, and applications, commonly used as the baseline for configuration assessment.

An environment using services from two or more cloud providers, which increases operational complexity and requires unified visibility, consistent identity policy, and normalized telemetry.

The management layer of a cloud platform that handles authentication, authorization, and resource orchestration through APIs; compromise here can affect every resource beneath it.

The layer that actually processes and stores workload traffic and content, as opposed to the management APIs that configure it. Attacks here target runtime behavior and data.

A compute model where the provider manages servers and scales functions on demand. Security focus shifts to code dependencies, event triggers, permissions, and short-lived execution contexts.

The cloud subsystem governing who can perform which actions on which resources, expressed through principals, policies, roles, and permission boundaries.

Granting only the permissions required for a task, for only as long as needed. In cloud environments this means narrow policy statements, scoped resources, and time-bound access.

A principal temporarily obtaining credentials for another identity, typically a role, through a trust policy. Widely used for cross-account access and service delegation.

A resource-based policy attached to a role that declares which principals are allowed to assume it and under what conditions, such as source account or external ID.

A flaw where a trusted service is tricked into acting on behalf of an attacker against another party. Cross-account role trust without an external ID condition is a classic cloud example.

A maximum-permission limit attached to an identity that does not grant access itself but caps what identity-based policies can allow, preventing privilege escalation.

Short-lived access keys or tokens issued after authentication or role assumption, reducing exposure compared with long-lived static keys embedded in code or configuration.

Trusting an external identity provider to authenticate users and pass assertions to the cloud, so credentials are not duplicated and central controls like MFA apply.

A mechanism letting users authenticate once to a central identity provider and reach multiple cloud consoles and applications without separate credentials.

Requiring two or more independent verification factors during login. Enforcing it on privileged and console accounts blocks a large share of credential-based intrusions.

Automated replay of username and password pairs stolen elsewhere against cloud login endpoints, succeeding where passwords are reused and MFA is absent.

Any running compute unit in the cloud, such as a virtual machine, container, or function, including its code, configuration, and attached identities.

Monitoring and blocking activity while a workload executes, detecting behaviors like unexpected shell spawning, crypto-mining, or lateral movement rather than only scanning artifacts beforehand.

Inspecting container images for vulnerable packages, secrets, and malware before deployment, ideally gating the build pipeline so flawed images never reach production.

The people, code, dependencies, and build systems that produce a workload. Securing it means verifying provenance, pinning versions, and monitoring for tampered artifacts.

An internal endpoint virtual machines query for configuration and temporary credentials. Unrestricted access from server-side request forgery is a common cloud credential theft path.

An attack forcing a server to fetch an attacker-chosen URL, often used in cloud to reach internal metadata endpoints and retrieve role credentials.

Storing and distributing keys, tokens, and passwords in a dedicated vault with access control, rotation, and audit logging instead of hardcoding them in code or images.

An isolated virtual network within a cloud region, containing subnets, route tables, and gateways that define how workloads communicate internally and with the internet.

A stateful, instance-level virtual firewall controlling allowed inbound and outbound traffic by protocol, port, and source or destination.

A stateless, subnet-level filter evaluating ordered allow and deny rules for traffic entering or leaving a subnet, complementing instance-level firewalls.

Records of connection metadata such as source, destination, port, and bytes transferred. They support traffic analysis and threat hunting without capturing packet payloads.

Network communication between workloads inside the same cloud environment. It is a primary lateral movement path after an initial compromise and often lacks inspection.

A private network interface connecting a VPC to a provider service so traffic never traverses the public internet, reducing exposure and data exfiltration risk.

Identifying malicious activity by analyzing patterns of action, such as process lineage or unusual API sequences, rather than relying solely on known signatures.

Evidence of active adversary behavior and intent, such as credential dumping or defense evasion, which can detect novel tooling that signature-based indicators would miss.

Artifacts indicating a breach already occurred, such as malicious hashes, domains, or IP addresses. Useful for scoping incidents but easily changed by attackers.

Provider records of every management and data API call, including caller identity, source address, and outcome. They are essential for detecting privilege abuse and unauthorized changes.

An alert condition where the same identity authenticates from geographically distant locations within a timeframe that makes physical travel infeasible, suggesting stolen credentials.

A proactive, hypothesis-driven search through telemetry for undetected adversary activity, rather than waiting for automated alerts to fire.

Techniques an intruder uses to move from an initial foothold to other workloads or accounts, frequently abusing over-permissive roles and flat internal networks.

Unauthorized transfer of data out of an environment, often via cloud storage APIs, DNS tunneling, or legitimate SaaS services that blend with normal traffic.

A documented, rehearsed sequence of steps for a specific cloud incident type, specifying who does what, which evidence to capture, and when to isolate resources.

A preserved copy of a disk, memory, or log source captured before remediation, so investigation and potential legal proceedings retain trustworthy evidence.

Documented, unbroken record of who handled evidence, when, and how, required for findings to remain defensible in legal or disciplinary proceedings.

Translating regulatory or industry requirements, such as PCI DSS or ISO 27001, into concrete, testable cloud controls so audits can be evidenced from configuration data.

Controls that detect and block sensitive data leaving approved boundaries, including uploads to cloud storage and sharing through collaboration tools.

The top-level cloud account that governs billing and organization-wide policy. It should hold no workloads, because compromise there can override controls across all member accounts.