CrowdStrike CCSA cheat sheet

Shared responsibility boundary: the provider secures the physical facility, hypervisor, and managed-service substrate; the customer secures identity, configuration, data, and workload internals.

AWS account is the primary isolation and billing boundary; Organizations/Control Tower apply SCPs across member accounts; VPC is a regional network boundary with subnets per Availability Zone.

Azure hierarchy: Tenant > Management group > Subscription > Resource group > Resource. Azure Policy and RBAC inherit downward through this tree.

GCP hierarchy: Organization > Folder > Project > Resource. IAM policies inherit down the resource tree; VPC networks are global while subnets are regional.

IaaS vs PaaS vs SaaS shifts the control line: on IaaS the customer patches the OS; on PaaS the provider patches the runtime; on SaaS the customer controls only data and access.

Ephemeral and immutable infrastructure means workload identity is short-lived; an instance ID or IP address is not a durable asset key, whereas a resource ARN/ID is.

Cloud-native control plane audit sources: AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs; data-plane and OS telemetry require separate collection.

Multi-account/multi-project sprawl is the normal state: architecture decisions must assume hundreds of accounts, overlapping CIDRs, and cross-account role assumption.

CSPM finds misconfiguration against benchmarks (CIS, provider security standards); CIEM governs entitlement and unused permissions; CWPP protects running workloads; DSPM locates sensitive data.

Least privilege is evaluated on effective permissions: identity policy plus resource policy plus permission boundary plus SCP, with explicit deny always winning.

Public exposure decision rule: storage bucket public + sensitive data = critical; public + non-sensitive static content may be acceptable per policy, not automatically a finding of the same severity.

Identity is the dominant attack surface in cloud: long-lived access keys, over-privileged roles, and trust policies with wildcard principals outrank network-layer risk in most cloud incidents.

Defense in depth in cloud layers: identity, network (security groups, NACLs, firewall), workload runtime, data encryption (at rest and in transit), and logging/monitoring.

Compliance frameworks (SOC 2, PCI DSS, ISO 27001) map to controls, not to individual findings; a single finding maps to one or more controls.

Encryption key custody matters: provider-managed keys reduce operational burden; customer-managed keys (KMS/Key Vault/Cloud KMS) add revocation and separation-of-duties control.

Detection coverage gap rule: control-plane logs alone cannot detect in-instance behavior; runtime sensor or OS audit telemetry is required for process-level detection.

Agentless assessment snapshots cloud APIs and disk images on a schedule; it gives posture and vulnerability context but no runtime blocking.

Falcon sensor-based visibility gives continuous runtime telemetry (process, network, file) and is required for prevention and real-time detection.

Registration of cloud accounts uses read-only roles/service principals; the onboarding scope determines which accounts, regions, and resource types are assessed.

Asset inventory normalizes resources across providers into a single model so the same misconfiguration rule can apply to AWS, Azure, and GCP resources.

IaC scanning evaluates templates before deployment; it catches misconfiguration earlier than CSPM but does not reflect drift in deployed resources.

Prioritization inputs typically combine severity, internet exposure, sensitive-data presence, and exploitability (for example known-exploited vulnerability status).

Triage rule: a finding on an unused or decommissioned resource is still a hygiene item but ranks below an identical finding on an internet-facing production asset.

Detection of drift requires repeated assessment; a single scan is a point-in-time state and cannot prove a control remained enforced.

Containment order for a compromised cloud instance: isolate network (security group/quarantine policy), preserve memory/disk evidence, then revoke credentials - snapshot before termination.

Cloud incident scope questions: which identity was used, which API calls were made (CloudTrail/Activity Log), which resources were touched, and whether persistence (new keys, roles, Lambdas) was created.

Never terminate an instance as the first response step; termination destroys volatile memory and the runtime evidence needed for root cause.

Credential revocation in cloud is broader than password reset: rotate access keys, revoke session tokens, remove added role trust entries, and check for new IAM users or service principals.

Real-time response actions typically include network containment, process kill, file quarantine, and memory dump, executed via the sensor on the host.

Detection-to-response loop needs identity context: correlating a process event with the IAM principal that launched the instance distinguishes benign admin action from attacker activity.

Log retention is an incident-response control: short retention windows in CloudTrail/Activity Log/flow logs directly limit the achievable investigation timeline.

Post-incident hardening closes the initial access vector (for example public key, exposed metadata service, over-privileged role) before restoring the workload to service.