CrowdStrike CCSA key terms

A division of security duties between a cloud provider and its customer. The provider secures the physical infrastructure and managed services; the customer secures their data, identities, configurations, and workloads they control.

A classification of how much the provider manages. Infrastructure as a Service gives raw compute and storage; Platform as a Service adds runtimes and middleware; Software as a Service delivers a finished application. Each shifts the customer's responsibility boundary.

The management layer of a cloud platform: APIs, identity services, and console actions that create, configure, and delete resources. Compromise here can affect every workload in an account, so it is a high-value monitoring target.

Provider-native audit trails recording who called which management API, from where, and with what result. Examples include AWS CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs. They are primary evidence for detecting control-plane attacks.

The system of users, roles, policies, and permissions governing who can act on cloud resources. Excessively broad permissions are a leading cause of cloud breaches and a frequent finding in posture assessments.

Granting only the permissions needed for a task, for the shortest useful time. In cloud environments this means scoped roles, conditional access, and avoiding wildcard permissions in policies.

A chain of permissions or trust relationships that lets an identity gain more authority than intended, such as assuming a highly privileged role. Mapping these chains reveals risk that single-permission review misses.

A security tool that protects running compute instances, containers, and serverless functions through agents or API integration, covering vulnerability detection, runtime behavior monitoring, and threat response.

Continuous assessment of cloud configurations against benchmarks and policies to find misconfigurations, exposed resources, and compliance gaps. It answers what is wrongly configured rather than what is currently executing maliciously.

Analysis focused on cloud identities and their effective permissions, surfacing unused, excessive, or risky access rights. It complements posture management by concentrating on entitlement rather than resource configuration.

A resource setting that weakens security, such as a publicly readable storage bucket, an open management port, or disabled logging. Misconfigurations are the most common source of cloud data exposure.

A condition where object storage or a database snapshot is reachable by unauthenticated or overly broad audiences. Detecting it requires inventory of storage resources and evaluation of their access policies.

A continuously updated catalog of cloud resources across accounts and regions, including metadata such as type, owner, tags, and exposure. Accurate inventory is the foundation for assessment and prioritization.

The process of connecting a cloud subscription or project to a security platform using read-only roles or API credentials so it can be inventoried and assessed. Correct scoping prevents blind spots and permission errors.

Modeling how an adversary could chain weaknesses, such as an exposed instance plus an over-privileged role, to reach critical assets. It converts isolated findings into ranked, actionable risk.

Ordering findings by exploitability, exposure, asset criticality, and available threat intelligence rather than raw severity score alone, so remediation effort targets what attackers would actually use.

Comparing cloud configuration against published hardening standards, such as CIS Benchmarks, and reporting pass or fail per control. Results support audit evidence and guide configuration remediation.

The lightweight agent installed on hosts and container images that collects telemetry, enforces prevention policy, and enables response actions. Its deployment mode determines visibility depth in cloud workloads.

The administrative step of placing a cloud instance, container, or serverless function under management so it appears in the console with policy applied. Unregistered workloads remain unmonitored.

Detection and blocking of malicious behavior while a workload executes, using process, file, and network telemetry. It catches threats that pre-deployment scanning cannot, such as fileless or in-memory attacks.

Identifying adversary activity in cloud environments by correlating control-plane logs, workload telemetry, and identity behavior. Effective detection requires cloud-native context such as account, region, and role.

A behavioral pattern describing adversary intent, such as credential dumping or lateral movement, regardless of the specific tool used. IOAs are more durable than file hashes for detecting intrusions.

Artifact evidence that a system was already breached, such as a malicious hash, domain, or IP address. IOCs are easy to evade by modification, so they are usually paired with behavioral detection.

Enriching detections and investigations with external data about adversaries, infrastructure, and campaigns, so analysts can judge whether an alert matches known activity and respond faster.

Inspecting container image layers and installed packages for known vulnerabilities and embedded secrets before deployment, so flawed images are blocked at build or registry stage.

Monitoring running containers for anomalous behavior such as unexpected shell spawns, privilege changes, or crypto-mining, while accounting for short-lived and highly dynamic container lifecycles.

Compute that runs on demand without customer-managed servers, such as function services. It has no persistent host to install an agent on, so visibility depends on provider logs and integrations.

A recorded instance of a known weakness in a specific asset, including severity and remediation guidance. Context such as exposure and exploitability determines whether it should be fixed first.

A remote investigation and remediation capability that lets an analyst run commands, inspect files, and collect artifacts on a managed host without disrupting the user or rebuilding the system.

Isolating a compromised workload from the network while preserving analyst access for investigation. In cloud environments containment must respect auto-scaling, since replacement instances may recreate the threat.

The structured sequence of detection, triage, containment, eradication, recovery, and lessons learned applied to a security event, adapted for cloud identity and ephemeral resources.

Detection and response focused on cloud control-plane and identity activity rather than only endpoint behavior, addressing attacks such as role assumption abuse and resource hijacking.

A consolidated category combining posture management, workload protection, entitlement analysis, and image scanning into one platform so teams correlate findings across build, deploy, and runtime stages.

Continuous assessment of images stored in a container registry, re-evaluating them as new vulnerabilities are disclosed so already-published images do not silently become risky.

Geographic and isolated datacenter subdivisions of a cloud provider. They matter for data residency, resilience, and scoping investigations, because activity in an unexpected region is itself a detection signal.

Key-value labels attached to cloud resources that convey owner, environment, and application. Consistent tagging enables scoping, policy targeting, and accurate risk context during assessment and response.

Configuring which security policies apply to a workload group and whether violations are only logged or actively blocked. Choosing prevention too early can disrupt production, so staging matters.