IBM Cloud Security Engineer key terms

A division of security duties between a cloud provider and its customer. IBM manages the physical infrastructure, hypervisor, and managed service internals, while customers secure their data, identities, configurations, and workloads.

Automated tooling that continuously inspects cloud configurations against security benchmarks and flags risky settings such as public buckets, overly permissive rules, or disabled encryption.

A published control framework defining security and compliance requirements for regulated workloads on IBM Cloud, organized into control families mapped to industry standards and used to evidence compliance.

An IBM Cloud service that collects configuration and activity evidence, evaluates resources against profiles and controls, and produces compliance posture views and audit-ready reports.

A stated security or compliance outcome that a control is designed to achieve, such as restricting privileged access. Objectives are satisfied by one or more implemented controls and supporting evidence.

The process of gathering configuration scans, activity logs, and attestations that demonstrate a control is operating. Collected evidence is evaluated and retained to support audits and continuous compliance monitoring.

A logical container that groups IBM Cloud resources for access control and organization. IAM policies and service-to-service authorization are scoped to resource groups, making them fundamental to segregation of duties.

The structure of an IBM Cloud account, its resource groups, and optionally enterprise-managed child accounts. It determines where policies attach and how billing and governance roll up.

A rule granting a subject a role on a resource, resource group, or account. Policies are additive; access comes from the union of all applicable policies, and no policy means no access.

A named set of permitted actions on a resource, such as Viewer, Editor, Operator, Administrator, or service-defined roles. Roles are assigned to subjects through policies and determine what actions are allowed.

A non-human identity used by applications and automation to authenticate to IBM Cloud APIs. It has its own API keys and receives access only through IAM policies assigned to it.

A credential associated with a user or service ID that is exchanged for a short-lived IAM access token. Keys should be rotated, scoped narrowly, and never embedded in source code.

A time-limited bearer credential issued by IBM Cloud IAM after authenticating an API key or user. It is presented on API calls and expires quickly to limit the impact of theft.

A non-human identity that obtains credentials by trusting a compute resource, such as a virtual server or Kubernetes workload, instead of storing long-lived secrets. This reduces credential sprawl and leakage risk.

The principle of granting only the permissions needed to perform a task, for only as long as needed. It limits blast radius when credentials are misused or compromised.

Authentication that trusts an external identity provider, such as IBM Verify or a corporate SAML or OIDC provider, so users sign in once and receive IBM Cloud access without separate local accounts.

Requiring two or more independent verification factors during sign-in. IBM Cloud account owners can enforce it for account members to reduce risk from stolen passwords.

IAM rules that allow access only when the request originates from approved network zones or satisfies specified resource attributes. They add a condition layer on top of role-based policies.

A grant that lets one IBM Cloud service act on another on a user's behalf, such as a service reading from a bucket. It is defined by source, target, and role without sharing user credentials.

A scheme where a data key encrypts the data and a root key managed by a key management service encrypts the data key. The root key never leaves the service, simplifying rotation and access control.

A long-lived key held inside a key management service that protects wrapped data keys. Access to it is policy-controlled, and its versions can be rotated without re-encrypting stored data.

A service that generates, stores, and controls cryptographic keys and performs wrap and unwrap operations. Keys stay inside a hardware security module boundary, and every use is logged.

A tamper-resistant device that stores keys and performs cryptographic operations inside a protected boundary. IBM Cloud key services use HSMs so key material is never exposed in plaintext to operators.

Periodically replacing or adding key versions so that older material is retired. Rotation limits the volume of data protected by any single key version and supports incident recovery.

A model where the customer supplies or imports key material into a cloud key service, retaining control over creation and rotation while the provider performs cryptographic operations.

A stronger control model where key material is generated and held in a customer-controlled HSM, so the provider cannot use the key without the customer's authorization. It supports cryptographic shredding.

Assigning sensitivity labels such as public, internal, confidential, or restricted to data so that storage, encryption, and access controls match the value and regulatory exposure of the information.

Protecting stored data by encrypting it on disk or object storage so that physical media theft or unauthorized backend access does not reveal plaintext. It is typically enabled by default and can use customer-managed keys.

Protecting data while it moves between clients and services using protocols such as TLS. It prevents eavesdropping and tampering on networks and should enforce modern protocol versions and strong ciphers.

A software-defined network in IBM Cloud where you define subnets, address ranges, routing, and security controls. Workloads in a VPC communicate privately and can reach services over private endpoints.

A stateful virtual firewall attached to network interfaces in a VPC. It permits or denies traffic by direction, protocol, and port, and return traffic for allowed flows is automatically permitted.

A stateless subnet-level filter in a VPC that evaluates rules in order for inbound and outbound traffic. Because it is stateless, both directions of a flow must be explicitly allowed.

A private IP address in a VPC that connects to an IBM Cloud service or another endpoint over the provider backbone, avoiding exposure to the public internet and reducing data exfiltration risk.

A named collection of allowed network addresses and services used by context-based restrictions. Requests from outside the zone are denied even when the caller holds a valid role.

The point where an encrypted connection is decrypted, such as a load balancer or gateway. Choosing where termination occurs determines which segments are encrypted and where certificates are managed.

Issuing, deploying, tracking, and renewing TLS certificates so encrypted endpoints stay valid. Expired or weak certificates cause outages and downgrade protection, so lifecycle automation is essential.

An IBM Cloud service that records account-level API activity, such as logins, policy changes, and resource deletions, as structured events. Events can be routed to SIEM tools for analysis and retention.

A chronological record of security-relevant actions and system events used to reconstruct who did what and when. Logs must be protected from tampering and retained per regulatory requirements.

Forwarding security events and logs into a security information and event management platform that correlates them, triggers alerts, and supports investigation across many sources.

The policy defining how long log data is kept and where. Retention must satisfy legal, regulatory, and investigative needs while controlling cost and limiting exposure of sensitive content.

A documented set of roles, detection, containment, eradication, recovery, and communication steps activated when a security event occurs. It is tested through exercises and updated after each incident.

The disciplined collection and preservation of evidence, such as logs, disk images, and memory captures, after an incident so that root cause can be determined and findings withstand legal scrutiny.

A structured evaluation of threats, vulnerabilities, and business impact that estimates likelihood and severity, then prioritizes treatment through mitigation, transfer, acceptance, or avoidance.

A design-time exercise that identifies assets, entry points, threat actors, and abuse cases, then defines controls to reduce risk before systems are built or changed.

Layering independent controls, such as identity, network, encryption, and monitoring, so that failure or bypass of one layer does not expose the whole system.

The requirement that data be stored and processed in specified geographic locations. It influences region selection, backup placement, and which services may lawfully handle a workload.