CCSO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

Division of security duties between cloud provider and customer. The provider secures physical infrastructure and virtualization; the customer secures data, identity, configuration, and workload-level controls regardless of service model.

Control inheritance

Reuse of provider audit attestations, such as SOC 2 or ISO 27001 reports, to satisfy customer framework requirements. Inherited controls still need customer-side configuration evidence to be audit-valid.

Residual risk

Risk remaining after controls are applied. It is compared against the organization's stated risk appetite, and acceptance above appetite requires documented management sign-off.

Policy as code

Expressing security requirements as machine-evaluated rules enforced in pipelines and at deploy time. Preventive policies deny noncompliant resources; detective policies flag drift after provisioning.

Data sovereignty

Requirement that data remains subject to the laws and access rules of the jurisdiction where it is stored. It constrains region choice, replication targets, and support personnel access.

Trust boundary

Any point where the level of control or authentication changes, such as account-to-account, network-to-internet, or control-plane-to-data-plane. Every boundary needs explicit authentication and authorization.

Blast radius

Scope of impact if a component is compromised. Account isolation, network segmentation, and least privilege bound it; flat single-account architectures maximize it.

Control plane vs data plane

Management APIs versus workload traffic. Control-plane compromise usually yields full resource takeover, so it warrants stronger authentication, logging, and network restriction than data-plane access.

Landing zone

Pre-built, governed multi-account foundation providing identity, network segmentation, centralized logging, and guardrails. Workloads deploy into it so compliance is structural rather than retrofitted.

Federated identity

Authentication delegated to an external identity provider via SAML or OIDC. The cloud provider stores no passwords, and disabling the identity at the IdP revokes cloud access immediately.

STS temporary credentials

Short-lived tokens issued in exchange for an authenticated identity or role assumption. They expire automatically, reducing the exposure window compared with long-lived access keys.

Permissions boundary

A maximum-permissions ceiling attached to an identity. Effective permissions are the intersection of identity policies and the boundary, preventing privilege escalation even if a policy is overly broad.

Just-in-time privilege

Elevated access granted on request, with approval and time-bound expiry, instead of standing admin rights. Sessions are logged and recorded to support audit and separation of duties.

Break-glass account

Sealed emergency credential used when normal federation fails. It is monitored, alerts on use, tested periodically, and excluded from routine access paths.

Access recertification

Periodic owner attestation that each entitlement is still required. Unused roles and orphaned accounts are removed during review rather than deferred to a later cycle.

Envelope encryption

A data key encrypts the data, and a root key encrypts the data key. Rotating the root key does not require re-encrypting stored data, only rewrapping data keys.

Customer-managed key

Encryption key the customer creates and controls in the cloud key service. It enables independent audit of key use and revocation, which can render protected data unreadable.

Crypto-shredding

Destroying encryption keys so ciphertext becomes permanently unrecoverable. It satisfies deletion obligations only when key destruction is provable and all backups using that key are covered.

Tokenization

Replacing sensitive values, such as card numbers, with non-sensitive surrogate tokens that preserve referential integrity. It reduces compliance scope because the original data leaves the environment.

Stateful vs stateless firewall

Security groups are stateful and remember connections, so return traffic is allowed automatically. Network ACLs are stateless and evaluate each direction separately using numbered allow and deny rules.

Private endpoint

An interface or gateway that routes service traffic over the provider's private network instead of the public internet. It reduces exfiltration exposure and removes public attack surface.

Micro-segmentation

Identity-aware policy applied between individual workloads rather than at the network perimeter. It limits east-west lateral movement after an initial host compromise.

Default-deny egress

Outbound traffic blocked unless explicitly allowed by destination and port. It disrupts data exfiltration and command-and-control callbacks that rely on unrestricted outbound connections.

Admission control

A cluster gate that evaluates workloads before scheduling and rejects those violating policy, such as unsigned images or missing resource limits. It is preventive rather than detective.

Immutable image digest

A content hash identifying an exact container image version. Deploying by digest instead of a mutable tag prevents tag-mutation attacks and supports reproducible, verifiable provenance.

SBOM

A software bill of materials listing components and versions in an artifact. It enables rapid identification of affected workloads when a dependency vulnerability is disclosed.

Log immutability

Write-once retention, often via object lock, applied to centralized audit logs. It prevents a compromised workload or insider from deleting evidence of their own activity.

MTTD and MTTR

Mean time to detect and mean time to respond. They are the core operational security metrics, and gaps in log coverage directly increase detection time.

Incident containment

Limiting incident spread through credential revocation, key rotation, or network isolation. Evidence such as snapshots and logs must be preserved before remediation destroys it.

Alert fatigue

Analyst desensitization caused by high volumes of low-value alerts. It is measured by the actionable-alert ratio and mitigated by tuning thresholds and suppressing known-benign patterns.

Shift left

Moving security checks into design, code review, and build so defects are caught before deployment. It complements, rather than replaces, runtime detection and response.

Drift detection

Continuous comparison of running configuration against the declared infrastructure-as-code baseline. Detected differences trigger alerts or automated remediation and are logged with their trigger.