CCSO key terms

A framework dividing security duties between a cloud provider and its customer. The provider secures the physical infrastructure and managed services; the customer secures data, identities, configurations, and whatever the service leaves in their control.

The dividing lines among IaaS, PaaS, and SaaS that determine how much security work the provider absorbs. Higher abstraction shifts more patching and platform hardening to the provider, but never transfers accountability for data and access.

Every setting a tenant can change in a cloud service, such as network rules, encryption options, public access flags, and logging toggles. Misconfiguration in this surface is a leading cause of cloud breaches.

The policies, roles, and decision processes that direct how cloud is adopted and operated. It defines who approves accounts, sets standards, funds controls, and accepts residual risk across the organization.

The practice of linking implemented safeguards to the requirements they satisfy, such as regulatory clauses or framework controls. Good mapping enables reuse of evidence and shows coverage gaps across multiple compliance obligations.

Collecting a single artifact, such as a configuration export or log sample, and citing it against several frameworks at once. It reduces audit fatigue and keeps evidence consistent across overlapping regulatory regimes.

A living record of identified risks with owners, likelihood, impact, and treatment decisions. In cloud programs it tracks items like unmanaged accounts, exposed storage, and concentration on a single provider.

A formal decision by an accountable owner to tolerate a residual risk without further mitigation. It must be documented with rationale and expiry so it does not silently become permanent exposure.

A time-bound process for approving deviations from security standards, with compensating controls and a remediation date. It prevents policy bypasses from becoming invisible permanent exceptions.

A documented minimum configuration standard applied to accounts, workloads, and services. It typically covers identity defaults, logging, encryption, network exposure, and patching, and serves as the reference for automated checks.

Expressing security and governance rules in machine-readable form so they can be versioned, tested, and enforced automatically. It enables preventive guardrails and repeatable audits across many accounts.

Automated constraints that prevent or flag noncompliant cloud actions, such as blocking public storage or requiring tags. Preventive guardrails deny the action; detective guardrails report it after the fact.

An organization-level policy that sets the maximum permissions available to member accounts, regardless of what individual identities are granted. It is a coarse but powerful lever for enforcing boundaries.

A policy that caps the effective permissions of an identity without granting anything itself. The effective permission is the intersection of the identity policy and the boundary, useful for delegating safely.

Granting only the permissions needed for a task, for only as long as needed. In cloud it requires continuous review because permissions accumulate through role chaining and copied policies.

Obtaining temporary credentials for a role rather than using long-lived keys. The trust policy decides who may assume it, and session conditions can restrict time, source network, or required authentication strength.

A flaw where a trusted service is tricked into acting on a resource on behalf of an unintended party. Unique external identifiers and strict trust conditions on role assumption mitigate it.

Trusting an external identity provider so users authenticate there and receive cloud credentials through assertions. It removes local passwords and centralizes joiner, mover, and leaver control.

The configuration that lets a cloud platform accept authentication assertions from a specific external IdP. Weak trust settings, such as missing audience or condition checks, can allow token misuse.

A mechanism letting one authenticated session reach many applications. In cloud it simplifies access but concentrates risk, since compromise of the primary identity can unlock every connected platform.

Authentication factors bound to the legitimate service origin, such as hardware security keys or passkeys, that defeat real-time relay attacks. Numeric codes and push approvals are weaker against adversary-in-the-middle phishing.

Controls that safeguard high-impact accounts and roles through vaulting, session recording, approval workflows, and short-lived credentials. The goal is to make powerful access rare, monitored, and attributable.

Granting elevated permission only when requested and approved, then revoking it automatically after a set window. It shrinks standing privilege and the blast radius of a stolen credential.

A tightly controlled emergency identity used when normal access paths fail. It should be heavily monitored, excluded from routine workflows, and tested periodically so it works when needed.

A chain of permissions or trust relationships that lets an identity gain more access than intended, such as editing a role it can assume. Mapping these paths is core to cloud attack-path analysis.

Granting identities in one account or tenant rights to resources in another, usually through role trust. It enables separation of duties but widens trust boundaries if relationships are poorly documented.

Assigning sensitivity labels to data so protection matches value and regulatory weight. Classification drives encryption, retention, access, and monitoring decisions consistently across cloud stores.

The requirement that data remain within specified geographic or jurisdictional boundaries. It affects region selection, replication, backup placement, and which support personnel may access systems.

A managed service that creates, stores, rotates, and audits cryptographic keys, often backed by hardware security modules. Applications call it to encrypt or sign without handling raw key material.

Encrypting data with a data key and then encrypting that data key with a longer-lived master key. It limits how much ciphertext one key protects and makes re-wrapping keys cheap.

A key the tenant creates and controls in the provider's key service, rather than one the provider manages. It gives the tenant authority to rotate, disable, or revoke access, affecting data availability.

Importing key material generated outside the cloud provider into its key service. It supports external custody requirements but adds responsibility for backup, rotation, and availability of that material.

Periodically replacing cryptographic keys to limit the impact of undetected compromise. Automated rotation with versioned keys keeps old ciphertext decryptable while new data uses fresh material.

Replacing sensitive values with meaningless tokens mapped in a protected vault. It reduces the scope of systems that must meet strict data protection rules while preserving referential usability.

Encrypting specific sensitive attributes rather than an entire store, so searchable or non-sensitive fields remain usable. It narrows exposure but complicates querying and key access design.

A logically isolated network within a cloud region where subnets, routes, and gateways are defined. Its design determines segmentation, egress paths, and which resources can reach the internet.

Dividing a cloud network into zones with controlled traffic between them, limiting lateral movement after compromise. Segmentation relies on subnets, routing rules, firewalls, and workload identity-aware policies.

A stateful, instance-level firewall rule set controlling allowed inbound and outbound traffic. Because it is attached to resources, it must be reviewed for overly broad rules and default open settings.

Applying fine-grained, often identity-based traffic policy between individual workloads rather than broad network zones. It contains lateral movement but demands accurate workload labeling and policy lifecycle management.

A private network address that connects to a managed service without traversing the public internet. It reduces exposure and supports data exfiltration controls when paired with strict egress policy.

Controlling outbound traffic to prevent data exfiltration and command-and-control callbacks. In cloud it combines route tables, firewall appliances, DNS policy, and allowlists for approved destinations.

A credential issued to a running workload, such as a pod or function, so it can authenticate to services without stored secrets. It ties access to the workload's attested identity rather than to a shared key.

Analyzing image layers for known vulnerabilities, embedded secrets, and policy violations before deployment. Scanning should occur at build, on registry push, and continuously for images already running.

A cluster mechanism that evaluates workloads before they run and can reject noncompliant ones. It enforces rules like signed images, no privileged containers, and required resource limits.

Protecting the path from source code to deployed artifact through provenance, signing, and dependency controls. It addresses tampering, malicious packages, and unverified build steps that bypass review.

Cryptographically signing build outputs so consumers can verify origin and integrity. Signature verification at admission prevents unsigned or tampered images from reaching production.

Static analysis of templates and modules to find insecure settings before deployment. Catching public buckets or open security groups in code review is cheaper than remediating live infrastructure.

Storing and distributing credentials through a dedicated vault with access control, rotation, and audit. It eliminates hardcoded secrets in code, images, and configuration files.

A provider record of control-plane actions showing who did what, when, and from where. These logs are foundational for detection, forensics, and proving compliance, and must be protected from tampering.

Capturing activity inside a service, such as object reads or database queries, rather than only management actions. It is essential for detecting exfiltration but is often disabled by default due to volume and cost.

Protecting log stores so records cannot be altered or deleted during their retention period. Techniques include write-once storage, separate accounts, and restricted deletion permissions for responders.

Logic that turns raw telemetry into alerts for suspicious behavior, such as impossible travel or mass key deletion. Rules need tuning, ownership, and periodic validation against known attack techniques.

A predefined sequence of steps for a specific cloud scenario, such as leaked credentials or exposed storage. It assigns roles, lists containment actions, and accounts for provider notification and evidence preservation.

A preserved copy of a disk, memory, or configuration captured before remediation destroys evidence. Chain-of-custody documentation and account-level isolation keep the copy trustworthy and admissible.

A tool category that continuously assesses cloud accounts against benchmarks and flags misconfigurations, drift, and exposed resources. It prioritizes findings by reachability and data sensitivity.

Divergence between the deployed state of a resource and its approved baseline or code definition. Drift reintroduces fixed weaknesses, so detection and reconciliation must be automated.

Automated, ongoing evaluation of controls against live evidence instead of point-in-time audits. It shortens the window between a violation and its discovery and keeps reports current.

A geographic area containing isolated data centers where cloud services are offered. Region choice affects latency, service availability, legal jurisdiction, and disaster recovery design.

An isolated location within a region with independent power and networking. Distributing workloads across zones supports resilience, though it also multiplies the resources needing consistent controls.