SCLE Module 17 key terms

A division of security duties between a cloud provider and its customer, where the provider secures the underlying infrastructure and the customer secures data, identities, and configurations they control.

A classification of cloud offerings by abstraction level, such as infrastructure, platform, or software as a service, which determines how much control and responsibility the customer retains.

The controls that keep one customer's workloads, data, and traffic separated from another's within shared cloud infrastructure, preventing cross-account access or data leakage.

An execution model where the provider manages servers and scales functions on demand, so the customer focuses on code while still owning identity, code, and data protection duties.

Managing cloud resources through machine-readable definition files stored in version control, enabling repeatable, reviewable, and auditable deployments instead of manual console changes.

The gradual divergence of deployed systems from their approved baseline, often caused by manual changes, which can silently weaken security controls and complicate audits.

A deployment pattern where servers or containers are replaced rather than modified in place, reducing drift and making rollback and forensic comparison more reliable.

The policies, processes, and technologies that ensure the right identities get appropriate access to resources and that access is reviewed, limited, and revoked when no longer needed.

Granting an identity or service only the permissions required for its current task, minimizing the blast radius if credentials are compromised or misused.

An authorization approach that assigns permissions to job roles rather than individuals, simplifying administration and making access reviews easier to perform consistently.

A trust arrangement that lets identities from one organization or provider authenticate to another using standards such as SAML or OpenID Connect, avoiding duplicate credentials.

An authentication design where one successful login grants access to multiple applications, reducing password sprawl but concentrating risk in the primary identity provider.

Requiring two or more independent evidence types, such as a password plus a hardware token, before granting access, which blocks many credential-theft attacks.

Authentication methods bound to a specific origin, such as passkeys or hardware security keys, that do not reveal reusable secrets to a deceptive lookalike site.

An attack that replays username and password pairs leaked from one breach against other services, exploiting password reuse across accounts.

Dividing a cloud network into isolated subnets and security zones with enforced traffic rules, limiting lateral movement after a compromise.

A stateful virtual firewall attached to cloud resources that permits or denies traffic based on rules, typically defaulting to deny inbound connections.

A reverse proxy that inspects HTTP traffic and blocks common injection and scripting attacks before requests reach an application, supplementing secure coding practices.

Protecting stored data with cryptography so that stolen disks, snapshots, or backups remain unreadable without the appropriate keys.

Protecting data moving between systems using protocols such as TLS, preventing interception or tampering on networks the organization does not fully control.

A managed service for creating, storing, rotating, and auditing cryptographic keys, keeping key material out of application code and configuration files.

The practice of storing API keys, passwords, and tokens in a controlled vault with access logging and rotation, rather than embedding them in code or repositories.

The requirement that certain data remain stored or processed within specified geographic boundaries, driven by law, contract, or organizational policy.

Assigning labels such as public, internal, confidential, or restricted to information so that handling, retention, and protection controls match its sensitivity.

Tools and rules that detect and block unauthorized movement of sensitive information, such as exfiltration to personal storage or unapproved external services.

An intermediary that enforces policy between users and cloud services, providing visibility, data protection, and threat detection for sanctioned and unsanctioned applications.

Cloud services adopted by employees without security or IT approval, creating unmanaged data stores and gaps in monitoring and compliance evidence.

A maintained record of cloud accounts, workloads, data stores, and owners, forming the foundation for scoping assessments, patching, and incident response.

An approved, documented set of settings for a system or service against which actual state is compared to detect weakening or unauthorized change.

A published set of consensus hardening recommendations for a platform or technology, used to derive and justify baseline configurations and audit checks.

Automated assessment of cloud resources against benchmarks, policies, or regulatory controls, producing findings that feed remediation and audit evidence.

Meeting legally binding requirements such as privacy, financial, or health data rules, evidenced through documented controls, assessments, and retained records.

Automated probing of systems and images to identify known weaknesses and missing patches, prioritized by exploitability and exposure for remediation.

Authorized simulated attacks that chain weaknesses to demonstrate real business impact, conducted under a defined scope and rules of engagement.

A written agreement defining targets, timing, excluded systems, escalation contacts, and permitted techniques for a security test, protecting both testers and the organization.

A coordinated process for reporting a discovered vulnerability to the affected owner with reasonable time to fix it before public details are shared.

A documented set of roles, phases, and communication paths guiding an organization from detection through containment, eradication, recovery, and lessons learned.

Preparing systems and processes so that evidence such as logs, memory, and disk images can be collected intact and admissible when an incident occurs.

A documented, unbroken record of who collected, handled, and stored evidence and when, supporting its integrity and reliability in investigations or legal proceedings.

A policy specifying how long audit and security logs are kept and protected from alteration, balancing investigation needs against cost and privacy obligations.

A platform that centralizes logs, correlates events across sources, and generates alerts, enabling detection that individual systems cannot achieve alone.

Adjusting detection rules and thresholds to reduce false positives while preserving coverage, keeping analyst attention focused on genuine threats.

The average elapsed time between the start of a security event and its identification, a key measure of monitoring effectiveness and response readiness.

The average time from detection to containment or resolution of an incident, reflecting process efficiency, automation, and team readiness.

A living record of identified risks with owners, likelihood, impact, treatment decisions, and status, used to track and communicate risk posture.

Choosing how to address an identified risk by mitigating, transferring, avoiding, or accepting it, with the decision documented and approved by an accountable owner.

The risk remaining after controls and treatments are applied, which an accountable owner must consciously accept against defined tolerance.

Splitting sensitive tasks among different people or roles so that no single identity can both commit and conceal a harmful action.

Protecting dependencies, build pipelines, and artifacts from tampering or malicious insertion through provenance checks, signing, and controlled build environments.

The ethical duty to accept only work within one's knowledge and skill, and to maintain currency through training, practice, and honest acknowledgment of limits.

A situation where personal, financial, or organizational interests could improperly influence professional judgment, requiring disclosure and often recusal from decisions.