Certified Cloud Security Analyst key terms

A division of security duties between a cloud provider and its customer. The provider secures the physical infrastructure and managed service layers, while the customer secures data, identities, configurations, and whatever the service leaves under customer control.

The IaaS, PaaS, and SaaS categories that describe how much of the technology stack a provider manages versus how much the customer manages. The model chosen shifts the boundary of security responsibility.

The arrangements for hosting cloud services: public, private, community, and hybrid or multi-cloud. Each changes exposure, control, and the governance obligations the customer retains.

Using services from two or more cloud providers, often for resilience, cost, or avoiding lock-in. It multiplies identity, monitoring, and policy complexity because controls must work consistently across differing provider interfaces.

A widely used control framework that maps security objectives to specific cloud-relevant control requirements. Organizations use it to structure assessments, build questionnaires, and align provider attestations with their own control catalog.

A US government program that authorizes cloud services for federal use through standardized security assessments and continuous monitoring. Commercial customers often reference its authorization packages as evidence of a strong control environment.

An independent attestation covering a service organization's controls over security, availability, processing integrity, confidentiality, and privacy. Type I covers design at a point in time; Type II covers operating effectiveness over a period.

A contractual clause letting a customer examine a provider's controls, either directly or by reviewing independent reports. In cloud contracts it is usually narrowed to accepting third-party attestations plus periodic evidence.

Ranking third parties by the sensitivity of data they touch and the criticality of the service, then applying proportionate due diligence and review. High tiers receive deeper assessment, tighter contract terms, and more frequent reassessment.

Exposure created by the subcontractors and downstream providers that a cloud vendor relies on. The customer's data may reach parties it never contracted with, so the vendor agreement must address notice and flow-down obligations.

A contract governing how a provider handles personal data on the customer's behalf, including purpose limits, security measures, breach notification, subprocessor approval, and deletion on termination. It translates privacy obligations into enforceable vendor duties.

A requirement that data be stored and processed within specified geographic or legal boundaries. It affects region selection, replication design, backup placement, and which support staff may access the data.

The principle that data is subject to the laws and legal authority of the jurisdiction where it resides. It can conflict with provider operations, such as cross-border support access or government disclosure demands.

Linking requirements from different frameworks, regulations, and provider attestations to a single internal control set. Good mapping lets one implemented control satisfy multiple obligations and reduces duplicated audit effort.

Automated, ongoing evaluation of cloud resources against policy and regulatory requirements rather than point-in-time audits. It detects drift quickly but depends on accurate mappings and low false-positive rates to stay trusted.

A control point between users and cloud services that enforces policy on traffic and data. It can discover shadow cloud use, block unsanctioned services, apply data loss prevention, and inspect activity in SaaS environments.

A tool category that continuously scans cloud configurations for misconfigurations, excessive permissions, and policy violations across accounts and providers. It typically offers remediation guidance and integrates findings into operational workflows.

A published set of configuration checks for a specific cloud platform, such as the CIS Benchmarks. Benchmarks give a starting baseline, but organizations must still decide which checks apply to their workloads.

Static analysis of templates and modules that define cloud resources, performed before deployment. It catches insecure defaults, public exposure, and missing encryption early, when fixes are cheap and do not require production change control.

A practice where servers and components are replaced rather than modified in place. It reduces configuration drift and makes rollbacks predictable, but requires disciplined image pipelines and secure artifact storage.

Applying a documented minimum secure configuration to operating systems, services, and cloud resources before they enter use. Baselines usually derive from vendor guidance and benchmarks, then get tailored and enforced automatically.

Expressing security and compliance rules in machine-readable form so they can be versioned, tested, and enforced automatically in pipelines and at runtime. It makes policy consistent but requires governance over who may change the rules.

A model where the provider runs code on demand and manages servers, scaling, and patching. Customers still own code, dependencies, identity, and event-source permissions, which are frequent sources of unintended access.

Trusting an external identity provider to authenticate users so they can access cloud resources without separate credentials. It centralizes authentication and enables single sign-on, but trust configuration errors can widen access broadly.

An identity whose authentication is performed by one system and accepted by another under a trust relationship. It reduces credential sprawl but makes the identity provider a high-value target and a critical availability dependency.

A mechanism letting a user authenticate once and reach multiple applications. It improves usability and centralizes revocation, yet a compromised session can reach every connected application, so session controls matter.

Obtaining temporary credentials for a defined role instead of using long-lived keys. The role's trust policy and permission set bound what the holder can do, and the credentials expire automatically.

Granting only the permissions needed for a task, for only as long as needed. In cloud environments this means scoping identities, roles, and resource policies narrowly and reviewing accumulated permissions regularly.

A limit on the maximum permissions an identity or role can hold, even if broader policies are attached. It provides a safety net against overly permissive grants but does not itself grant any access.

Gaining access rights beyond those intended, often by chaining legitimate permissions such as creating a role or attaching a policy. Cloud escalation paths frequently hide in combinations of individually modest permissions.

Requiring two or more independent evidence types to authenticate, such as a password plus a hardware key. It is the strongest simple defense against credential theft and should be enforced for all administrative access.

Controls for issuing, monitoring, and revoking high-powered accounts and sessions. In cloud settings it includes just-in-time elevation, approval workflows, session recording, and rapid credential rotation after suspected compromise.

An emergency identity kept for use when normal access paths fail. It should be tightly controlled, monitored, tested periodically, and stored so that routine use is impossible and every use is investigated.

Controls that detect and block unauthorized movement of sensitive data across endpoints, networks, and cloud services. Effective programs classify data first, then tune rules to reduce noise and avoid blocking legitimate work.

Assigning sensitivity labels to data so handling rules, access decisions, and retention periods can follow automatically. Classification is the prerequisite for meaningful encryption, loss prevention, and residency controls.

Protecting stored data so it is unreadable without the correct key. In cloud environments the key's location, ownership, and rotation determine how much control the customer actually retains.

A managed service for creating, storing, rotating, and auditing cryptographic keys. Its access policies are security-critical because anyone who can use a key can typically decrypt the data it protects.

Encryption keys the customer creates and controls rather than the provider. They enable revocation and separation of duties, but losing access to the key can make protected data permanently unrecoverable.

A tamper-resistant device that stores keys and performs cryptographic operations without exposing key material. Cloud providers offer managed and dedicated variants with differing levels of customer control and certification.

A virtual firewall rule set attached to cloud network interfaces that permits or denies traffic by protocol, port, and source. Rules are usually stateful and default-deny, so overly broad entries are a common finding.

Dividing a cloud network into isolated zones so a compromise in one area cannot freely reach another. It relies on subnets, routing, firewalls, and private endpoints rather than on perimeter defenses alone.

A private network address that connects to a provider service without traversing the public internet. It reduces exposure but requires careful DNS design so clients resolve to the private path rather than the public one.

A design principle that grants no implicit trust based on network location and verifies every request using identity, device state, and context. It replaces perimeter assumptions with continuous authorization and least privilege.

Cloud services and applications adopted without security or IT approval. It creates unmanaged data stores and unmonitored access paths, so discovery, acceptable-use policy, and safe alternatives are the main countermeasures.

A maintained record of cloud accounts, resources, data stores, and owners. You cannot protect or monitor what you have not catalogued, making inventory a prerequisite for posture management and incident response.

Collecting logs from many cloud sources into a central, protected repository for correlation and retention. Centralization enables detection and investigation while making the log store itself a target that needs strict access control.

Combining and analyzing events from multiple sources to surface patterns that individual records would not reveal. Effective correlation depends on accurate time synchronization, normalized fields, and tuned detection logic.

Assurance that log records are complete, unaltered, and time-accurate. Techniques include write-once storage, hash chaining, separate logging accounts, and synchronized clocks, which matter greatly when logs become evidence.

A documented sequence for detecting, containing, eradicating, recovering from, and learning from security incidents. Cloud plans must account for provider coordination, API-driven containment, and evidence collection across accounts.

A preserved copy of a disk, memory, or configuration captured for investigation before remediation alters it. In cloud environments it requires coordination with the provider and attention to data residency and chain of custody.

Stealing an authenticated session token to act as the victim without knowing their password. Cloud defenses include short token lifetimes, binding sessions to context, conditional access, and revoking tokens on suspicion.

A register describing what personal data is processed, why, where, by whom, and for how long. It supports privacy compliance and is a practical tool for scoping vendor reviews and data residency decisions.