PECB Lead Cloud Sec flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

Division of security duties between cloud provider and customer. The provider secures the underlying infrastructure; the customer secures data, identities, and configuration within its scope.

Cloud service customer

Role in ISO/IEC 17789 that uses cloud services. It includes sub-roles such as cloud service user, administrator, business manager, and integrator, each with distinct duties.

Measured service

Essential cloud characteristic where resource usage is monitored, controlled, and reported, providing transparency for both provider and consumer of the utilized service.

Hybrid cloud

Deployment model combining two or more distinct cloud infrastructures bound by standardized or proprietary technology that enables data and application portability between them.

Resource pooling

Provider aggregates computing resources to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand.

Cloud security policy

Top-management-approved document defining approved cloud service models, data classification constraints, procurement rules, provider obligations, and prohibited cloud usage within the organization.

Documented information control

ISO/IEC 27001 clause 7.5 requirement to control creation, approval, distribution, access, retrieval, retention, and disposal of information and its supporting medium.

Acceptable use policy

Cloud-specific rule set stating which data classifications may be placed in which service models, who may procure services, and which behaviours constitute shadow IT.

Policy hierarchy

Layered structure of overarching information security policy, cloud security policy, topic-specific policies such as access control and cryptography, and supporting procedures and work instructions.

Record retention

Controlled preservation of evidence such as risk assessments, supplier due diligence, audit logs, and management review minutes for legal, contractual, and certification periods.

Risk treatment options

Four choices under ISO/IEC 27005: modify risk with controls, retain and accept residual risk, avoid the activity, or share risk through contracts or insurance.

Supplier risk assessment

Evaluation of provider controls, certification scope, carve-outs, sub-processor chain, and audit evidence to determine residual risk transferred to the customer.

Concentration risk

Risk arising from dependency on a single provider, region, or service, where failure or exit causes disproportionate impact; mitigated by multi-region design and exit plans.

Risk owner

Named accountable person with authority to accept residual risk within defined criteria; the security team supports assessment but does not own business risk.

Cloud risk register

Record of cloud-related risks capturing service model, data classification, provider, jurisdiction, existing controls, treatment plan, owner, and review date.

ISO/IEC 27017

International standard extending ISO/IEC 27002 with cloud-specific controls and guidance, assigning each control to cloud service provider, cloud service customer, or both.

ISO/IEC 27018

International standard for public cloud providers acting as processors, defining controls for protecting personally identifiable information, including consent, sub-processor disclosure, and deletion.

Tenant separation control

ISO/IEC 27017 clause 13.1.3 requirement to separate virtual computing environments, administrative operations, and virtual networks between different cloud service customers.

Provider evidence access

ISO/IEC 27017 clause 9.5.1 guidance that customers assess provider controls while providers supply audit reports, certifications, and assurance evidence.

Customer-managed keys

Encryption approach where the customer generates and controls cryptographic keys held in a separate key management service, reducing provider access to plaintext data.

Sub-processor disclosure

ISO/IEC 27018 obligation to inform customers before engaging sub-processors that handle personal data, giving the customer opportunity to object or terminate.

Awareness versus training

Awareness builds security attitude in all staff; training builds specific skills for roles such as administrators, developers, and procurement; education builds deeper professional competence.

Competence records

ISO/IEC 27001 clause 7.2 evidence that required competence was determined, achieved through training or experience, and evaluated for effectiveness.

Shadow IT

Unsanctioned cloud services procured outside approved channels, creating unmanaged data exposure, missing contractual protections, and invisible risk in the register.

Cloud administrator training

Role-based curriculum covering identity federation, key management, logging, backup, cost controls, and secure configuration of provider consoles and APIs.

Awareness effectiveness metrics

Measures such as phishing simulation click rates, misconfiguration trends, incident reports, and assessment scores used to evaluate whether awareness activities change behaviour.

ISO/IEC 27035 phases

Incident management framework covering preparation, detection and reporting, assessment and decision, response, and learning from lessons identified.

Provider breach notification

Contractual obligation requiring the provider to inform the customer within a defined period so the customer can meet its own regulatory reporting deadlines.

Cloud containment actions

Immediate response steps including revoking credentials and tokens, isolating instances with security groups, snapshotting volumes, and disabling compromised accounts.

Chain of custody

Documented, unbroken record of evidence handling; in cloud it requires agreed log retention, export capability, and integrity hashing before provider logs rotate.

Control plane audit logs

Records of management API activity showing who created, modified, or deleted cloud resources; a primary detection source for misconfiguration and account compromise.

Configuration drift

Divergence of deployed cloud resources from approved hardening baselines, detected by continuous compliance scanning against benchmarks such as CIS.

Corrective action clause

ISO/IEC 27001 clause 10.2 requirement to react to nonconformity, evaluate root cause, implement action, review effectiveness, and retain documented evidence.