Certificate of Cloud Security Knowledge (CCSK): key terms

Flashcards for this exam Certificate of Cloud Security Knowledge (CCSK) guide

• Bring Your Own Key (BYOK)Practice of generating encryption keys on premises (often in an HSM) and importing them into a cloud key management service.Advanced
• Broad Network AccessNIST cloud characteristic: capabilities are available over the network and accessed through standard mechanisms from diverse client devices.Foundational
• Cloud Access Security Broker (CASB)Security policy enforcement point between users and cloud services that provides visibility, compliance, data security and threat protection.Intermediate
• Cloud AuditorIndependent party that assesses cloud services for security controls, privacy impact, performance and compliance.Intermediate
• Cloud Controls Matrix (CCM)Cloud Security Alliance cybersecurity control framework for cloud computing, mapped to major standards and regulations.Intermediate
• Cloud Infrastructure Entitlement Management (CIEM)Discipline and tools that manage identities and permissions in cloud environments to enforce least privilege.Advanced
• Cloud MisconfigurationIncorrect or insecure setting of a cloud resource, such as public storage or overly permissive access, that creates security risk.Foundational
• Cloud PortabilityAbility to move applications and data between cloud providers or between cloud and on premises with minimal rework.Intermediate
• Cloud Security Posture Management (CSPM)Tools that continuously assess cloud configurations against best practices and compliance frameworks to detect and fix misconfigurations.Intermediate
• Cloud Service Broker (CSB)Intermediary that aggregates, integrates or customizes cloud services from multiple providers on behalf of customers.Intermediate
• Cloud Service Customer (CSC)Party that has a business relationship with a cloud provider to use its cloud services.Foundational
• Cloud Service Provider (CSP)Organization that offers cloud computing services such as IaaS, PaaS or SaaS to customers.Foundational
• Cloud Workload Protection Platform (CWPP)Security solution protecting workloads such as VMs, containers and serverless functions across hybrid and multicloud environments.Intermediate
• Cloud-Native Application Protection Platform (CNAPP)Unified platform combining CSPM, CWPP, CIEM and code-to-cloud security to protect cloud-native applications across their lifecycle.Advanced
• Community CloudDeployment model where infrastructure is shared by several organizations with common concerns such as mission or compliance.Foundational
• Confidential ComputingProtection of data in use by performing computation in hardware-based, attested trusted execution environments.Advanced
• Consensus Assessments Initiative Questionnaire (CAIQ)CSA questionnaire of yes/no questions based on the Cloud Controls Matrix for assessing cloud providers.Intermediate
• CSA STARCloud Security Alliance Security, Trust, Assurance and Risk program and public registry for cloud provider assurance.Intermediate
• Customer-Managed Key (CMK)Encryption key created and controlled by the customer in a cloud key management service, rather than by the provider.Intermediate
• Data Security Posture Management (DSPM)Tools that discover, classify and monitor sensitive data across cloud data stores and assess its exposure and access risk.Advanced
• Detective GuardrailGovernance control that identifies noncompliant resources after creation and reports or remediates them.Intermediate
• Federal Risk and Authorization Management Program (FedRAMP)U.S. government program that standardizes security assessment and authorization of cloud products used by federal agencies.Intermediate
• Instance Metadata Service (IMDS)Link-local endpoint (169.254.169.254) from which an EC2 instance reads its metadata, user data and role credentials.Advanced
• ISO/IEC 27017Code of practice for information security controls for cloud services, for both providers and customers.Intermediate
• Measured ServiceNIST cloud characteristic: resource usage is metered, monitored and reported, enabling pay-per-use billing and transparency.Foundational
• MultitenancyArchitecture where multiple customers (tenants) share the same physical infrastructure or application instance with logical isolation.Foundational
• NIST Definition of Cloud Computing (NIST SP 800-145)The NIST special publication that defines cloud computing via 5 essential characteristics, 3 service models and 4 deployment models.Foundational
• On-Demand Self-ServiceNIST cloud characteristic: consumers provision compute, storage or network resources automatically without human interaction with the provider.Foundational
• Preventive GuardrailGovernance control that blocks noncompliant actions before they happen, typically implemented with policies.Intermediate
• Rapid ElasticityNIST cloud characteristic: capabilities can be provisioned and released quickly, often automatically, to scale with demand.Foundational
• Resource PoolingNIST cloud characteristic: provider resources are pooled to serve multiple consumers in a multi-tenant model with location independence.Foundational
• Security as a Service (SECaaS)Delivery of security capabilities, such as email filtering, web gateways or SIEM, as cloud-hosted subscription services.Intermediate
• Shared Responsibility ModelFramework dividing security and operational duties between the cloud provider (of the cloud) and customer (in the cloud).Foundational
• Software-Defined Perimeter (SDP)Architecture that hides resources from the network and grants per-session access only after authentication.Advanced
• Tenant IsolationControls that keep one cloud customer's compute, network and data separate and inaccessible to other tenants.Advanced
• Vendor Lock-InDependence on a provider's proprietary services or formats that makes switching providers costly or difficult.Foundational