Definitions and pro-tips for the CCSP certification.
An API Gateway is a management tool that sits between a client and a collection of backend services, acting as a single entry point for API requests. It handles critical functions such as request routing, protocol translation, rate limiting, authentication, and monitoring to ensure secure and scalable API consumption.
Attribute-Based Access Control (ABAC) is an authorization model that grants access rights based on a combination of attributes. These attributes can include user characteristics, resource properties, and environmental conditions, providing more granular control than traditional role-based systems.
Block storage is a data storage architecture that breaks data into evenly sized blocks, each with its own unique address. It is primarily used for high-performance applications like databases and virtual machine disks because it allows for low-latency access and efficient modification of specific data chunks.
Bring Your Own Key (BYOK) is a cloud security model where the customer generates and manages their own cryptographic keys rather than relying on keys generated by the cloud service provider. This provides the customer with greater control over data access and key rotation.
Business Continuity Planning (BCP) is the process of creating systems of prevention and recovery to ensure that essential business functions continue during and after a disaster. In the cloud, BCP focuses on redundancy, failover mechanisms, and geographical distribution to maintain high availability.
Cloud Bursting is a configuration where an application runs in a private cloud or data center and 'bursts' into a public cloud when demand for computing capacity spikes. This allows organizations to handle peak loads without investing in permanent on-premises hardware.
The Cloud Controls Matrix (CCM) is a cybersecurity control framework developed by the Cloud Security Alliance (CSA). It provides a detailed set of security controls mapped to various industry standards, helping organizations assess cloud provider security and ensure regulatory compliance across different cloud service models.
Cloud Governance is a set of rules, policies, and controls that an organization implements to manage the use of cloud services. It ensures that cloud adoption aligns with business goals, regulatory requirements, and security standards.
Cloud Interoperability is the ability of two or more cloud services or providers to exchange and use information seamlessly. It ensures that different cloud platforms can work together to provide a unified service without requiring manual data translation.
Cloud Orchestration is the automated arrangement, coordination, and management of complex computer systems, middleware, and services. It coordinates multiple automated tasks into a single cohesive workflow to deploy and manage cloud resources efficiently and consistently.
The Cloud Security Alliance (CSA) is a non-profit organization dedicated to defining and raising the awareness of best practices to help ensure a secure cloud computing environment. They are the creators of the Cloud Controls Matrix (CCM) and the STAR registry.
Cloud Service Broker (CSB) is an intermediary entity that helps organizations select, manage, and integrate services from multiple cloud providers. A broker adds value by providing a single point of contact for service aggregation, arbitrage, and management across a multi-cloud strategy.
A Cloud Service Customer (CSC) is an organization or individual that consumes cloud services provided by a CSP. Depending on the service model (IaaS, PaaS, SaaS), the CSC is responsible for various security layers, primarily the security in the cloud.
A Cloud Service Level Agreement (SLA) is a formal contract between a cloud service provider and a customer that defines the expected level of service. It typically includes metrics for availability, performance, and the remedies provided if these standards are not met.
A Cloud Service Provider (CSP) is a third-party company that offers a cloud-based platform, infrastructure, application, or storage services to customers. They are responsible for the security of the cloud, including the physical hardware and the virtualization layer.
Cloud Virtualization is the process of creating a virtual version of a physical resource, such as a server, storage device, or network, using a hypervisor. This allows multiple virtual machines (VMs) to run on a single physical host, maximizing resource utilization.
Cloud-Native Security refers to security practices specifically designed for modern cloud architectures, such as microservices, containers, and serverless functions. It emphasizes automation, continuous integration/continuous deployment (CI/CD) integration, and a 'shift-left' approach to security.
Confidential Computing is a cloud computing technology that protects data in use by performing computation in a hardware-based Trusted Execution Environment (TEE). This ensures that data is encrypted in memory, protecting it from the cloud provider's privileged administrators and other malicious actors.
Control Plane is the part of the network architecture that determines where traffic is sent and how the network is configured. In cloud environments, it manages the orchestration of virtual resources and directs the flow of data across the infrastructure.
The Data Custodian is the role responsible for the technical implementation of the security controls defined by the Data Owner. This includes performing backups, managing encryption, and ensuring the integrity and availability of the data on a daily basis.
Data Escrow is a legal arrangement where a third party holds a copy of critical data or software source code to be released to the customer if the provider goes bankrupt. It mitigates the risk of vendor lock-in and ensures business continuity.
The Data Life Cycle is a conceptual framework describing the stages data passes through from creation to destruction. It typically includes six phases: create, store, use, share, archive, and destroy, each requiring specific security controls to protect data integrity and confidentiality.
Data Loss Prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. In the cloud, DLP monitors data patterns to prevent the accidental or intentional exfiltration of sensitive information.
Data Masking is a security technique that obscures specific data elements within a dataset to protect sensitive information while maintaining the data's functional utility. It replaces real data with realistic but fake values, ensuring that developers or testers can work with production-like data without exposing PII.
The Data Owner is the individual or entity ultimately responsible for the classification, protection, and lifecycle management of a specific data set. They define the access requirements and determine who is authorized to access the information based on business needs.
Data Portability is the ability to move data from one cloud service provider to another without significant friction or loss of data integrity. It is a critical requirement for avoiding vendor lock-in and ensuring business continuity.
Data Residency refers to the physical or geographic location where an organization's data is stored. While often driven by business requirements or performance needs, it is closely linked to regulatory compliance and data sovereignty laws.
Data Sanitization is the process of deliberately, permanently, and irreversibly removing or destroying data stored on a memory device. In the cloud, this is challenging because the physical media is managed by the provider and shared among customers.
Data Sovereignty is the concept that digital data is subject to the laws and governance of the country in which it is physically located. This requires organizations to ensure that their cloud storage locations comply with the legal requirements of the host nation.
Data Tokenization is the process of replacing sensitive data elements with non-sensitive equivalents, called tokens, which have no extrinsic or exploitable meaning. The original data is stored securely in a central vault, and only authorized systems can detokenize it.
Disaster Recovery as a Service (DRaaS) is a cloud computing service model that allows an organization to back up its data and IT infrastructure in a third-party cloud environment. It provides a cost-effective way to ensure business continuity by automating failover and recovery processes.
Discretionary Access Control (DAC) is an access control method where the owner of a resource determines who is granted access to that resource. This flexibility allows owners to pass permissions to other users, though it is generally considered less secure than MAC or RBAC.
Due Care is the ongoing act of implementing the necessary security controls and practices to protect assets and maintain a reasonable standard of care. While due diligence is the research phase, due care is the actual execution and maintenance of the agreed-upon security measures.
Due Diligence is the process of investigating and verifying a cloud service provider's security claims, financial stability, and operational capabilities before entering into a contract. It involves reviewing audit reports, certifications, and SLAs to ensure the provider meets the organization's risk appetite.
Encryption at rest is the process of protecting data that is physically stored on a disk or storage medium. By encrypting data while it is stationary, organizations protect sensitive information from unauthorized access in the event of physical theft or unauthorized access to the storage hardware.
Encryption in transit is the process of protecting data as it moves across a network between two points. It utilizes protocols like TLS (Transport Layer Security) to ensure that data cannot be intercepted or read by unauthorized parties while traveling between a client and a cloud service.
Encryption in use refers to the protection of data while it is being processed in memory (RAM) or the CPU. This is typically achieved through confidential computing or Trusted Execution Environments (TEEs), ensuring that sensitive data remains encrypted even during active computation and processing.
File storage is a data storage method that organizes data in a hierarchical structure of files and folders. It is commonly used for shared network folders and NAS (Network Attached Storage) systems, providing an intuitive way for users to organize and access documents across a network.
Function as a Service (FaaS) is a category of cloud computing services that allows customers to execute discrete blocks of code in response to specific events. It is the primary implementation of serverless computing, enabling highly scalable, event-driven architectures without managing servers.
General Data Protection Regulation (GDPR) is a comprehensive data privacy law in the European Union that regulates how the personal data of EU citizens is collected, processed, and stored. It grants individuals significant control over their data and imposes strict penalties for non-compliance.
Hardware Security Module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. In the cloud, HSMs are often offered as a service to ensure that keys are stored in a tamper-resistant environment.
Homomorphic Encryption is an advanced form of encryption that allows computations to be performed on ciphertext without first decrypting it. The result of the computation remains encrypted and, when decrypted, matches the result of operations performed on the plaintext data.
Hybrid Cloud is a computing environment that combines a private cloud, on-premises infrastructure, and a public cloud into a single, flexible infrastructure. This allows data and applications to be shared between them to provide greater flexibility and deployment options.
Hypervisor is a layer of software that creates and runs virtual machines by isolating the operating system and applications from the underlying physical hardware. It manages the distribution of physical resources like CPU, memory, and storage among the VMs.
Identity and Access Management (IAM) is a framework of policies and technologies ensuring that the right people and systems have appropriate access to technology resources. It encompasses authentication, authorization, and auditing to manage digital identities and control access to cloud-based applications and data.
Identity Federation is a system that allows a user's single identity to be recognized across multiple distinct security domains or organizations. It enables seamless access to cloud services by establishing a trust relationship between the identity provider and the relying party.
Infrastructure as Code (IaC) is the process of managing and provisioning computer data centers through machine-readable definition files, rather than physical hardware configuration or interactive tools. This allows for consistent, repeatable, and version-controlled infrastructure deployments.
ISO/IEC 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a risk-based approach to managing sensitive company information through a set of controls.
ISO/IEC 27017 is an international standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It extends the ISO/IEC 27002 controls to specifically address cloud-specific risks.
ISO/IEC 27018 is an international code of practice for protecting personally identifiable information (PII) in public clouds. It provides specific guidance for cloud service providers to ensure the privacy and protection of customer data.
Key Management Service (KMS) is a centralized cloud service used to create, manage, rotate, and delete cryptographic keys. It allows organizations to control the lifecycle of their encryption keys, ensuring that only authorized users and services can decrypt sensitive data stored in the cloud.
Management Plane is the administrative layer of a cloud environment used to configure, monitor, and manage cloud resources. It typically consists of the web console, Command Line Interface (CLI), and Application Programming Interfaces (APIs) provided by the cloud service provider.
Mandatory Access Control (MAC) is a strict access control system where access rights are regulated by a central authority based on multiple levels of security. Users are granted access to objects based on their clearance level and the object's classification label, preventing data leakage.
Measured Service refers to the cloud characteristic where resource usage is monitored, controlled, and reported for transparency. This 'pay-as-you-go' model allows providers to charge customers based on the actual amount of storage, processing power, or bandwidth consumed.
Microsegmentation is a security technique that divides a cloud network into small, isolated segments to limit lateral movement by attackers. By applying granular security policies to individual workloads, organizations can implement a Zero Trust architecture within their virtualized environment.
Multi-tenancy is a software architecture where a single instance of a software application serves multiple customers, known as tenants. Each tenant's data is isolated and invisible to other tenants, allowing the cloud provider to optimize resource utilization while maintaining logical separation of user data.
A Network Access Control List (NACL) is an optional layer of security for a VPC that acts as a firewall for controlling traffic in and out of one or more subnets. Unlike security groups, NACLs are stateless and operate at the subnet level.
OAuth 2.0 is an industry-standard authorization framework that allows a third-party application to obtain limited access to an HTTP service. It uses access tokens to delegate authority without requiring the user to share their credentials with the third-party application.
Object Storage is a data storage architecture that manages data as objects, which include the data itself, variable amounts of metadata, and a unique identifier. Unlike file or block storage, it is highly scalable and ideal for unstructured data in cloud environments.
OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol. It allows clients to verify the identity of the end-user based on the authentication performed by an Authorization Server, as well as to obtain basic profile information.
Platform as a Service (PaaS) is a cloud model that provides a framework for developers to build, test, and deploy applications without managing the underlying infrastructure. The provider manages the hardware, virtualization, and operating system, leaving the customer to manage the application and data.
The Principle of Least Privilege (PoLP) is a security concept where users and systems are granted only the minimum levels of access—or permissions—needed to perform their job functions. This minimizes the attack surface and limits potential damage from breaches.
A Privacy Impact Assessment (PIA) is a systematic process used to identify and evaluate the potential effects that a project or system may have on individual privacy. In cloud environments, it helps organizations ensure that data processing activities comply with privacy regulations like GDPR.
Private cloud is a cloud computing model where the infrastructure is dedicated solely to a single organization. It provides enhanced security, privacy, and control, making it ideal for organizations with strict regulatory requirements or highly sensitive data that cannot be shared in a multi-tenant environment.
Public cloud is a cloud deployment model where services are delivered over the public internet and shared across multiple organizations. It offers high scalability and cost-efficiency through a pay-as-you-go model, though it typically provides less control over the underlying infrastructure compared to private cloud environments.
Rapid Elasticity is the ability of a cloud environment to quickly scale computing resources upward or downward to meet fluctuating demand. This allows organizations to handle spikes in traffic automatically without manual intervention, ensuring consistent performance and cost-efficiency.
Recovery Point Objective (RPO) is the maximum acceptable amount of data loss measured in time. It determines the necessary frequency of backups, as the RPO defines the point in time to which data must be recovered to resume normal operations.
Recovery Time Objective (RTO) is the maximum tolerable duration of time within which a business process must be restored after a disaster. It defines the target time for getting systems back online to avoid unacceptable consequences associated with a break in business continuity.
Resource Pooling is the process of grouping physical and virtual resources to serve multiple consumers using a multi-tenant model. The provider dynamically assigns and reassigns these resources according to demand, often without the customer knowing the exact physical location of the hardware.
A Responsibility Assignment Matrix (RACI) is a project management tool used to clarify roles and responsibilities for tasks and deliverables. In cloud security, it identifies who is Responsible, Accountable, Consulted, and Informed for specific security controls, preventing gaps in the shared responsibility model.
Role-Based Access Control (RBAC) is a method of restricting network access based on the roles of individual users within an enterprise. It assigns permissions to specific roles rather than individual users, simplifying administration and ensuring the principle of least privilege is maintained across cloud environments.
Root of Trust (RoT) is a source that is always trusted within a computer system, typically implemented in hardware. It serves as the foundational building block for secure boot processes and cryptographic operations, ensuring that the system starts in a known-good and untampered state.
Secure Software Development Lifecycle (S-SDLC) is a framework that integrates security activities into every phase of the software development process, from requirements gathering to maintenance. This proactive approach ensures that security is baked into the application rather than added as an afterthought.
Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider. It is primarily used to enable Single Sign-On (SSO) across different security domains.
A Security Group is a virtual firewall that controls inbound and outbound traffic for a specific instance or group of instances in a cloud environment. It operates at the instance level, providing a layer of security that is typically stateful.
Security Groups act as virtual firewalls for cloud instances to control inbound and outbound traffic. Unlike network ACLs, which are stateless and operate at the subnet level, security groups are typically stateful and operate at the individual instance or network interface level.
Security Information and Event Management (SIEM) is a security solution that provides real-time analysis of security alerts generated by applications and network hardware. It aggregates log data from multiple sources to identify patterns, detect threats, and support compliance reporting.
Security Orchestration, Automation, and Response (SOAR) is a stack of software that allows an organization to collect data about security threats and respond to low-level security events without human assistance. It focuses on automating the 'playbook' for incident response.
Serverless Computing, often implemented as Function-as-a-Service (FaaS), is a cloud execution model where the provider automatically manages the infrastructure. Developers only write code functions that trigger based on specific events, paying only for the actual execution time.
SOC 2 Type II is an audit report that evaluates a service organization's controls over a period of time based on Trust Services Criteria. Unlike Type I, which assesses design at a point in time, Type II verifies that controls are operating effectively over several months.
A SOC 2 Type II Report is an independent auditor's assessment of a service organization's controls over a period of time based on Trust Services Criteria. Unlike Type I, which assesses design at a point in time, Type II evaluates the operational effectiveness of those controls over several months.
Software Defined Networking (SDN) is a network architecture approach that decouples the network control plane from the forwarding plane. This allows network administrators to manage network services through abstraction, enabling centralized programmatic control and increased flexibility in configuring virtual network topologies within cloud environments.
The Software Development Life Cycle (SDLC) is a structured process used by organizations to design, develop, and test high-quality software. It consists of several phases, including requirement analysis, design, implementation, testing, deployment, and maintenance, ensuring a systematic approach to software creation.
Static Application Security Testing (SAST) is a white-box security testing methodology that analyzes application source code, binaries, or byte code without executing the program. It identifies vulnerabilities early in the software development life cycle (SDLC) by scanning for common coding errors and security flaws.
Tokenization is the process of replacing sensitive data with a non-sensitive equivalent, known as a token, that has no extrinsic or exploitable meaning. The original data is stored securely in a separate vault, and the token is used for business processes.
A Trust Anchor is an authoritative entity for which trust is assumed and not derived from any prior trust anchor. In cloud PKI and encryption, it typically refers to the root certificate authority (CA) that serves as the starting point for validating a certificate chain.
Vendor Lock-in occurs when a customer becomes dependent on a single cloud provider's proprietary technologies, making it difficult or costly to migrate to another provider. This is often caused by incompatible APIs, unique data formats, or proprietary services.
Virtual Desktop Infrastructure (VDI) is a technology that hosts a desktop operating system on a centralized server in a data center. Users access their virtual desktops remotely, allowing for centralized management, improved security, and consistency across various end-user devices.
Virtual Machine (VM) Escape is a security vulnerability where an attacker breaks out of a guest virtual machine to access the underlying hypervisor or host operating system. This is a critical risk in cloud environments as it could allow an attacker to access other tenants' VMs.
Virtual Private Cloud (VPC) is a logically isolated section of a public cloud provider's network where users can launch resources in a virtual network they define. It allows for custom IP address ranges, subnets, and network gateways.
VM Escape is a critical security vulnerability where an attacker breaks out of a virtual machine's isolation to interact directly with the hypervisor or the host operating system. This allows the attacker to potentially access other virtual machines running on the same physical host.
Zero Trust Architecture (ZTA) is a security framework based on the principle of 'never trust, always verify.' It requires strict identity verification for every person and device attempting to access resources on a private network, regardless of whether they are sitting inside or outside the network perimeter.
We're adding new exams every week. Let us know what you're studying for, and we'll bump it up our priority list! (Typical turnaround: 2-3 days)
Your feedback has been submitted successfully. We appreciate your help in making Cert Sensei better!