Certified Cloud Security Professional (CCSP)

A server-side encryption option where the cloud provider's Key Management Service (KMS) generates and manages the encryption keys, while allowing the customer to control key usage and revocation policies.

• Cloud provider generates and manages keys.
• Customer retains policy control over key usage and revocation.
• Often integrated with other cloud services.

A data destruction method that renders encrypted data permanently unrecoverable by destroying or revoking access to the encryption keys. The underlying encrypted data may persist, but it becomes unintelligible and unusable without the key.

• Key destruction/revocation.
• Encrypted data becomes unrecoverable.
• Ideal for virtualized and cloud environments.

A feature in cloud object storage that prevents objects from being deleted or overwritten for a fixed amount of time or indefinitely, ensuring data immutability.

• Provides Write-Once-Read-Many (WORM) capability.
• Protects against accidental or malicious deletion/modification.
• Can be configured with retention periods or legal holds.

HSM as a Service is a cloud offering that provides dedicated, FIPS 140-2 certified hardware for cryptographic key generation, storage, and operations, ensuring a high level of security and regulatory compliance for key management.

• Provides dedicated, tamper-resistant hardware.
• Often FIPS 140-2 Level 3 certified.
• Keys are generated and stored within the HSM, never leaving it.

The automated process of analyzing container images for known vulnerabilities, misconfigurations, and policy violations, typically integrated into CI/CD pipelines.

• Identifies security risks before containers are deployed.
• Leverages vulnerability databases (CVEs).
• Helps enforce security policies and compliance standards.

The process of identifying, locating, and mapping sensitive data across an organization's IT environment, including structured and unstructured data stores, to understand its prevalence and ensure proper protection.

• Identifies sensitive data locations.
• Works across structured and unstructured data.
• Crucial first step for data protection initiatives.

A cloud service feature that records API calls and administrative actions for all resources, providing an immutable audit trail for security and compliance.

• Records all management plane activities.
• Logs are typically immutable and time-stamped.
• Essential for compliance, forensics, and security monitoring.

A disaster recovery strategy where an application is fully deployed and active in multiple, geographically separate cloud regions, processing requests concurrently.

• Provides highest availability and lowest RTO/RPO.
• Routes traffic automatically to active regions upon failure.
• More complex and expensive to implement.

A security policy enforcement point placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as cloud-based resources are accessed. CASBs provide visibility, compliance, data security, and threat protection.

• Intermediary between users and cloud services.
• Provides visibility, compliance, data security, threat protection.
• Enforces policies in real-time across multiple cloud services.

A cloud infrastructure shared by several organizations with shared concerns (e.g., mission, security requirements, policy, and compliance considerations).

• Shared by specific, related organizations.
• Addresses common regulatory or security needs.
• Can be managed internally or by a third party.

A cloud deployment model where the cloud infrastructure is provisioned for exclusive use by a single organization.

• Offers exclusive control over infrastructure
• Can be managed internally or by a third party
• Typically used for sensitive data and high compliance needs

The practice of encrypting data when it is stored on a physical storage device, such as a hard drive, solid-state drive, or cloud storage bucket.

• Protects data from unauthorized access even if the storage medium is compromised.
• Can be managed by the customer (client-side) or the cloud provider (server-side).
• Crucial for data confidentiality and compliance requirements.

The process of organizing data into categories based on its sensitivity, value, and regulatory requirements, which then informs the application of appropriate security controls and policies.

• Categorizes data based on sensitivity and value.
• Informs security controls (encryption, access).
• Drives retention and disposal policies.

The property that enables a system to continue operating properly in the event of the failure of some of its components.

• Achieved through redundancy and automatic failover mechanisms.
• Crucial for high availability and business continuity.
• Often involves deploying across multiple availability zones or regions.

A security vulnerability or exploit that allows an attacker to break out of a guest virtual machine and gain unauthorized access to the host operating system (hypervisor) or other virtual machines running on the same host.

• Considered a highly severe threat in virtualized environments.
• Can compromise the isolation between virtual machines.
• Requires robust hypervisor security and patching.

The process of continuously copying data from one location to another, maintaining an up-to-date duplicate, primarily for disaster recovery, high availability, and load balancing.

• Continuous data copying.
• Aims for low RPO (Recovery Point Objective).
• Supports disaster recovery and business continuity.

Cloud-native virtual firewall services that control inbound and outbound network traffic for virtual machines or subnets based on rules.

• Filter traffic based on IP, port, protocol.
• Act as a virtual firewall.
• Configurable at VM or subnet level.

A characteristic of cloud computing where resource usage is monitored, controlled, and reported, providing transparency for both the provider and consumer.

• Enables 'pay-as-you-go' or 'pay-per-use' billing models.
• Allows consumers to track and optimize their resource consumption.
• Often includes metrics like compute time, data transfer, and storage used.

The process of capturing and analyzing the volatile memory (RAM) of a virtual machine in a cloud environment to investigate security incidents and potential compromises.

• Captures runtime state, processes, network connections, and hidden data.
• Essential for detecting advanced persistent threats (APTs) and malware.
• Requires specific cloud provider capabilities or third-party tools.

Cryptographic hashing is a mathematical algorithm that maps data of arbitrary size to a fixed-size bit array (hash value or message digest). It is primarily used for ensuring data integrity, as any alteration to the input data will produce a different hash value.

• Generates a fixed-size output (hash value).
• One-way function (computationally infeasible to reverse).
• Collision resistant (hard to find two inputs with same hash).

A cloud security technology that protects data in use by performing computation in a hardware-based Trusted Execution Environment (TEE), shielding it from unauthorized access even from the cloud provider.

• Protects data during processing (in use).
• Utilizes hardware-based Trusted Execution Environments (TEEs).
• Shields data from hypervisor, OS, and cloud administrator access.

A technique that replaces sensitive data with fictitious but realistic data, preserving the data's format and referential integrity, primarily used for non-production environments like development, testing, and training.

• Replaces real data with fake, but realistic, data.
• Preserves data format and referential integrity.
• Used in non-production environments (dev, test, training).

A cloud service model where the provider delivers a computing platform and solution stack, allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure.

• Provider manages OS, middleware, runtime.
• Customer manages applications and data.
• Focus on application development and deployment.

Ensuring that one tenant's data resides on distinct physical hardware resources, preventing any sharing of underlying physical storage with other tenants.

• Achieved through dedicated hardware (disks, servers).
• Provides strongest form of isolation.
• More expensive and less common in multi-tenant cloud.