Concept Maps

AI in Cloud Architecture

The design considerations for safely incorporating AI and machine-learning services into a cloud security architecture, covering where AI workloads sit in the network, how their data is protected, and how their access and logging fit existing controls.

Architecture Decision Records

Short documents that capture a significant design decision, the options considered, the choice made, and the reasoning behind it. In cloud security architecture they preserve why controls were designed a certain way.

AWS CloudTrail Investigation

Using AWS CloudTrail logs, which record API calls and account activity, to investigate a cloud incident: who did what, from where, and when. It is the primary evidence source for AWS control-plane actions.

AWS GuardDuty

An AWS threat-detection service that analyzes account, network, and DNS activity to flag suspicious behavior, such as compromised credentials, cryptomining, or reconnaissance, without needing agents on workloads.

AWS Landing Zone Frameworks

Prescriptive blueprints, such as AWS Control Tower and the multi-account framework, for setting up a secure, scalable AWS foundation with baked-in account structure, guardrails, logging, and identity from the start.

AWS Network Architecture

The design of networking in AWS, VPCs, subnets, route tables, gateways, security groups, and connectivity, arranged to segment workloads, control traffic, and limit exposure as part of a secure cloud foundation.

Azure Incident Investigation

Investigating a security incident in Microsoft Azure using its logs and signals, such as Entra ID sign-in logs, activity logs, and Microsoft Defender alerts, to determine what an attacker did and how far they reached.

Azure Landing Zone

Microsoft's prescriptive blueprint for a secure, scalable Azure foundation, defining management group hierarchy, subscriptions, policies, identity, networking, and logging so workloads land in a governed environment by default.

Azure Network Architecture

The design of networking in Azure, virtual networks, subnets, network security groups, peering, gateways, and firewalls, arranged to segment workloads, control traffic, and limit exposure within a secure cloud foundation.

Azure VM Forensics

Collecting and analyzing forensic evidence from an Azure virtual machine during an incident, such as disk snapshots and memory, in a way that preserves integrity so the VM's activity can be examined without altering evidence.

Cloud Forensic Collection

Gathering evidence from a cloud environment during an incident in a sound, repeatable way, such as snapshotting disks, capturing memory, and exporting logs, while preserving integrity and chain of custody.

Cloud IR Automation

Using automated playbooks and scripts to speed up cloud incident response, such as automatically isolating a workload, revoking credentials, or collecting evidence the moment a detection fires, reducing the time an attacker has to act.

Cloud IR Evidence Sources

The places a cloud responder gathers evidence during an incident, control-plane and audit logs, identity sign-in logs, network flow logs, disk snapshots, memory captures, and provider detection findings. Knowing them is essential to investigate effectively.

Cloud IR Fundamentals

The core principles of responding to cloud incidents: how cloud differs from on-premises IR, the importance of identity and logging, the shared-responsibility constraints, and the basic phases adapted to cloud. It is the foundation for all cloud IR work.

Cloud IR Playbook Design

Creating the step-by-step response procedures for specific cloud incident types, like compromised credentials, exposed storage, or cryptomining, so responders act quickly and consistently using the right cloud-native steps.

Cloud IR Timeline Management

Building and maintaining an accurate chronological record of a cloud incident, ordering events from logs across identity, control plane, and workloads so responders understand what happened, in what sequence, and how far the attacker reached.

Cloud Landing Zone

A pre-built, secure cloud foundation, account structure, identity, networking, logging, and guardrails, established before workloads are deployed, so every workload lands in a governed environment with security baked in by default.

Cloud Log Preservation

Ensuring cloud logs needed for an investigation are captured, retained, and protected from deletion or tampering, including before an incident, since many cloud logs are off by default or expire quickly and cannot be recovered once gone.

Cloud Logging Architecture

The design of how logs are collected, routed, centralized, retained, and protected across a cloud environment, so security teams have complete, trustworthy telemetry for detection, investigation, and compliance.

Cloud Network Topologies

The common architectural patterns for arranging cloud networks, such as hub-and-spoke, flat, and segmented multi-account designs, each shaping how traffic flows, how workloads are isolated, and how easily an attacker can move.

Cloud Security Tool Architecture

How an organization's cloud security tools, posture management, workload protection, detection, identity analytics, fit together into a coherent whole, with data flowing between them rather than operating as disconnected point solutions.

Cloud Security Tooling Categories

The main classes of cloud security tools, such as posture management (CSPM), workload protection (CWPP), network security, identity analytics, and consolidated platforms (CNAPP), each addressing a different aspect of cloud risk.

Compromised IAM Credentials Playbook

A cloud incident-response playbook for when cloud access keys or identity credentials are stolen, covering how to confirm the compromise, scope what the attacker did, revoke and rotate credentials, and recover, using cloud-native tools.

Container Image Scanning

Within DevSecOps, scanning container images in the pipeline for known vulnerabilities, exposed secrets, and insecure configurations before they are deployed, so security issues are caught and fixed early in the software lifecycle.

Container Security Model

Within DevSecOps, the conceptual model for how container security is layered, image, build, registry, runtime, and orchestration, that guides where to place controls in a secure software delivery pipeline.

Continuous Architecture Review

Treating security architecture review as an ongoing practice rather than a one-time event, periodically re-examining a cloud design as it evolves so new services, changes, and drift do not silently undermine its security.

Cryptomining Incident Response

The response to a cryptomining (cryptojacking) incident in the cloud, confirming the unauthorized mining, scoping how the attacker got in, containing and removing the mining workloads, and closing the entry point, often using a predefined playbook.

DAST in DevSecOps

Dynamic Application Security Testing integrated into the DevSecOps pipeline, automatically testing a running application for vulnerabilities by probing it from the outside, like an attacker would, to find flaws that only appear at runtime.

72-Hour Notification

A 72-hour notification is a regulatory deadline that requires an organization to report certain security or privacy incidents within 72 hours of becoming aware of them.

Architecture Finding Communication

Conveying the results of a security architecture review so stakeholders understand each design weakness, why it matters, and what to change, adjusting depth and framing for technical teams versus leadership.

Architecture Findings

The weaknesses identified during a security architecture review, such as missing trust boundaries, weak authentication between components, or single points of failure, that stem from how a system is designed rather than from a single bug.

Architecture Review Methodology

The defined process for reviewing a system's security architecture from start to finish: setting scope, gathering design information, applying threat modeling, identifying findings, and communicating recommendations.

Architecture Review Scope

The boundaries of a security architecture review: which systems, components, data flows, and concerns are in or out, set at the start so the review stays focused and its findings are meaningful.

Audit Engagement Management

Running an external audit engagement well from the company's side: selecting the firm, scoping the work, coordinating evidence and timelines, and managing distribution of the resulting report, so the audit is efficient and the outcome is usable.

Audit Report Distribution

Controlling who receives an audit report and how, since reports often contain sensitive findings and may be shared with customers, regulators, or partners under specific conditions. Distribution must balance transparency with confidentiality.

Authentication Architecture Review

Assessing how a system proves who users are, examining the design of login flows, multi-factor authentication, session handling, token issuance, and federation, to find design weaknesses before they are exploited.

Authorization Architecture Review

Assessing how a system decides what an authenticated user is allowed to do, examining the design of its access model (such as RBAC or ABAC), enforcement points, and default-deny posture, to find gaps that allow excess access.

Building Framework Mapping

When building a compliance program, mapping the organization's controls to one or more frameworks (like SOC 2, ISO 27001, or NIST) so a single control can satisfy multiple requirements and gaps become visible.

Calibrated Estimation

A skill for making numerical risk estimates whose stated confidence matches reality, so that when an estimator says they are 90% confident, they are right about 90% of the time. It produces honest, useful ranges instead of false precision or vague guesses.

Cloud Architecture Security Review

A security architecture review focused on a cloud environment, examining how accounts, identity, networking, data protection, and services are designed to find systemic weaknesses such as over-broad access, flat networks, or unprotected data.

Cloud Reference Architectures

Vetted, reusable blueprints for securely designing common cloud scenarios, such as a secure landing zone, a three-tier app, or a data platform, that an architecture reviewer compares a real design against to spot gaps.

Compliance and B2B Sales

The role compliance plays in winning business-to-business deals, where customers require proof of security, such as a SOC 2 report or ISO 27001 certificate, before buying. Compliance becomes a sales enabler, not just a risk function.

Compliance Automation Tooling

The category of products used to run a compliance program efficiently, GRC and compliance-automation platforms that map controls to frameworks, gather evidence, track tasks, and produce audit-ready output. This entry focuses on the tooling itself within building a program.

Compliance Framework Mapping

Within building a compliance program, the work of mapping the organization's controls to the requirements of each framework it must meet, so overlaps are reused and gaps are exposed, enabling a 'comply once, satisfy many' approach.

Compliance Program Scope

Defining what a compliance program covers, which frameworks, systems, data, and business units are in or out, set when building the program so effort is focused on what actually matters and audits have clear boundaries.

Compliance Program Structure

How a compliance program is organized when built, its scope, framework mappings, control set, evidence processes, tooling, team, and audit cadence, assembled into a coherent program rather than scattered, ad-hoc efforts.

Compliance Team Structure

How the people responsible for compliance are organized, roles, reporting lines, and the split between dedicated compliance staff and control owners across the business, so accountability is clear and the workload is sustainable.

Compliance Tool Selection

The process of evaluating and choosing compliance and GRC tooling when building a program, weighing framework coverage, evidence automation, integrations, usability, and cost against the organization's actual needs.

Cross-Border Data Transfer Requirements

The specific legal mechanisms and obligations, under privacy laws like the GDPR, that must be satisfied to lawfully move personal data across borders, such as adequacy decisions, standard contractual clauses, and supplementary safeguards.

Customer Trust Center

A dedicated, often public-facing page or portal where an organization shares its security and compliance posture, certifications, audit reports, and policies, so prospects and customers can verify trust without lengthy back-and-forth.

Data Mapping at Scale

Performing data mapping across large, complex organizations with many systems and data flows, using automation, discovery tooling, and governance to keep the map accurate when manual methods alone cannot keep up.

Data Mapping Foundation

The basic concept and purpose of data mapping in privacy practice: documenting what personal data an organization holds, where it comes from, where it flows, and where it is stored, as the groundwork for all privacy compliance.

Evidence Repository

A central, organized store where compliance evidence is kept, control proof, logs, policies, and records, so it is preserved, version-tracked, and easy to retrieve for audits and ongoing compliance.

Authentication Testing

Systematically evaluating an application's login and identity mechanisms during a security assessment to find weaknesses, such as weak session handling, missing MFA enforcement, or flaws in password and reset flows.

Authorization Testing Methodology

A structured approach to testing whether an application correctly enforces what users are allowed to do, checking for broken access control such as accessing other users' data or reaching admin functions without rights.

AWS IAM Assessment Priority

Treating identity and access management as the first and highest-priority area when assessing AWS security, because IAM misconfigurations, like over-permissioned roles or exposed keys, are the most common path to full account compromise.

Azure Assessment Scope

Defining what is included when assessing the security of an Azure environment, the subscriptions, resource groups, identities, and services to examine, so the assessment is focused and its coverage is clear.

Azure Resource Assessment

Examining the security configuration of individual Azure resources, such as virtual machines, databases, storage, and networking, to find misconfigurations like excessive exposure, missing encryption, or weak access settings.

Azure Storage Assessment

Evaluating the security of Azure storage accounts and blobs, checking for public exposure, weak access controls, missing encryption, and overly permissive shared keys or SAS tokens that could leak data.

Burp Suite Workflow

The practical way a web application tester uses Burp Suite, an intercepting proxy and testing toolkit, to capture, inspect, modify, and replay HTTP traffic during an authorized assessment.

Business Logic Testing Methodology

A testing approach that targets flaws in an application's intended workflow and rules, rather than technical bugs, such as skipping a payment step, abusing discount logic, or bypassing an intended sequence. These flaws evade automated scanners.

Cloud Assessment Findings

The documented weaknesses a cloud security assessment uncovers, such as over-permissioned identities, publicly exposed storage, missing encryption, or absent logging, each with its risk and a recommended fix. They are the actionable output of the assessment.

Cloud Assessment Methodology

A structured, repeatable process for assessing the security of a cloud environment: scoping it, prioritizing identity, examining resources, networks, data, and logging, validating findings, and reporting. It keeps cloud assessments thorough and consistent.

Cloud Assessment Scope

The defined boundaries of a cloud security assessment, which accounts, subscriptions, services, and regions are included, and what is out of scope. It is set first so the assessment is focused and its coverage and limits are clear.

Cloud Assessment Tools

The software used to assess cloud security, including provider-native posture tools and open-source scanners (such as those that analyze IAM policies or scan for misconfigurations). They automate discovery of exposure, excessive permissions, and configuration weaknesses.

Cloud Database Assessment

Evaluating the security of managed and self-hosted cloud databases, checking for public exposure, weak authentication, missing encryption, excessive privileges, and inadequate logging, since databases often hold an organization's most sensitive data.

Cloud Findings Communication

Conveying the results of a cloud security assessment so stakeholders understand each issue, its real risk, and how to fix it, adjusting depth and framing for engineers, cloud owners, and leadership.

Cloud Storage Assessment

Evaluating the security of cloud object and file storage, checking for public exposure, weak access controls, missing encryption, and risky sharing settings, since misconfigured storage is a leading cause of cloud data breaches.

Cloudsplaining Analysis

Using Cloudsplaining, an open-source tool, to analyze AWS IAM policies for risky permissions, surfacing identities that can escalate privileges, access data broadly, or modify resources, so assessors can focus on the most dangerous access.

Compute Security Assessment

Evaluating the security of cloud compute resources, virtual machines, instances, and the services running on them, checking for public exposure, missing patches, weak access, and insecure configurations during a cloud assessment.

Container Cluster Assessment

Evaluating the security of a container orchestration cluster (such as Kubernetes) during a cloud assessment, checking API server exposure, RBAC, network policies, pod security, and admission controls for weaknesses.

CSPM Integration

Incorporating cloud security posture management findings into a cloud assessment, using CSPM tooling to enumerate misconfigurations at scale and feeding its results into the assessment's prioritized findings.

Access Certification Campaign Design

Access certification campaign design is the process of deciding what access will be reviewed, who will approve it, how exceptions are handled, and how results will be tracked.

Behavioral Anomaly Detection

In identity governance, detecting access behavior that deviates from a user's or peer group's norm, such as accessing systems they never use or acting outside their role, to surface risky or compromised identities.

Continuous Access Evaluation

A zero-trust capability that re-checks a session's validity in near real time rather than only at login, so that if conditions change, a token is revoked, risk rises, or a device falls out of compliance, access is cut off promptly.

Cross-System SoD

Separation of duties enforced across multiple systems, ensuring that a combination of access spread over different applications does not let one person complete a sensitive process alone, even when no single system shows a conflict.

Assembly for Analysts

A working familiarity with assembly language so a malware analyst can read disassembled code and understand what a sample does at the instruction level when higher-level clues are missing or obfuscated.

Attorney-Client Privilege in IR

The legal protection that can keep certain incident-response work confidential when it is done under the direction of legal counsel. It shapes how investigations are structured, communicated, and documented during major incidents.

Cloud Hunting Data Sources

The telemetry a threat hunter draws on to hunt in cloud environments, such as control-plane and audit logs, identity sign-in logs, network flow logs, and managed detection findings. They are the raw material for cloud hunts.

Crisis External Communication

Communicating with outside parties, customers, regulators, media, and the public, during a major incident, managed by incident leadership to inform stakeholders accurately while protecting the organization legally and reputationally.