Concept Maps

Account/Subscription Strategy

An account and subscription strategy defines how cloud accounts or subscriptions are separated, governed, and assigned so ownership, billing, and security boundaries stay clear.

Admission Control

A gatekeeping step that checks whether a workload, image, or change is allowed to run before it is admitted into an environment, blocking anything that fails policy such as an unsigned container image or one with critical vulnerabilities.

Admission Controllers

Kubernetes components that intercept requests to the cluster's API server and can validate or modify them before objects are created, letting security teams enforce policy such as blocking privileged pods or requiring trusted images.

AI in Cloud Architecture

The design considerations for safely incorporating AI and machine-learning services into a cloud security architecture, covering where AI workloads sit in the network, how their data is protected, and how their access and logging fit existing controls.

API Gateway Security

Securing the API gateway, the entry point that sits in front of backend services and APIs, by enforcing authentication, authorization, rate limiting, and input checks centrally so individual services do not each have to.

Architecture Decision Records

Short documents that capture a significant design decision, the options considered, the choice made, and the reasoning behind it. In cloud security architecture they preserve why controls were designed a certain way.

AWS CloudTrail Investigation

Using AWS CloudTrail logs, which record API calls and account activity, to investigate a cloud incident: who did what, from where, and when. It is the primary evidence source for AWS control-plane actions.

AWS GuardDuty

An AWS threat-detection service that analyzes account, network, and DNS activity to flag suspicious behavior, such as compromised credentials, cryptomining, or reconnaissance, without needing agents on workloads.

AWS Landing Zone Frameworks

Prescriptive blueprints, such as AWS Control Tower and the multi-account framework, for setting up a secure, scalable AWS foundation with baked-in account structure, guardrails, logging, and identity from the start.

AWS Network Architecture

The design of networking in AWS, VPCs, subnets, route tables, gateways, security groups, and connectivity, arranged to segment workloads, control traffic, and limit exposure as part of a secure cloud foundation.

Azure Incident Investigation

Investigating a security incident in Microsoft Azure using its logs and signals, such as Entra ID sign-in logs, activity logs, and Microsoft Defender alerts, to determine what an attacker did and how far they reached.

Azure Landing Zone

Microsoft's prescriptive blueprint for a secure, scalable Azure foundation, defining management group hierarchy, subscriptions, policies, identity, networking, and logging so workloads land in a governed environment by default.

Azure Network Architecture

The design of networking in Azure, virtual networks, subnets, network security groups, peering, gateways, and firewalls, arranged to segment workloads, control traffic, and limit exposure within a secure cloud foundation.

Azure VM Forensics

Collecting and analyzing forensic evidence from an Azure virtual machine during an incident, such as disk snapshots and memory, in a way that preserves integrity so the VM's activity can be examined without altering evidence.

Cloud Compliance Landscape

The overall set of regulations, standards, and certification schemes that apply to cloud-hosted systems, such as FedRAMP, ISO 27001/27017, SOC 2, GDPR, and HIPAA, and how they interact under the shared-responsibility model.

Cloud Compliance Tools

Software that helps manage cloud compliance by mapping controls to frameworks, collecting evidence automatically, monitoring for drift, and producing audit-ready reports. They make multi-framework compliance feasible at cloud scale and speed.

Cloud Forensic Collection

Gathering evidence from a cloud environment during an incident in a sound, repeatable way, such as snapshotting disks, capturing memory, and exporting logs, while preserving integrity and chain of custody.

Cloud IAM Architecture

The overall design of identity and access in a cloud environment, how accounts, roles, policies, permission boundaries, and organization-wide controls fit together to enforce least privilege and limit blast radius.

Cloud IR Automation

Using automated playbooks and scripts to speed up cloud incident response, such as automatically isolating a workload, revoking credentials, or collecting evidence the moment a detection fires, reducing the time an attacker has to act.

Cloud IR Evidence Sources

The places a cloud responder gathers evidence during an incident, control-plane and audit logs, identity sign-in logs, network flow logs, disk snapshots, memory captures, and provider detection findings. Knowing them is essential to investigate effectively.

Cloud IR Fundamentals

The core principles of responding to cloud incidents: how cloud differs from on-premises IR, the importance of identity and logging, the shared-responsibility constraints, and the basic phases adapted to cloud. It is the foundation for all cloud IR work.

Cloud Native Computing Foundation

The open-source organization (CNCF) that hosts and governs many foundational cloud-native projects, including Kubernetes. It stewards the ecosystem of container, orchestration, and cloud-native tooling that modern infrastructure is built on.

Cloud Native vs Lifted

The distinction between workloads built specifically for the cloud (cloud-native) and those moved from on-premises largely unchanged (lift-and-shift). The two have very different security profiles, tooling, and opportunities.

Cloud Provider Compliance

The certifications and attestations a cloud provider holds for its own infrastructure and services, such as SOC 2, ISO 27001, or FedRAMP authorizations, which customers can rely on for the provider's share of the shared-responsibility model.

Cloud Security Architect

The role responsible for designing secure cloud environments, setting the patterns, standards, and guardrails, identity, network, logging, account structure, that workloads are built within. It focuses on design and strategy rather than day-to-day operations.

Cloud Security Engineer

The role that implements, automates, and operates security controls in cloud environments, building guardrails, configuring identity and network protections, integrating security into pipelines, and responding to issues. It is hands-on and build-focused.

Cloud Security Lifecycle

The end-to-end stages of securing cloud workloads over time, design, build, deploy, operate, and respond, with security integrated at each stage rather than bolted on at the end.

Cloud Security Maturity

A measure of how advanced and effective an organization's cloud security practices are, from ad-hoc and reactive toward automated, integrated, and proactive. It helps teams gauge where they stand and what to improve next.

Cloud VM Lifecycle

The stages a cloud virtual machine passes through, from a hardened base image, through provisioning and configuration, to running, patching, and decommissioning, with security applied at each stage to keep workloads protected over time.

Cloud-Native Architecture

The structural design of cloud-native systems, microservices, containers, orchestration, declarative infrastructure, and automated delivery, that emphasizes loosely coupled, independently deployable, elastically scaled components.

Cloud-Native Security Model

The overall approach to securing cloud-native systems, layering identity-based access, network policy and segmentation, admission control, supply-chain security, runtime protection, and observability across the orchestrated, containerized stack.

Compliance vs Security

The distinction between meeting a framework's requirements (compliance) and actually being protected against attack (security). An organization can be fully compliant yet insecure, and secure yet not formally compliant; the two overlap but are not the same.

Conditional Access (Cloud)

Conditional access as implemented and operated by a cloud security engineer, the policies in a cloud identity platform that gate access to cloud resources based on risk, device, location, and identity signals.

Container Compliance

Ensuring container images and running containers meet security and configuration standards, scanned for vulnerabilities, built from approved bases, signed, and configured to benchmarks, so they satisfy both internal policy and external requirements.

Container Registry Security

Protecting the container registry through access control, image signing and verification, vulnerability scanning of stored images, and provenance checks, so only trusted, clean images can be stored and deployed.

Container Runtime Protection

Securing containers while they are running by monitoring their behavior and blocking malicious activity in real time, such as detecting and stopping a container escape, unexpected process execution, or anomalous network connection.

Container Security Lifecycle

The stages of securing a container over its life, build (hardened, scanned, signed images), ship (secure registry), and run (admission control and runtime protection), with security applied at each stage rather than only at the end.

Container Vulnerability Scanning

Scanning container images and running containers for known software vulnerabilities, identifying vulnerable packages in image layers so they can be fixed before deployment and tracked while running.

Containerization Patterns

Common ways of structuring and deploying containers, such as one process per container, sidecar and ambassador patterns, and init containers, each with security implications for isolation, privilege, and the attack surface.

Continuous Evidence Collection

Automatically gathering compliance evidence on an ongoing basis, configurations, logs, access reviews, and tickets, as it is generated, so audits draw on a continuously maintained evidence store rather than a last-minute manual scramble.

CSA STAR

The Cloud Security Alliance's Security, Trust, Assurance and Risk registry, a public program where cloud providers publish assessments of their security controls, letting customers evaluate and compare providers' security and compliance.

Customer Compliance Scope

The portion of cloud compliance obligations that fall to the customer rather than the provider under the shared-responsibility model, the controls the customer must implement, operate, and evidence for their own configuration and use.

Customer-Implemented Controls

The security controls that, under shared responsibility, the customer must build and operate themselves in the cloud, such as configuring identity, encryption, network rules, and logging, as opposed to controls inherited from the provider.

Declarative Infrastructure

Defining infrastructure by describing the desired end state in code, and letting tooling make reality match, rather than scripting step-by-step changes. It is foundational to cloud-native systems and enables consistent, auditable, self-correcting configuration.

Engineer-Developer Interface

The working relationship between cloud security engineers and the developers who build on the cloud, defining how security guardrails, feedback, and requirements reach developers without becoming a blocker to their work.

Engineering vs Operations

The distinction between building cloud security capabilities (engineering, automation, guardrails, tooling) and running them day to day (operations, monitoring, response), two complementary modes within the cloud security engineer role.

FedRAMP

The US government program that standardizes security assessment and authorization for cloud services used by federal agencies, so a cloud provider authorized once can be trusted across government under a common baseline.

GDPR Cloud

Applying GDPR requirements specifically to cloud environments, ensuring personal data in cloud services meets obligations for lawful processing, data residency, transfers, breach notification, and shared responsibility with the provider.

GitOps

An operational model where the desired state of infrastructure and applications is declared in Git and automatically reconciled to the live environment, making Git the single source of truth for deployments and changes.

Golden Image

A pre-configured, hardened base image, of a VM or container, that is built once to a secure standard and reused as the trusted starting point for new workloads, so every instance inherits a known-good, consistent configuration.

HIPAA Cloud

Meeting HIPAA requirements when health information is processed or stored in the cloud, ensuring PHI is safeguarded through the shared-responsibility model, business-associate agreements, and appropriate cloud controls.

IAM Roles vs Users (Cloud)

The distinction between cloud users (long-lived identities for people, with standing credentials) and roles (assumable identities granting temporary credentials), a core cloud-IAM concept where roles are preferred to avoid static, leakable keys.

Image Hardening

Configuring a VM or container image to a secure, minimal state, removing unnecessary packages and services, applying secure settings, and patching, so every workload launched from it starts hardened rather than from an insecure default.

Image Pipeline

The automated process that builds, hardens, scans, and publishes VM or container images, so images are produced consistently and securely from source to a trusted registry rather than assembled ad hoc.

Image Security Pipeline

A build-and-delivery pipeline with security stages woven in, building, hardening, scanning, signing, and gating images, so security is enforced automatically as images move from source to deployment.

Image Signing

Cryptographically signing container or VM images so their integrity and origin can be verified before deployment, ensuring an image has not been tampered with and came from a trusted source.

Inheritable Controls

Controls that a cloud customer can rely on the provider to fulfill under shared responsibility, so the customer inherits them rather than implementing them, reducing the customer's own compliance burden for those controls.

ISO 27001 Cloud

Applying ISO 27001 to cloud environments, scoping the ISMS to include cloud services, addressing shared responsibility, and using cloud-specific guidance (like ISO 27017/27018) so the management system covers cloud risks.

ISO 27017

An international standard giving cloud-specific security guidance that extends ISO 27001/27002 to cloud services, addressing the shared responsibilities and controls relevant to both cloud providers and customers.

Microservices

An architectural style where an application is built as many small, independent services that communicate over the network, common in cloud-native systems and carrying distinctive security characteristics for defenders to address.

Multi-Cloud vs Single-Cloud

The architectural choice between using one cloud provider or several. Multi-cloud avoids lock-in and adds resilience but increases complexity; single-cloud is simpler but ties the organization to one provider.

Mutating Webhooks

Kubernetes admission controllers that can modify incoming requests before they take effect, automatically adjusting workloads, for instance injecting sidecars or enforcing required settings, as part of cluster security and policy.

Network Policies Production

Operating Kubernetes network policies in real production at scale, designing them sustainably, rolling them out without breaking apps, monitoring effectiveness, and maintaining them as workloads change.

OPA Gatekeeper

A Kubernetes admission controller built on Open Policy Agent that enforces policy on resources as they are created, blocking or auditing workloads that violate rules, so cluster policy is enforced automatically.

PCI-DSS Cloud

Meeting PCI DSS in cloud environments, addressing how the standard applies when cardholder data is processed in the cloud, including shared responsibility, scope, and provider attestations within the cloud compliance landscape.

Pod Security Standards Production

Operating Pod Security Standards in real production clusters, choosing the right level per workload, rolling out without breaking existing apps, handling exceptions, and monitoring effectiveness over time.

Production Kubernetes

The realities of running Kubernetes securely at production scale, hardening the cluster, operating policies and controls over time, handling change and incidents, beyond what initial deployment requires.

RBAC at Scale

The challenges and patterns for using role-based access control across large cloud-native environments, role explosion, drift, and complexity, that require deliberate design and ongoing governance to keep RBAC working.

Security as Code

Expressing security configuration, policies, and controls as code that is versioned, tested, and deployed alongside applications, so security is automated and consistent rather than manually managed.

Service Control Policies (SCPs)

Organization-level policies in cloud (AWS-style) that set the maximum permissions any account in scope can have, used as guardrails to enforce limits across many accounts at once.

Service Mesh Security

The security capabilities and concerns of a service mesh, mTLS, identity, authorization, observability, plus protecting the mesh itself, treated as a coherent security-architecture topic.

Shared Responsibility for Compliance

How compliance responsibilities split between cloud provider and customer, both share parts of meeting frameworks, requiring customers to understand what's inherited and what they must do themselves.

SOC 2 Cloud

Operating SOC 2 compliance in cloud environments, leveraging provider attestations for inherited controls and demonstrating customer-side controls for what shared responsibility leaves to the customer.

Trust Policy

In AWS IAM, the policy attached to a role that defines who can assume it, distinct from the permissions policy that defines what the role can do. Misconfigured trust policies are a major cloud security issue.

Twelve-Factor Implications

The security implications of building apps along the twelve-factor methodology, externalized config, stateless processes, log streams, that shape how cloud-native security applies to those apps.

Validating Webhooks

Verifying that webhook requests come from the expected sender, via signed payloads, HMAC verification, or source-IP checks, since webhook endpoints are publicly reachable and trivially spoofable otherwise.

VM Configuration Management

Managing the configuration of cloud VMs at scale, baselines, drift detection, automated remediation, so workloads stay aligned to expected state instead of diverging silently.

VM Patching at Cloud Scale

Patching cloud VM fleets at scale, often via image rebuilds or scheduled rolling updates, rather than in-place patches, since cloud-native patterns favor replace over update.

VM Runtime Protection

Protecting cloud VMs at runtime, monitoring process behavior, file changes, network connections, often via EDR or specialized cloud-workload agents, complementing configuration and image controls.

VM-specific Cloud Telemetry

Telemetry distinct to cloud VMs, metadata-service access, control-plane API calls, instance-level network logs, that goes beyond on-prem endpoint data and is essential for cloud workload detection.