Glossary

Cloud Architecture Security Review

A security architecture review focused on a cloud environment, examining how accounts, identity, networking, data protection, and services are designed to find systemic weaknesses such as over-broad access, flat networks, or unprotected data.

Cloud Assessment Findings

The documented weaknesses a cloud security assessment uncovers, such as over-permissioned identities, publicly exposed storage, missing encryption, or absent logging, each with its risk and a recommended fix. They are the actionable output of the assessment.

Cloud Assessment Scope

The defined boundaries of a cloud security assessment, which accounts, subscriptions, services, and regions are included, and what is out of scope. It is set first so the assessment is focused and its coverage and limits are clear.

Cloud Assessment Tools

The software used to assess cloud security, including provider-native posture tools and open-source scanners (such as those that analyze IAM policies or scan for misconfigurations). They automate discovery of exposure, excessive permissions, and configuration weaknesses.

Cloud Audit Log

A cloud platform's record of control-plane activity, who called which API, on what resource, when, and from where. It is the foundational telemetry for detecting, investigating, and auditing actions in a cloud environment.

Cloud Audit Logs

Cloud control-plane activity records as handled within a logging and telemetry pipeline, covering how they are collected, indexed, stored across hot and cold tiers, and made searchable for detection and investigation at scale.

Cloud Compliance

Meeting regulatory, contractual, and framework requirements for systems and data hosted in the cloud, while accounting for the shared-responsibility model that splits obligations between the cloud provider and the customer.

Cloud Compliance Landscape

The overall set of regulations, standards, and certification schemes that apply to cloud-hosted systems, such as FedRAMP, ISO 27001/27017, SOC 2, GDPR, and HIPAA, and how they interact under the shared-responsibility model.

Cloud Compliance Tools

Software that helps manage cloud compliance by mapping controls to frameworks, collecting evidence automatically, monitoring for drift, and producing audit-ready reports. They make multi-framework compliance feasible at cloud scale and speed.

Cloud Computing

The on-demand delivery of computing resources, servers, storage, databases, and software, over the internet from a provider, paid for as used rather than owned. It is the foundation that all cloud security concepts build upon.

Cloud Configuration Drift

The gradual divergence of a cloud environment's actual settings from its intended secure baseline, as people make ad-hoc changes over time. Drift quietly reopens risks that were once closed, which is why it must be detected continuously.

Cloud Containment

The actions taken to stop an active cloud incident from spreading, using cloud-native controls, such as isolating a workload, revoking credentials and sessions, restricting a resource's network access, or quarantining an account.

Cloud DLP

Cloud data loss prevention: tools and policies that detect and stop sensitive data, like personal, financial, or health information, from being exposed or leaving the cloud environment improperly, by inspecting data and enforcing handling rules.

Cloud Data Security

Protecting data stored and processed in the cloud through classification, encryption, access control, and key management, so sensitive information stays confidential and intact regardless of which cloud service holds it.

Cloud Database Assessment

Evaluating the security of managed and self-hosted cloud databases, checking for public exposure, weak authentication, missing encryption, excessive privileges, and inadequate logging, since databases often hold an organization's most sensitive data.

Cloud Detection

Identifying malicious or anomalous activity in a cloud environment by analyzing control-plane logs, identity events, network flows, and managed threat-detection services. It focuses on the signals unique to cloud, especially identity and API abuse.

Cloud Directories

Cloud-hosted identity directories, such as Microsoft Entra ID or other cloud directory services, that store user accounts, groups, and attributes and authenticate access to cloud and SaaS applications. They are the cloud equivalent of on-premises Active Directory.

Cloud Federation

Establishing trust between identity systems so that identities from one domain can access resources in another, for example letting an organization's existing directory authenticate users into a cloud platform without separate accounts.

Cloud Findings Communication

Conveying the results of a cloud security assessment so stakeholders understand each issue, its real risk, and how to fix it, adjusting depth and framing for engineers, cloud owners, and leadership.

Cloud Forensic Collection

Gathering evidence from a cloud environment during an incident in a sound, repeatable way, such as snapshotting disks, capturing memory, and exporting logs, while preserving integrity and chain of custody.

Cloud Forensics

The discipline of investigating incidents in cloud environments, collecting and analyzing evidence like snapshots, memory, and logs to reconstruct what happened, while working within the constraints and capabilities the cloud provider exposes.

Cloud GRC Role

The job of a governance, risk, and compliance professional focused on cloud, translating cloud technical realities into compliance evidence, managing cloud frameworks, and bridging cloud engineers with auditors and risk stakeholders.

Cloud GRC Skills

The competencies a cloud GRC professional needs: understanding cloud services and shared responsibility, knowing major frameworks, mapping controls, collecting cloud-native evidence, and communicating compliance posture to technical and non-technical audiences.

Cloud GRC to Adjacent Roles

How a cloud GRC role relates to and differs from neighboring roles like cloud security engineer, traditional GRC analyst, auditor, and risk manager, clarifying the unique blend of governance and cloud fluency it occupies.

Cloud Hunting Data Sources

The telemetry a threat hunter draws on to hunt in cloud environments, such as control-plane and audit logs, identity sign-in logs, network flow logs, and managed detection findings. They are the raw material for cloud hunts.

Cloud IAM Architecture

The overall design of identity and access in a cloud environment, how accounts, roles, policies, permission boundaries, and organization-wide controls fit together to enforce least privilege and limit blast radius.

Cloud IR

Incident response in the cloud as practiced by a cloud security engineer, covering the cloud-native detection, containment, forensics, and recovery actions used when a cloud workload or identity is compromised.

Cloud IR Automation

Using automated playbooks and scripts to speed up cloud incident response, such as automatically isolating a workload, revoking credentials, or collecting evidence the moment a detection fires, reducing the time an attacker has to act.

Cloud IR Evidence Sources

The places a cloud responder gathers evidence during an incident, control-plane and audit logs, identity sign-in logs, network flow logs, disk snapshots, memory captures, and provider detection findings. Knowing them is essential to investigate effectively.

Cloud IR Fundamentals

The core principles of responding to cloud incidents: how cloud differs from on-premises IR, the importance of identity and logging, the shared-responsibility constraints, and the basic phases adapted to cloud. It is the foundation for all cloud IR work.

Cloud IR Playbook Design

Creating the step-by-step response procedures for specific cloud incident types, like compromised credentials, exposed storage, or cryptomining, so responders act quickly and consistently using the right cloud-native steps.