Glossary

Cloud IR Timeline Management

Building and maintaining an accurate chronological record of a cloud incident, ordering events from logs across identity, control plane, and workloads so responders understand what happened, in what sequence, and how far the attacker reached.

Cloud Incident Response

Responding to security incidents in cloud environments, adapting the incident response lifecycle to cloud realities like identity-centric attacks, ephemeral resources, control-plane evidence, and the shared-responsibility model.

Cloud Landing Zone

A pre-built, secure cloud foundation, account structure, identity, networking, logging, and guardrails, established before workloads are deployed, so every workload lands in a governed environment with security baked in by default.

Cloud Log Preservation

Ensuring cloud logs needed for an investigation are captured, retained, and protected from deletion or tampering, including before an incident, since many cloud logs are off by default or expire quickly and cannot be recovered once gone.

Cloud Logging Architecture

The design of how logs are collected, routed, centralized, retained, and protected across a cloud environment, so security teams have complete, trustworthy telemetry for detection, investigation, and compliance.

Cloud Native Computing Foundation

The open-source organization (CNCF) that hosts and governs many foundational cloud-native projects, including Kubernetes. It stewards the ecosystem of container, orchestration, and cloud-native tooling that modern infrastructure is built on.

Cloud Native vs Lifted

The distinction between workloads built specifically for the cloud (cloud-native) and those moved from on-premises largely unchanged (lift-and-shift). The two have very different security profiles, tooling, and opportunities.

Cloud Network Architecture

The design of networking within a cloud environment as built and operated by a cloud security engineer, virtual networks, subnets, segmentation, gateways, and connectivity, arranged to control traffic flow and contain compromise.

Cloud Network Monitoring

Observing network traffic within and at the edges of a cloud environment, using flow logs, traffic mirroring, and provider network tools, to detect anomalies, investigate incidents, and verify segmentation is working.

Cloud Network Topologies

The common architectural patterns for arranging cloud networks, such as hub-and-spoke, flat, and segmented multi-account designs, each shaping how traffic flows, how workloads are isolated, and how easily an attacker can move.

Cloud Provider Compliance

The certifications and attestations a cloud provider holds for its own infrastructure and services, such as SOC 2, ISO 27001, or FedRAMP authorizations, which customers can rely on for the provider's share of the shared-responsibility model.

Cloud Provider Dependency

The reliance a business places on its cloud provider for availability and recovery, and the continuity risk that creates, such as regional outages, account lockout, or provider failure, that BC/DR planning must explicitly account for.

Cloud Recovery

Restoring systems and data after a disruption using cloud capabilities, such as redeploying infrastructure from code, restoring from cloud or cross-region backups, and failing over to another region, to meet defined recovery objectives.

Cloud Reference Architectures

Vetted, reusable blueprints for securely designing common cloud scenarios, such as a secure landing zone, a three-tier app, or a data platform, that an architecture reviewer compares a real design against to spot gaps.

Cloud Regions

Geographically distinct locations where a cloud provider operates data centers, each containing multiple availability zones. The region a workload runs in affects latency, data residency, available services, and resilience options.

Cloud Roles

Cloud identities that carry a set of permissions and are assumed temporarily by users, services, or workloads to perform actions, rather than being a permanent account. Roles are central to granting access without long-lived credentials.

Cloud SIEM

A security information and event management system delivered as a cloud service or built to ingest cloud telemetry, centralizing logs and events from cloud and other sources to power detection, investigation, and compliance at cloud scale.

Cloud Security Architect

The role responsible for designing secure cloud environments, setting the patterns, standards, and guardrails, identity, network, logging, account structure, that workloads are built within. It focuses on design and strategy rather than day-to-day operations.

Cloud Security Engineer

The role that implements, automates, and operates security controls in cloud environments, building guardrails, configuring identity and network protections, integrating security into pipelines, and responding to issues. It is hands-on and build-focused.

Cloud Security Lifecycle

The end-to-end stages of securing cloud workloads over time, design, build, deploy, operate, and respond, with security integrated at each stage rather than bolted on at the end.

Cloud Security Maturity

A measure of how advanced and effective an organization's cloud security practices are, from ad-hoc and reactive toward automated, integrated, and proactive. It helps teams gauge where they stand and what to improve next.

Cloud Security Posture Management

A practice or toolset for finding risky cloud configurations and policy gaps.

Cloud Security Tool Architecture

How an organization's cloud security tools, posture management, workload protection, detection, identity analytics, fit together into a coherent whole, with data flowing between them rather than operating as disconnected point solutions.

Cloud Security Tooling Categories

The main classes of cloud security tools, such as posture management (CSPM), workload protection (CWPP), network security, identity analytics, and consolidated platforms (CNAPP), each addressing a different aspect of cloud risk.

Cloud Users

Permanent cloud identities representing people or applications, each with long-lived credentials and assigned permissions. Unlike roles, which are assumed temporarily, users persist, which makes their credentials a more attractive target.

Cloud VM Lifecycle

The stages a cloud virtual machine passes through, from a hardened base image, through provisioning and configuration, to running, patching, and decommissioning, with security applied at each stage to keep workloads protected over time.

Cloud Workload Protection Platforms

Tools (CWPP) that secure running cloud workloads, virtual machines, containers, and serverless functions, by scanning for vulnerabilities, hardening configurations, and detecting and stopping threats at runtime, wherever the workload runs.

Cloud Workloads

The applications and compute running in the cloud, virtual machines, containers, serverless functions, and the services they comprise. They are what cloud workload protection aims to secure and where attacks ultimately execute.

Cloud-Native

An approach to building applications designed specifically for the cloud, using managed services, containers, microservices, and automation, rather than running traditional architectures on cloud infrastructure. It changes both how software is built and how it is secured.

Cloud-Native Architecture

The structural design of cloud-native systems, microservices, containers, orchestration, declarative infrastructure, and automated delivery, that emphasizes loosely coupled, independently deployable, elastically scaled components.

Cloud-Native Attack Patterns

The recurring ways attackers compromise cloud-native systems, such as exploiting exposed orchestrator APIs, escaping containers, abusing over-permissioned workload identities, and cryptojacking. They differ from traditional attacks because the architecture differs.