Glossary

Cloud-Native Incident Patterns

The characteristic shapes that incidents take in cloud-native environments, such as an exposed orchestrator leading to mass workload compromise, or a container escape spreading across a node, that inform how responders investigate and contain them.

Cloud-Native Observability

Gaining visibility into the behavior of cloud-native systems for security purposes, using logs, metrics, distributed tracing, and kernel-level instrumentation like eBPF, to detect threats across many ephemeral, distributed components.

Cloud-Native Security Model

The overall approach to securing cloud-native systems, layering identity-based access, network policy and segmentation, admission control, supply-chain security, runtime protection, and observability across the orchestrated, containerized stack.

Cloud-Native Threat Modeling

Applying threat modeling to cloud-native systems, accounting for their distinctive elements, microservices, containers, orchestrators, service meshes, and managed services, to identify design-level threats specific to that architecture.

Cloud-Specific Hunts

Threat hunts tailored to cloud environments, searching cloud telemetry, identity, control-plane, and network logs, for cloud-specific adversary behaviors like credential abuse, privilege escalation, and resource hijacking that on-premises hunts would miss.

Cloud-Specific TTPs

The tactics, techniques, and procedures attackers use that are unique to cloud environments, such as abusing access keys, assuming roles across accounts, querying instance metadata for credentials, and disabling cloud logging.

CloudFormation Bicep

Infrastructure-as-code languages, AWS CloudFormation and Azure Bicep, used to define cloud resources declaratively in templates. Securing these templates means catching misconfigurations and insecure defaults before they are deployed.

Cloudsplaining Analysis

Using Cloudsplaining, an open-source tool, to analyze AWS IAM policies for risky permissions, surfacing identities that can escalate privileges, access data broadly, or modify resources, so assessors can focus on the most dangerous access.

Cluster Hardening

Securing a Kubernetes cluster by tightening its configuration, locking down the API server, enforcing RBAC and network policies, applying pod security standards, and using admission control, so the orchestrator and its workloads resist attack.

Clustering Techniques

Analytical methods that group similar events or entities together so a threat hunter can spot outliers and patterns in large datasets, for example grouping connections by destination to reveal a rare cluster worth investigating.

Cold Leads

Investigation leads that look low-priority or unlikely to be malicious based on initial assessment, which an analyst may deprioritize relative to hot leads. Judging a lead cold is a triage decision that must balance efficiency against missing a real threat.

Cold Standby

A disaster-recovery setup where backup systems exist but are kept powered off or unprovisioned until needed, making it the cheapest but slowest recovery option, since systems must be brought up and data restored before service resumes.

Collection

The attack stage where an adversary gathers the data they intend to steal, staging files, capturing keystrokes, or pulling from databases and email, before exfiltrating it. It is the step between finding valuable data and removing it.

Collision Resistance

A property of a secure cryptographic hash function meaning it is computationally infeasible to find two different inputs that produce the same hash output. It is what lets a hash reliably stand in for the data it represents.

Command Injection

A web vulnerability where untrusted input is passed into a system command, letting an attacker run arbitrary commands on the host. It arises when an application builds shell commands from user input without proper handling.

Command Line

The text-based interface for issuing commands to an operating system, and a rich source of security evidence: the full command line of a process often reveals exactly what it was doing, which is invaluable for detection and investigation.

Command and Control

Communication used by an attacker to control compromised systems.

Common Combinations

The framework pairings organizations typically adopt together because they complement each other, for example using the NIST CSF for structure alongside ISO 27001 for certification, or CIS Controls for prescriptive action under a broader reference framework.

Common PIR Failures

The recurring ways post-incident reviews go wrong, such as assigning blame, producing vague or unowned action items, skipping the review under time pressure, or never tracking fixes to completion, that prevent an organization from actually learning from incidents.

Communication Cadence

The planned rhythm of updates during an incident, who is informed, how often, and through what channel, so stakeholders stay appropriately updated without overwhelming responders or creating confusion.

Communication During Incidents

The discipline of keeping the right people informed throughout an incident, internal teams, leadership, customers, and partners, with accurate, timely, appropriately scoped information, recognizing that poor communication can worsen an incident as much as the technical issue.

Compensating Controls

Compensating controls are alternative safeguards used when the preferred control cannot be implemented exactly as required.

Compliance Automation

Using tools and code to perform compliance work, evidence collection, control checking, drift detection, and reporting, automatically and continuously, instead of through manual, periodic effort. It makes cloud-scale, multi-framework compliance feasible.

Compliance Automation Tooling

The category of products used to run a compliance program efficiently, GRC and compliance-automation platforms that map controls to frameworks, gather evidence, track tasks, and produce audit-ready output. This entry focuses on the tooling itself within building a program.

Compliance Calendar

A schedule of recurring compliance obligations, audits, control reviews, evidence-collection deadlines, attestations, and report dates, that a GRC analyst maintains so nothing is missed and work is paced rather than crammed before each audit.

Compliance Communication

How a GRC analyst conveys compliance status, obligations, and findings to the people who must act, control owners, leadership, and auditors, translating requirements into terms each audience understands and can act on.

Compliance Drift

The gradual movement of a cloud environment out of a compliant state as configurations change over time, so controls that once passed an audit quietly stop being met. It must be detected continuously because it accumulates silently.

Compliance Evidence

The proof that a control exists and operates as required, such as configuration exports, logs, screenshots, policies, and tickets, that an organization presents to demonstrate compliance to an auditor.

Compliance Framework Mapping

Within building a compliance program, the work of mapping the organization's controls to the requirements of each framework it must meet, so overlaps are reused and gaps are exposed, enabling a 'comply once, satisfy many' approach.

Compliance Frameworks

Structured sets of security requirements and controls, such as ISO 27001, the NIST CSF, SOC 2, PCI DSS, and HIPAA, that organizations use to organize their security program and demonstrate they meet recognized standards or regulations.

Compliance Integration

Embedding compliance into the cloud's existing engineering and operations workflows, pipelines, infrastructure as code, and monitoring, so compliance is a continuous part of how systems are built and run rather than a separate, after-the-fact activity.