Cloud Computing: The delivery of different services through the Internet, including data storage, servers, databases, networking, and software.
API Security: The protection of the integrity of APIs—both the ones you own and the ones you use.
Cloud Access Security Broker (CASB): Software that sits between cloud service users and cloud applications to monitor all activity and enforce security policies.
Cloud Computing: The delivery of different services through the Internet, including data storage, servers, databases, networking, and software.
Cloud Migration: The process of moving data, applications, or other business elements to a cloud computing environment.
Cloud Security: The set of policies, technologies, applications, and controls utilized to protect virtualized IP, data, applications, services, and the associated infrastructure of cloud computing.
Compliance: The act of being in alignment with guidelines, regulations and/or legislation.
Data Breach: An incident where information is stolen or taken from a system without the knowledge or authorization of the system’s owner.
Data Encryption: The method of converting plaintext data into an unreadable form, or ciphertext, to protect it from unauthorized access.
Disaster Recovery: Strategies and processes to recover from and prevent data loss due to a disaster.
Encryption Key Management: The administration of tasks involved with protecting, storing, backing up, and organizing encryption keys.
Hybrid Cloud: A cloud computing environment that combines on-premises, private cloud and third-party, public cloud services with orchestration between the two platforms.
Identity and Access Management (IAM): A framework of policies and technologies for ensuring that the proper people in an enterprise have the appropriate access to technology resources.
Infrastructure as a Service (IaaS): A cloud computing service model that provides virtualized computing resources over the internet.
Multi-Factor Authentication (MFA): An authentication method that requires the user to provide two or more verification factors to gain access to a resource such as an application, online account, or a VPN.
Platform as a Service (PaaS): A cloud computing service model that provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app.
Private Cloud: A cloud computing model that offers a proprietary environment dedicated to a single business entity.
Public Cloud: A cloud service model where services are provided over the Internet and are available to anyone who wants to use or purchase them.
Service Level Agreement (SLA): A contract between a service provider and the end user that defines the level of service expected from the service provider.
Software as a Service (SaaS): A cloud computing service model that provides software applications over the internet, on a subscription basis.
Virtual Private Network (VPN): A technology that creates a safe and encrypted connection over a less secure network, such as the internet.
Application Security:
Application Programming Interface (API) Security: The practice of protecting APIs from malicious attacks or misuse.
Application Security: The process of making apps more secure by finding, fixing, and enhancing the security of apps.
Authentication: The process of verifying the identity of a user or process.
Authorization: The process of determining if a user, program, or process has the necessary permissions to perform a given action.
Certificate Authority (CA): An entity that issues digital certificates.
Code Review: The systematic examination of computer source code intended to find and fix mistakes overlooked in the initial development phase.
Cross-Site Request Forgery (CSRF): A type of attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated.
Cross-Site Scripting (XSS): A security vulnerability typically found in web applications that allows attackers to inject client-side scripts into web pages viewed by other users.
Data Breach: An incident where information is stolen or taken from a system without the knowledge or authorization of the system’s owner.
Decryption: The process of converting encrypted data back into its original form.
Digital Certificate: An electronic document used to prove the ownership of a public key.
Encryption: The process of encoding data to prevent unauthorized access.
Firewall: A network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.
Input Validation: The process of ensuring that a program operates on clean, correct and useful data.
Intrusion Detection System (IDS): A device or software application that monitors a network or systems for malicious activity or policy violations.
Intrusion Prevention System (IPS): A form of network security that works to detect and prevent identified threats.
Patch Management: The process of managing a network of computers by regularly performing patch deployment to keep computers up to date.
Penetration Testing: The practice of testing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit.
SQL Injection: A type of security vulnerability that allows attackers to interfere with the queries an application makes to its database.
Secure Sockets Layer (SSL)/Transport Layer Security (TLS): Protocols for establishing authenticated and encrypted links between networked computers.
Security Information and Event Management (SIEM): A set of tools and services offering a holistic view of an organization’s information security.
Security Token: A physical or digital device that provides an additional layer of security for authentication.
Session Hijacking: The exploitation of a valid computer session to gain unauthorized access to information or services in a computer system.
Two-Factor Authentication (2FA): A security process in which users provide two different authentication factors to verify themselves.
Vulnerability Assessment: The process of identifying, quantifying, and prioritizing (or ranking) the vulnerabilities in a system.
Zero-Day Attack: A cyber attack that occurs on the same day a weakness is discovered in software, before the software developers have an opportunity to create a patch to fix the vulnerability.