Cloud Computing:
The delivery of different services through the Internet, including data
storage, servers, databases, networking, and software.
API Security:
The protection of the integrity of APIs—both the ones you own and the
ones you use.
Cloud Access Security Broker (CASB):
Software that sits between cloud service users and cloud applications
to monitor all activity and enforce security policies.
Cloud Computing
: The delivery of different services through the Internet, including
data storage, servers, databases, networking, and software.
Cloud Migration
: The process of moving data, applications, or other business elements
to a cloud computing environment.
Cloud Security
: The set of policies, technologies, applications, and controls utilized
to protect virtualized IP, data, applications, services, and the associated
infrastructure of cloud computing.
Compliance
: The act of being in alignment with guidelines, regulations and/or legislation.
Data Breach
: An incident where information is stolen or taken from a system without
the knowledge or authorization of the system’s owner.
Data Encryption
: The method of converting plaintext data into an unreadable form, or
ciphertext, to protect it from unauthorized access.
Disaster Recovery
: Strategies and processes to recover from and prevent data loss due
to a disaster.
Encryption Key Management
: The administration of tasks involved with protecting, storing, backing
up, and organizing encryption keys.
Hybrid Cloud
: A cloud computing environment that combines on-premises, private cloud
and third-party, public cloud services with orchestration between the
two platforms.
Identity and Access Management (IAM)
: A framework of policies and technologies for ensuring that the proper
people in an enterprise have the appropriate access to technology resources.
Infrastructure as a Service (IaaS)
: A cloud computing service model that provides virtualized computing
resources over the internet.
Multi-Factor Authentication (MFA)
: An authentication method that requires the user to provide two or more
verification factors to gain access to a resource such as an application,
online account, or a VPN.
Platform as a Service (PaaS)
: A cloud computing service model that provides a platform allowing customers
to develop, run, and manage applications without the complexity of building
and maintaining the infrastructure typically associated with developing
and launching an app.
Private Cloud
: A cloud computing model that offers a proprietary environment dedicated
to a single business entity.
Public Cloud
: A cloud service model where services are provided over the Internet
and are available to anyone who wants to use or purchase them.
Service Level Agreement (SLA)
: A contract between a service provider and the end user that defines
the level of service expected from the service provider.
Software as a Service (SaaS)
: A cloud computing service model that provides software applications
over the internet, on a subscription basis.
Virtual Private Network (VPN)
: A technology that creates a safe and encrypted connection over a less
secure network, such as the internet.
Application Security:
Application Programming Interface (API) Security
: The practice of protecting APIs from malicious attacks or misuse.
Application Security
: The process of making apps more secure by finding, fixing, and enhancing
the security of apps.
Authentication
: The process of verifying the identity of a user or process.
Authorization
: The process of determining if a user, program, or process has the necessary
permissions to perform a given action.
Certificate Authority (CA)
: An entity that issues digital certificates.
Code Review
: The systematic examination of computer source code intended to find
and fix mistakes overlooked in the initial development phase.
Cross-Site Request Forgery (CSRF)
: A type of attack that forces an end user to execute unwanted actions
on a web application in which they are currently authenticated.
Cross-Site Scripting (XSS)
: A security vulnerability typically found in web applications that allows
attackers to inject client-side scripts into web pages viewed by other
users.
Data Breach
: An incident where information is stolen or taken from a system without
the knowledge or authorization of the system’s owner.
Decryption
: The process of converting encrypted data back into its original form.
Digital Certificate
: An electronic document used to prove the ownership of a public key.
Encryption
: The process of encoding data to prevent unauthorized access.
Firewall
: A network security device that monitors incoming and outgoing network
traffic and decides whether to allow or block specific traffic based
on a defined set of security rules.
Input Validation
: The process of ensuring that a program operates on clean, correct and
useful data.
Intrusion Detection System (IDS)
: A device or software application that monitors a network or systems
for malicious activity or policy violations.
Intrusion Prevention System (IPS)
: A form of network security that works to detect and prevent identified
threats.
Patch Management
: The process of managing a network of computers by regularly performing
patch deployment to keep computers up to date.
Penetration Testing
: The practice of testing a computer system, network, or web application
to find security vulnerabilities that an attacker could exploit.
SQL Injection
: A type of security vulnerability that allows attackers to interfere
with the queries an application makes to its database.
Secure Sockets Layer (SSL)/Transport Layer Security (TLS)
: Protocols for establishing authenticated and encrypted links between
networked computers.
Security Information and Event Management (SIEM)
: A set of tools and services offering a holistic view of an organization’s
information security.
Security Token
: A physical or digital device that provides an additional layer of security
for authentication.
Session Hijacking
: The exploitation of a valid computer session to gain unauthorized access
to information or services in a computer system.
Two-Factor Authentication (2FA)
: A security process in which users provide two different authentication
factors to verify themselves.
Vulnerability Assessment
: The process of identifying, quantifying, and prioritizing (or ranking)
the vulnerabilities in a system.
Zero-Day Attack
: A cyber attack that occurs on the same day a weakness is discovered
in software, before the software developers have an opportunity to create
a patch to fix the vulnerability.
