Glossary

155 terms from Cloud and Data Security, in plain words, each with the chapter that teaches it.

Search the glossary

A

ACL (access control list): An older S3 way to grant access, attached to a bucket or to individual objects. Two of the four Block Public Access switches refuse and ignore public ACLs.
AES (Advanced Encryption Standard): A widely used symmetric encryption algorithm. The Fernet tool in protect.py uses AES to encrypt the card number with a key.
Allow list: A list that describes what is permitted and refuses everything else. handler.py accepts only upload names shaped like products/<name>.jpg instead of trying to list every bad name.
Amazon Macie: AWS's cloud DLP service, which scans S3 buckets for sensitive data.
API gateway: A single front door that receives every outside request to a microservices app. It checks sign-in and rate limits before passing the request on, so the services themselves aren't reachable from the internet.
Architecture model: The overall choice of where systems run and who owns the machines, such as on-premises, cloud, hybrid, community cloud or multicloud. Kettle & Crane uses several at once.
Attack surface: Everything an attacker could reach and try. It grows with each microservice, and with each cloud provider and account you add.
Autoscaling: The cloud automatically adding or removing servers as demand changes, between a set minimum and maximum. For the holiday sale, the shop's group runs from 2 to 9 servers.
AWS Nitro Enclaves: AWS's confidential computing feature. Code runs in an isolated, protected area that even the server's admins can't read.
AWS Organizations: An AWS service for managing many accounts together. It can attach a service control policy, such as the region limit, to every account at once.

B

Bicep: Microsoft Azure's Infrastructure as Code language. It does the same job as CloudFormation templates.
Block Public Access (BPA): Four S3 switches that refuse and ignore public ACLs and public bucket policies. With all four on, public requests from anyone on the internet are denied, whatever the policies say.
Bucket: A named container for files (objects) in S3 cloud storage, such as kc-customers. Its settings and policy decide who can reach the files.
Bucket policy: S3's resource policy, attached to a bucket. It has a Principal field that names who it applies to, so it can, for example, deny everyone any request that doesn't use TLS.

C

CAN-SPAM: A US law on marketing email. It allows opt-out, as long as every email has a working unsubscribe link.
CASB (cloud access security broker): A security service that sits between users and cloud services to watch and control their use. CASBs often include cloud DLP.
CCPA (California Consumer Privacy Act): California's privacy law. It gives people rights over their data, including a right to delete that must be answered within 45 days.
Change set: CloudFormation's plan of what it will add, change or delete in a stack, built before it applies anything.
Check digit: A last digit calculated from the other digits, so typing mistakes can be spotted. In card numbers it comes from the Luhn algorithm, which lets DLP tell real cards from invoice numbers.
checkov: A free scanner that checks IaC templates against over a thousand security rules before deployment. It returns exit code 1 on any failure, so deploy.sh can use it as a gate.
CIDR notation: A way of writing a range of IP addresses as an address plus a slash and a number. 0.0.0.0/0 means any address on the internet, and /32 means exactly one address, such as the office's 203.0.113.10/32.
Classification levels: The steps on a company's data classification scale. Kettle & Crane uses public, internal (private), confidential (sensitive) and restricted (critical), and the rules get stricter the higher you go.
Cloud: Renting computing from a provider over the internet. The provider runs the buildings and hardware, and you give up some control and visibility in exchange.
CLOUD Act: A 2018 US law that lets US courts order a US cloud provider to hand over data it controls, even data stored abroad.
Cloud DLP: DLP that connects to cloud services through their APIs. It scans files already stored there, such as a Google Drive folder, and checks sharing settings.
CloudFormation: AWS's own Infrastructure as Code service. It builds a stack of resources from a YAML or JSON template.
CloudTrail: AWS's record of every API call in an account: who made it, from which address, when, and whether it succeeded. It answers questions such as "who made this bucket public?".
Community cloud: A cloud shared by several organizations with the same needs and rules, such as the Northwest Roasters Co-op's shared ordering portal. Members share costs and rules, but also risk.
Condition (policy): An optional part of a policy statement that makes it apply only when a test is true. The TLS-only policy's statement matches only when aws:SecureTransport is false.
Confidential computing: Running code in a protected area of the processor, a secure enclave, whose memory stays encrypted even from the server's admins. It helps protect data in use.
Controller (data controller): The organization that decides why personal data is collected and how it's used. Kettle & Crane is the controller of its customer data and stays responsible for every processor in the chain.
Crypto-shredding: Disposing of data by encrypting it with its own key and then destroying the key, so every copy becomes unreadable, even copies on cloud disks you can't reach.
CSPM (cloud security posture management): Tools that check running cloud accounts against your security rules, such as "no public storage". IaC scanning catches problems before deployment; CSPM checks what's already running.

D

Data at rest: Stored data that isn't being used right now: on a disk, in a database or bucket, or on a backup. It's protected by encryption, access control and storing less.
Data classification: Sorting data into a few levels by how much harm its loss would cause, then giving each level its own rules. Masking, DLP and retention all start from the label.
Data custodian: The person who handles data technically, following the owner's decisions: storing, encrypting, backing up and setting approved access. Alex is the custodian for almost everything at Kettle & Crane.
Data events: CloudTrail records of object-level activity, such as each GetObject read. They're off by default and turned on per bucket for the buckets that matter.
Data in transit: Data moving across a network, such as Dana's card number travelling from her browser to the shop. It's protected by encrypting the connection with TLS or a VPN.
Data in use: Data being worked on: loaded into memory, shown on screen or processed. It sits in plain form, so it's the hardest state to protect.
Data lifecycle: The stages data passes through: collected, stored, used, perhaps shared, kept, and finally disposed of. Each stage has its own privacy question.
Data localization law: A law that requires some data to stay inside one country. For example, India requires payment data to be stored in India.
Data loss prevention (DLP): Tools that inspect content against rules, such as "a card number that passes Luhn", find sensitive data where it shouldn't be, and stop it leaving. Possible actions are allow and log, warn, block or quarantine.
Data owner: The person accountable for a data set, usually a business manager rather than IT. The owner decides its classification, who may access it and how long it's kept; Sam owns the café accounts.
Data processing agreement (DPA): The written contract between a controller and a processor. It limits what the processor may do, requires security, and requires the processor to name its subprocessors and get approval before adding new ones.
Data sovereignty: The idea that data falls under the laws of the country where it's stored. Location decides who can demand access to it and which privacy rules apply.
Data steward: The person who looks after a data set's quality, meaning and correct use. Priya fixes duplicate customers and makes sure "zip" always means a five-digit zip.
Data subject: The person that personal data is about, such as Dana, whose name and address are in the customer list.
Default encryption: A bucket setting that makes S3 encrypt every new object automatically. Choosing KMS keys adds control over who may use the key, and every use is logged.
Deidentification: Removing or changing the parts of a data set that identify people, so it can be shared, as with the co-op's order history study. You remove direct identifiers and generalize quasi-identifiers, then measure the result with k-anonymity.
Direct identifier: A value that identifies a person on its own, such as a name, email address, phone number or customer ID. Deidentification removes these first.
Disposal: Making data unrecoverable when its time is up. That includes backups, old versions and processors' copies, not just deleting a row or file.
Drift: A difference between what an IaC template says and what really exists, usually caused by a change made by hand in the console. Redeploying the template won't notice it.
Dry run: A run that reports what it would do without doing it. purge.py lists the customers it would erase, and only deletes them when given --apply.

E

Encryption: Scrambling data with a key so only someone with the key can read it. It's reversible by anyone who holds the key, and it protects data at rest and in transit, but not in use.
Endpoint DLP: DLP that runs as an agent on each laptop and desktop. It sees actions such as copying to a USB stick, printing or uploading, even when the laptop is at home.
EU-US Data Privacy Framework: A 2023 arrangement that US companies can join so personal data may be transferred to them from the EU under GDPR.
Exit code: The number a program returns when it ends: 0 means success. checkov and kcplan.py return 1 on failure, so scripts, pipelines and schedulers can stop on it.
Explicit deny: A policy statement with "Effect": "Deny" that matches a request. It beats every Allow, even an admin's s3:*.

F

False negative: Sensitive data that a DLP rule misses.
False positive: A rule match on data that isn't really sensitive, such as a 16-digit invoice number flagged as a card. Too many, and staff learn to ignore DLP.

G

GDPR (General Data Protection Regulation): The EU's privacy law. It defines controllers and processors, requires consent by a clear positive action, limits transfers abroad, and gives a right to erasure that must be answered within one month.
Generalization: Replacing exact values with ranges so people are harder to pick out. For example, zip 97214 becomes 972** and birth year 1988 becomes 1980s.
Geofencing: Allowing or blocking actions based on a user's or device's location, worked out from the IP address or GPS. It's a signal, not proof, since a VPN can fake location, so pair it with MFA.
Geolocation database: A lookup table that maps IP address ranges to countries. geofence.py's COUNTRY table is a tiny stand-in for one, and real ones can be wrong.
Government classification levels: The US national-security scale: unclassified, confidential, secret and top secret. Note that "confidential" is the lowest classified level here, but a high level in many companies.

H

Hardened image: A pre-built, patched and locked-down server image. Every server autoscaling adds starts from it, because nobody checks servers added at 3 a.m.
Hashing: Turning a value into a fixed-length fingerprint that can't be reversed. The same input always gives the same hash, so the reports team can match records without seeing card numbers.
Health data: Information about a person's physical or mental health, treatment or payment for care, such as a doctor's note about Jo. It needs extra care and is labeled restricted.
HIPAA: A US law (Health Insurance Portability and Accountability Act) protecting health information held by health plans, health care providers and their business partners. Kettle & Crane isn't covered by it, but still treats health data as restricted.
HMAC (hash-based message authentication code): A hash mixed with a secret key. Without the key, an attacker can't reverse a card's HMAC by trying every possible number.
HTTPS: The web protocol HTTP, run inside a TLS-encrypted connection. A captured plain HTTP order shows the card number; a captured HTTPS one shows only encrypted bytes.
Hybrid: On-premises systems joined to a cloud, like Kettle & Crane's AWS shop reading the back-room order database over a VPN. It adds the link to secure and two sets of controls that must agree.

I

IaaS (infrastructure as a service): A cloud service model where you rent virtual servers. The provider runs the hardware and hypervisor; you patch the OS and apps.
IAM (identity and access management): The AWS service and practice of managing users, roles and their permission policies. An IAM policy can even limit reads by object tag.
Identity policy: A policy attached to a user or role that says what that identity may do. Priya's identity policy lets her read files in kc-customers.
Implicit deny: The default answer when no policy statement matches: everything starts denied. Jo was refused because nothing allowed her.
Infrastructure as Code (IaC): Describing cloud setup in files that a tool builds from, so settings can be reviewed, repeated, scanned and tracked in git. It also copies a template's mistakes everywhere the template is used.
Intellectual property (IP): Creations of the mind that a company owns: trade secrets, copyrights, trademarks and patents. Kettle & Crane's roast profiles are trade secrets.

K

k-anonymity: A measure of deidentification: every combination of quasi-identifiers must be shared by at least k people. deid.py found k = 1, meaning one customer could be picked out.
KMS (Key Management Service): AWS's key management service. Encrypting a bucket with KMS keys lets you decide who may use the key and logs every use.

L

Labeling: Marking data with its classification, as a document header, an email tag, metadata or a cloud object tag, so people and tools such as DLP know how to treat it.
Least privilege: Giving each person, service or function only the rights it needs. The thumbnail function's role can only read products/ and write thumbs/.
Legal hold: An order from lawyers to keep data for a lawsuit or investigation. It overrides deletion and erasure requests until it ends.
Lifecycle rule: An S3 setting that deletes objects automatically after a period, such as report exports after 30 days. NoncurrentVersionExpiration also removes old versions.
Luhn algorithm: The check-digit method used in card numbers: double every second digit from the right, subtract 9 from any result over 9, and the total must end in 0. DLP uses it to cut false positives.

M

Masking: Hiding part of a value with stand-in characters, such as ************1111. It can't be reversed, and it's used to show staff a hint of the value.
MDM (mobile device management): A tool that manages company phones and can, for example, lock company apps when a phone leaves the country.
MFA (multifactor authentication): A sign-in method that requires two or more different kinds of proof, such as a password plus a code from a phone. It stops attackers who have stolen only a password and is a common rule for every admin account in every cloud.
Microservices: An app split into small services, each with one job, that talk over the network. Every service and every call between them becomes a trust boundary.
Monolith: An app built and deployed as one program, like Kettle & Crane's original order system. It has one boundary to guard, the front door.
Multi-region trail: A CloudTrail trail that covers every region, so an attacker can't hide activity in a region nobody uses.
Multicloud: Using two or more public cloud providers at once, such as AWS for the shop and Google Cloud for reports. It means more consoles, identities and settings to check against one set of rules.
Mutual TLS: TLS where both sides show certificates, so each service proves its identity to the other. It's stronger than a shared token.

N

Need to know: The rule that even someone with the right clearance sees information only if their job requires it, as with top secret data.
Network DLP: DLP that inspects traffic leaving the network, usually at the web proxy and email gateway. It needs TLS inspection to read HTTPS.
Network geofencing: Geofencing that works out a country from a request's IP address using a geolocation database, then allows or blocks it. An example rule is "admins may sign in only from the US".
NIST SP 800-88: The US standard for sanitizing disks before they leave the company: clearing, purging or physical destruction, with a certificate kept for each disk.

O

Object tags: Key and value pairs attached to a cloud object, such as label=restricted and owner=hr. They carry labels and can drive access rules.
On-premises: Your own servers in your own building, like the back-room order database. You control everything and must also do everything, including patching.
Opt-in: A person must take a clear action, such as ticking an empty box, before you use their data for a purpose. Only Kim and Dana opted in to the newsletter.
Opt-out: You use the data until the person says stop. US marketing email under CAN-SPAM works this way.

P

PaaS (platform as a service): A cloud service model such as a managed database, where the provider also patches the operating system and you look after the app and data.
PCI DSS (Payment Card Industry Data Security Standard): The card industry's security standard. It applies to every system that stores, processes or sends card numbers.
PCI DSS scope: The set of systems PCI DSS applies to. Systems that hold only tokens can fall outside most of it, so tokenization reduces the scope.
Personal data: Any information about an identifiable person, such as a customer's name, address or email. Privacy laws protect it, and pseudonymized data still counts as personal data.
Policy statement: One rule inside an AWS policy: its Effect (Allow or Deny), the Actions it covers (such as s3:GetObject) and the Resources it applies to. Writing one narrow statement per job keeps a role to least privilege.
Principal: The field in a resource policy that names who the statement is about. "*" means everyone.
Processor: An organization that handles personal data on a controller's behalf, only as instructed. PostPigeon is a processor for Kettle & Crane's newsletter.
Proxy: A server that makes requests on a client's behalf, so it sees everything going out. dlp_proxy.py blocks uploads containing card numbers.
Pseudonymization: Replacing identifiers with consistent stand-ins, such as an HMAC, so records stay linked to each other but not to a name. Whoever holds the key can trace them back, so it's still personal data.

Q

Quarantine: A DLP action that moves a file to a safe place for review. It's used for files found at rest in the wrong place.
Quasi-identifier: A value that identifies people in combination with others, such as zip code, birth year and gender. Deidentification generalizes these.

R

Rate limit: A cap on how many requests a caller may make in a period. The API gateway enforces it.
Region: A cloud provider's group of data centers in one area, such as us-west-2 (Oregon). Choosing regions decides which country's laws apply to the data.
Regulated data: Data whose rules come from laws or contracts, such as customers' personal information and card numbers under PCI DSS.
Resource policy: A policy attached to the thing being reached, saying who may do what to it. A bucket policy is S3's resource policy.
Retention: How long data is kept. Keeping it too short breaks laws, and keeping it too long adds risk and breaks privacy rules.
Retention policy: A written rule setting the minimum and maximum time to keep each kind of data. At Kettle & Crane, orders are kept 7 years, customer accounts 3 years after the last order, and exports 30 days.
Retention requirement: A minimum keeping period set by law, regulation or contract. The IRS asks businesses to keep tax records for three years, and some for up to seven, so Kettle & Crane keeps order records for seven years.
Right to be forgotten: A person's right to have their personal data deleted everywhere, including processors' copies. Records that other laws require are kept with the person removed, as forget.py does for Lee.
Role: An AWS identity that servers and functions take on, getting temporary credentials and their own minimal policy. Each one gets its own role instead of a shared password.

S

S3 (Simple Storage Service): AWS's object storage service, which keeps files in buckets. aws s3 and aws s3api commands manage it.
SaaS (software as a service): A cloud service model where the provider runs the whole app, such as Microsoft 365. Data and access are still the customer's job.
Scalability: A system's ability to handle more work by adding resources, either scaling up or scaling out. Each added server must start safe and ship its logs out.
Secure enclave: A protected area of the processor whose memory stays encrypted even from the server's admins. Confidential computing runs code there.
Security group: An AWS virtual firewall made of allow rules for incoming traffic, such as the shop-web group allowing HTTPS from anywhere.
Serverless: Running code without managing servers: the provider runs everything, and your function runs when an event arrives. You still own the code's libraries, its role and input validation.
Service control policy: A policy attached through AWS Organizations to many accounts at once. For example, it can deny every request outside the allowed regions, even an admin's.
Shared responsibility model: The split of security work between cloud provider and customer: the provider takes layers from the bottom up, but data and who may access it always stay the customer's job.
Sovereign cloud: A cloud region run separately within one jurisdiction to limit foreign legal reach. An example is AWS's European Sovereign Cloud in Germany, run by EU residents.
Stack: The set of resources CloudFormation builds from a template as one unit, such as the stack named shop.
Structured data: Data with a fixed layout of rows and named columns, such as a database table or customers.csv. You know exactly where the sensitive column is.
Subprocessor: A company a processor hires to help process the data. AWS and SnapSMS are subprocessors for PostPigeon.

T

Template: The YAML or JSON file that lists the resources CloudFormation should build, such as shop.yaml.
Temporary credentials: Short-lived access keys given through a role, used instead of long-lived passwords baked into server images.
Terraform: A popular Infrastructure as Code tool with its own language, working across many clouds.
Timing attack: Working out a secret by measuring how long a system takes to answer each guess. Comparing tokens with hmac.compare_digest, which always takes the same time, stops it.
TLS (Transport Layer Security): The protocol that encrypts connections, and the one under HTTPS. The TLS-only bucket policy refuses any request without it.
TLS inspection: A proxy decrypting HTTPS traffic so network DLP can read what's being sent.
Token: A random stand-in for a sensitive value, such as tok_3d8e3195e7ae0135 for a card. It has no mathematical link to the original.
Token vault: The separate, well-guarded store that maps tokens back to real values. Only the vault can detokenize.
Tokenization: Replacing a value with a random token and keeping the original in a vault. Stolen tokens are worthless, and PCI DSS scope shrinks.
Top secret: The highest US government classification: information whose disclosure could cause exceptionally grave damage to national security. It needs a clearance and a need to know.
Trade secret: Business information that's valuable because it's kept secret, like Kettle & Crane's roast profiles. Once leaked, the protection can be lost forever.
Trail: A CloudTrail setting that sends API records to a bucket. Its log bucket needs the strongest protection, because attackers often try to delete the trail.
Transfer rules: Rules that let data leave a country only under conditions. For example, GDPR allows transfers only to adequate countries or under approved contracts.
Trust boundary: A line where a request passes from a less trusted place into a more trusted one. At each boundary, check who is calling and whether what they sent is safe.

U

Unstructured data: Data with no fixed layout, such as emails, documents, chats and scans. A card number can hide anywhere in it, as in support-ticket.txt.

V

Versioning: An S3 setting that keeps old copies of every file. It protects against mistakes, but deleted data lives on until old versions expire too.
Virtual machine (VM): A software computer running on a real one. Every lab runs in a throwaway Ubuntu VM called datalab.
VPN (virtual private network): An encrypted link across the internet, such as the one joining the AWS shop to the back-room database. It can also make a user appear to be in another country, fooling geofencing.

W

Weighted decision matrix: A way to compare options: give each criterion a weight, score each option, multiply, and add. choose.py found community cloud narrowly ahead at 31.
Wildcard: A * in a policy that matches anything, so s3:* covers every S3 action and "Resource": "*" covers every resource. Least privilege means no wildcards you can't explain.

Y

YAML: A text format that uses indentation (spaces only, never tabs) to show structure. CloudFormation templates such as shop.yaml are written in it.

Z

Zero trust: Never trusting a call just because it comes from inside. The payments service still checks every caller, even the catalog service.