CCSK_glossary

Module 1
	Internet of Things
		Internet of Things is a blanket term for non-traditional computing devices used in the physical world that utilize Internet connectivity. It includes everything from Internet-enabled operational technology (used by utilities like power and water) to fitness trackers, connected light bulbs, medical devices, and beyond.
	Cloud Computing
		Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
	Resource Pools
		Resources pools are how we build clouds. They are a collection of physical resources that are pooled together so a consumer of the cloud can pull resources from the pool, use them while they need them, and put them back in the pool for someone else to use them over time.
	Broad Network Access
		All resources are available over a network, without any need for direct physical access; the network is not necessarily part of the service.
	Rapid Elasticity
		Allows consumers to expand or contract the resources they use from the pool (provisioning and deprovisioning), often completely automatically. This allows them to more closely match resource consumption with demand (for example, adding virtual servers as demand increases, then shutting them down when demand drops).
	Measured Service
		meters what is provided, to ensure that consumers only use what they are allotted, and, if necessary, to charge them for it. This is where the term utility computing comes from, since computing resources can now be consumed like water and electricity, with the client only paying for what they use.
	Abstraction
		Also known as virtualization, abstraction separates resources from their underlying structure, allowing creation of resource pools from those underlying assets.
	Automation
		Also known as orchestration, allows rapidly provisioning and deprovisioning of resources from the resource pool.
	Multitenancy
		An emergent property of resource pooling that requires strong segregation and isolation.
	Governance
		The overall management model of the cloud, including contracts, service levels and policies.
	Isolation
		The concept that one segment of consumers in the cloud should not ever see anything running in another segment. A core control that allows for multiple tenants to safely share resource pools.
	Segmentation
		How the provider divides the cloud among different tenants.
	Infrastructure as a Service (IaaS)
		The most foundational of the service models, provides resource pools of virtualized infrastructure such as compute, network, or storage pools. Includes facilities, hardware, abstraction, core connectivity and delivery, and APIs.
	Software as a Service (SaaS)
		Fully abstracts everything except the application itself. Cloud consumers use the application but have no insight or management of the underlying resources. Consumers access it with a web browser, mobile app, or a lightweight client app.
	Platform as a Service (PaaS)
		Abstracts and provides development or application platforms, such as databases, application platforms (e.g. a place to run Python, PHP, or other code), file storage and collaboration, or even proprietary application processing (such as machine learning, big data processing, or direct Application Programming Interfaces (API) access to features of a full SaaS application). The key differentiator is that, with PaaS, you don’t manage the underlying servers, networks, or other infrastructure.
	Application Programming Interfaces (APIs)
		APIs are typically the underlying communications method for components within a cloud, some of which (or an entirely different set) are exposed to the cloud user to manage their resources and configurations. Most cloud APIs these days use REST (Representational State Transfer), which runs over the HTTP protocol, making it extremely well suited for Internet services.
	Cloud Deployment Models
		Deployment models describe how the cloud is offered to customers.
		Public Cloud: Open to anyone who signs up for the service, so cloud provider is responsible for keeping consumers isolated. You are only responsible for what you deploy in the cloud.
		Private Cloud: Reserved for trusted users, operated for a single organization on- or off-premises. You are responsible for securing all the hardware and software that makes up the cloud platform.
		Hybrid Cloud: Connects on-premises resources to a public cloud deployment. A combination of two or more clouds that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability.
		Community Cloud: The cloud infrastructure that is made available to the general public or a large industry group and owned by the organization selling cloud services.
	Logical Model
		Another way of thinking about IT assets. Includes the following areas:
		Infrastructure: The foundation and core components of a computing system (compute, network, and storage).
		Metastructure: The protocols and mechanisms that provide the interface between the infrastructure layer and the other layers.
		Applistructure: Data and information; the database content.
		Infostructure: The applications deployed in the cloud and the underlying services used to build them.
	Shared Responsibilities Model
		The heart of cloud security; where the responsibilities between cloud providers and consumers are determined. Responsibilities are not always set in stone, but this is the typical way responsibilities are delegated:
		Provider: responsible for physical infrastructure, virtualization/abstraction, and application and PaaS services.
		Consumer: responsible for host/server security, network, IAM, and metastructure configuration security, data and application security.
	Management Plane / Metastructure
		Interface between provider and consumer in the shared responsibilities model. How you access and control your cloud, provision and configure resources, start/stop/terminate services. Can access via web console or REST-/web-based APIs.

Module 2
	Virtual Networks
		Most common types include:
		VLAN: Virtual LAN, leverages existing technologies in all networks to segregate (not isolate) networks in single-tenant environments. Not effective as a security barrier.
		Software-Defined Networks (SDNs): Preferred networks, they provide better isolation and security; they decouple the control plane from the underlying physical network and offer more flexibility.
	Software Defined Networking (SDN)
		A more complete abstraction layer on top of networking hardware, SDNs decouple the network control plane from the data plane. This allows us to abstract networking from the traditional limitations of a LAN.
	Security Groups
		Common name for firewalling built into SDNs, security groups provide ability to manage the network firewall with the granularity of a host firewall. It is policy-based, typically default-deny, integrated in core SDN logic, and applied on a per-asset level.
	Bastion Virtual Network
		A bastion virtual network is a special purpose computer on a network specifically designed and configured to withstand attacks.
	Transit Virtual Private Cloud (VPC)
		Connects multiple, geographically disperse VPCs and remote networks in order to create a global network transit center. Simplifies network management and minimizes the number of connections required to connect multiple VPCs and remote networks.
	Software-Defined Perimeter (SDP)
		A model and specification that combines device and user authentication to dynamically provision network access to resources and enhance security. SDP includes three components:
		An SDP client on the connecting asset (e.g. a laptop).
		The SDP controller for authenticating and authorizing SDP clients and configuring the connections to SDP gateways.
		The SDP gateway for terminating SDP client network traffic and enforcing policies in communication with the SDP controller.
	Workload
		A unit of processing, which can be in a virtual machine, a container, or other abstraction. Workloads always run somewhere on a processor and consume memory. Workloads include a very diverse range of processing tasks, which range from traditional applications running in a virtual machine on a standard operating system, to GPU- or FPGA-based specialized tasks. Nearly every one of these options is supported in some form in cloud computing.
	Immutable Workloads
		Immutable infrastructure is an approach to managing services and software deployments on IT resources wherein components are replaced rather than changed. An application or services is effectively redeployed each time any change occurs. This is the preferred workload when possible.
	Virtual Machine
		Virtual machines are the most-well known form of compute abstraction, and are offered by all IaaS providers. They are commonly called instances in cloud computing since they are created (or cloned) off a base image.
	Containers
		Containers are code execution environments that run within an operating system (for now), sharing and leveraging resources of that operating system. It is a constrained place to run segregated processes while still utilizing the kernel and other capabilities of the base OS. Multiple containers can run on the same virtual machine or be implemented without the use of VMs at all and run directly on hardware.
	Platform-Based Workloads
		These are workloads running on a shared platform that aren’t virtual machines or containers, such as logic/procedures running on a shared database platform.
	Serverless
		Any situation where the cloud user doesn’t manage any of the underlying hardware or virtual machines, and just accesses exposed functions. Serverless covers containers and platform-based workloads, where the cloud provider manages all the underlying layers, including foundational security functions and controls.
	Business Continuity / Disaster Recovery (BC/DR)
		Should cover the entire stack of the logical model. Three aspects of BC/DR in the cloud:
		Ensuring continuity and recovery within a given cloud provider.
		Preparing for and managing cloud provider outages.
		Considering options for portability, in case you need to migrate providers or platforms.

Module 3
	Information/Data Governance
		Ensuring the use of data and information complies with organizational policies, standards and strategy — including regulatory, contractual, and business objectives.
	Enterprise Risk Management
		Measuring, managing, and mitigating uncertainty. Rooted in providing value to stakeholders.
	Information Risk Management
		A subset of enterprise risk management, aligns risk management to the tolerance of the data owner.
	Service Level Agreement (SLA)
		A service level agreement is a commitment between a service provider and a client. Particular aspects of the service – quality, availability, responsibilities – are agreed between the service provider and the service user. The most common component of SLA is that the services should be provided to the customer as agreed upon in the contract.
	Compliance
		Validates awareness of and adherence to corporate obligations (e.g., corporate social responsibility, ethics, applicable laws, regulations, contracts, strategies and policies). The compliance process assesses the state of that awareness and adherence, further assessing the risks and potential costs of non-compliance against the costs to achieve compliance, and hence prioritize, fund, and initiate any corrective actions deemed necessary.
	Audit
		How we validate compliance, can be performed internally or externally using third parties.
	Compliance Inheritance
		If a cloud provider’s service is compliant with a regulation/standard, cloud consumers can build compliant services/applications using that service, but doesn’t guarantee compliance of end-service/application.
	Compliance Management
		A tool of governance; it is how an organization assesses, remediates, and proves it is meeting these internal and external obligations.
	Attestation
		A legal statement that may require an NDA before being released; a third-party audit firm determines legal compliance and creates this statement.
	Artifacts
		The logs, documentation, and other materials needed for audits and compliance; they are the evidence to support compliance activities. Both providers and customers have responsibilities for producing and managing their respective artifacts.
	Cloud Controls Matrix (CCM)
		A list of security controls mapped by domain and aligned to various regulatory frameworks.
	Consensus Assessments Initiative Questionnaire (CAIQ)
		A standard set of security questions for cloud providers, allowing cloud consumers to directly compare providers, and allowing providers to reduce the need to respond to non-standard RFPs.
	STAR Registry
		The CSA STAR Registry documents the security and privacy controls provided by popular cloud computing offerings. This publicly accessible registry is designed for users of cloud services to assess their cloud providers, security providers and advisory and assessment services firms in order to make the best procurement decisions.
	STARWatch
		STARWatch is a SaaS application to help organizations manage compliance with CSA STAR (Security, Trust and Assurance Registry) requirements. STARWatch delivers the content of the Cloud Controls Matrix (CCM) and Consensus Assessments Initiative Questionnaire (CAIQ) in a database format, enabling users to manage compliance of cloud services with CSA best practices.

Module 4
	Cloud Data Storage
		May look like traditional storage, but it is actually quite different:
		Volume: Virtual hard drives for virtual machines or instances.
		Object: Resilient file storage via API. “Database” for files.
		Database: Multitenant, includes relational and non-relational.
		Applications: May store files using a wide range of techniques the cloud consumer has no insight into.
	Cloud Access and Security Broker (CASB)
		Also known as security gateways, CASBs discover internal use of cloud services using various mechanisms such as network monitoring, integrating with an existing network gateway or monitoring tool, or even by monitoring DNS queries. After discovering which services your users are connecting to, most of these products then offer monitoring of activity on approved services through API connections (when available) or inline interception (man in the middle monitoring). Many support DLP and other security alerting and even offer controls to better manage use of sensitive data in cloud services (SaaS/PaaS/and IaaS).
	Data Loss Prevention (DLP)
		A way to monitor and protect data that your employees access via monitoring local systems, web, email, and other traffic. It is not typically used within data centers, and thus is more applicable to SaaS than PaaS or IaaS, where it is typically not deployed.
	URL Filtering
		While not as robust as CASB, a URL filter/web gateway may help you understand which cloud services your users are using (or trying to use).
	Data Dispersion (Bit Splitting)
		This process takes chunks of data, breaks them up, and then stores multiple copies on different physical storage to provide high durability. Data stored in this way is thus physically dispersed. A single file, for example, would not be located on a single hard drive.
	Access Controls
		One of the core data security controls across the various technologies, access controls should be implemented with a minimum of three layers: the management plane, public and internal sharing controls, and application-level controls.
	Entitlement Matrix
		Documents which users, groups, and roles should access which resources and functions, and what they can do with them.
	Encryption
		Protects data by applying a mathematical algorithm that “scrambles” the data, which then can only be recovered by running it through an unscrambling (decryption) process with a corresponding key. The result is a blob of ciphertext.
	Tokenization
		Takes the data and replaces it with a random value. It then stores the original and the randomized version in a secure database for later recovery.
	Encryption System
		There are three components of an encryption system: data (the information you’re encrypting), the encryption engine (what performs the mathematical process of encryption), and key management (handles the keys for the encryption). You always want to separate the encryption key from the data and the encryption engine whenever possible.
	Transparent Database Encryption (TDE)
		A technology employed by Microsoft, IBM and Oracle to encrypt database files. TDE offers encryption at file level. TDE solves the problem of protecting data at rest, encrypting databases both on the hard drive and consequently on backup media.
	Key Management
		How keys are handled for encryption. The main considerations are performance, accessibility, latency, and security. Cloud key management options include provider managed, 3rd-party/customer managed, customer key managed, and hardware security modules (HSM).
	Customer-Managed Keys
		Also known as Bring Your Own Key (BYOK), this allows a cloud customer to manage their own encryption key while the provider manages the encryption engine.
	Hardware Security Module (HSM)
		A physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. These modules traditionally come in the form of a plug-in card or an external device that attaches directly to a computer or network server.
	Enterprise Rights Management (ERM) / Digital Rights Management (DRM)
		Technologies that protect sensitive information from unauthorized access. Traditional DRM/ERM isn’t necessarily useful for cloud, but some SaaS/PaaS services may have “DRM-like” capabilities such as sharing or view controls that provide similar protections.
	Data Masking
		A method of creating a structurally similar but inauthentic version of an organization's data that can be used for purposes such as software testing and user training. The purpose is to protect the actual data while having a functional substitute for occasions when the real data is not required. Critical for test data generation and to ensure production data is not exposed in development environments.
	Data Security Lifecycle
		A tool to help model your security controls and see where data flows, how it can be used, and how it should be used. When you can do something that shouldn’t be allowed, that’s where you need to insert the control. Phases include Create, Store, Use, Share, Archive, and Destroy, but data will bounce between all the phases as it is used.

Module 5
	DevOps
		The deeper integration of development and operations teams through better collaboration and communications, with a heavy focus on automating application deployment and infrastructure operations. There are multiple definitions, but the overall idea consists of a culture, philosophy, processes, and tools.
	Secure Software Development Cycle (SSDLC)
		A structured process for ensuring security needs are met throughout application development processes.
	Continuous Integration and Continuous Delivery (CI/CD)
		CI/CD embodies a culture, set of operating principles, and collection of practices that enable application development teams to deliver code changes more frequently and reliably. The implementation is also known as the CI/CD pipeline and is one of the best practices for devops teams to implement.
	Standard Application Security Testing (SAST)
		On top of the normal range of tests, these should ideally incorporate checks on API calls to the cloud service. They should also look for any static embedded credentials for those API calls, which is a growing problem.
	Dynamic Application Security Testing (DAST)
		DAST tests running applications and includes tests such as web vulnerability testing and fuzzing. Due to the terms of service with the cloud provider, DAST may be limited and/or require pre-testing permission from the provider.
	Change Management (CM)
		In cloud, CM Includes not only the application, but infrastructure and the cloud management plane.
	Web Application Firewall (WAF)
		Typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others. A WAF usually is part of a suite of tools, which together can create a holistic defense against a range of attack vectors.
	Function as a Service (FaaS)
		A category of cloud computing services that provides a platform allowing customers to develop, run, and manage application functionalities without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app.
	Secure Design & Development
		Consists of five phases: training, define, design, develop, and test.
	Threat Modeling
		Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege
	Functional Testing
		A type of software testing in which the system is tested against the functional requirements/specifications. Functions are tested by feeding them input and examining the output. Functional testing ensures that the requirements are properly satisfied by the application.
	Non-Functional Testing
		Non-functional testing is defined as a type of software testing to check non-functional aspects (performance, usability, reliability, etc) of a software application. It is designed to test the readiness of a system as per nonfunctional parameters which are never addressed by functional testing.
	Static Analysis
		Also called static code analysis, static analysis is a method of computer program debugging that is done by examining the code without executing the program. The process provides an understanding of the code structure, and can help to ensure that the code adheres to industry standards. In static analysis testing, you should have an understanding of cloud API calls.
	Dynamic Analysis (Fuzzing)
		Fuzz testing, or Fuzzing, is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.
	Vulnerability Scanning
		An inspection of the potential points of exploit on a computer or network to identify security holes. A vulnerability scan detects and classifies system weaknesses in computers, networks and communications equipment and predicts the effectiveness of countermeasures.
	Vulnerability Assessment
		The process of defining, identifying, classifying and prioritizing vulnerabilities in computer systems, applications and network infrastructures and providing the organization doing the assessment with the necessary knowledge, awareness and risk background to understand the threats to its environment and react appropriately. New vulnerability analysis options, such as scanning in a deployment pipeline or using host-based agents, are often better used for cloud.
	Penetration Testing
		Also called pen testing or ethical hacking, is the practice of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. CSA recommends adapting penetration testing for cloud using the following guidelines:
		Use a testing firm that has experience on the cloud provider where the application is deployed.
		Include developers and cloud administrators within the scope of the test. Many cloud breaches attack those who maintain the cloud, not the application on the cloud itself. This includes the cloud management plane.
		If the application is a multitenant app, then allow the penetration testers authorized access as a tenant to see if they can compromise the tenancy isolation and use their access to break into another tenant’s environment or data.
	Unit Testing
		A level of software testing where individual units/ components of a software are tested. The purpose is to validate that each unit of the software performs as designed. A unit is the smallest testable part of any software. It usually has one or a few inputs and usually a single output.
	Regression Testing
		The process of testing changes to computer programs to make sure that the older programming still works with the new changes. Regression testing is a normal part of the program development process and, in larger companies, is done by code testing specialists.
	Version Control Repository
		Single source for your code, logs changes and merges additions. Ex: GitHub is a version control repository.
	Configuration Integration Server
		Monitors your version control repository and when it detects changes in the files, it can launch a series of tests that includes building an entire environment before building your code, and then build the artifacts and compile app code and run testing.
	Realtime Application Security Protection (RASP)
		Realtime application security protection is a security technology that uses runtime instrumentation to detect and block computer attacks by taking advantage of information from inside the running software.
	Software Defined Security (SDS)
		Security automated with APIs and code. A type of security model in which the information security in a computing environment is implemented, controlled and managed by security software. SDS is a software-managed, policy-driven and governed security where most of the security controls such as intrusion detection, network segmentation and access controls are automated and monitored through software.
	Event-Driven Security
		Events in the cloud trigger execution of security code. Certain cloud providers support event-driven code execution. In these cases, the management plane detects various activities—such as a file being uploaded to a designated object storage location or a configuration change to the network or identity management—which can in turn trigger code execution through a notification message, or via serverless hosted code. Security can define events for security actions and use the event-driven capabilities to trigger automated notification, assessment, remediation, or other security processes.
	Air Gap
		An air gap is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It means a computer or network that is electrically disconnected (with a conceptual air gap) from all other networks.
	Identity and Access Management (IAM)
		IAM, at its core, is concerned with mapping some form of an entity (a person, system, piece of code, etc.) to a verifiable identity associated with various attributes (which can change based on current circumstances), and then making a decision on what they can or can’t do based on entitlements.
	Entity
		Discrete types that will have Identity; these are to Users, Devices, Code, Organizations and Agents.
	Identity
		The unique expression of an entity within a given namespace.
	Identifier
		The means by which an Identity can asserted, usually using crypto tokens for digital identities.
	Attributes
		Facets of an identity (e.g., org. unit or IP address).
	Persona
		Expression of an identity with attributes that indicates context. E.g., a developer logged into a given project.
	Role
		Has multiple meanings. Typically used to indicate a persona or subset. E.g., “developer” vs. “admin”.
	Authentication
		The process of confirming an identity. Authn
	Multifactor Authentication
		Use of multiple factors in authentication (e.g., username + password + token).
	Access Control
		Restricting access to a resource, Access management is the corresponding process.
	Authoritative Source
		The "root" source for an identity, such as a directory server.
	Authorization
		Allowing an identity access. Authz
	Entitlement
		Mapping an identity to an authorization.
	Federated Identity Management
		The process of asserting an identity across different systems.
	Identity Provider
		The trusted source of the identity in federation.
	Relying Party
		The system that relies on an identity assertion from an identity provider.
	Security Assertion Markup Language (SAML)
		Security Assertion Markup Language (SAML) is a standard protocol for web browser Single Sign-On (SSO) using secure tokens. SAML completely eliminates all passwords and instead uses standard cryptography and digital signatures to pass a secure sign-in token from an identity provider to a SaaS application. Supported by nearly all cloud providers, it is the most common way of communicating authentication and authorization in two parties in federated identity.
	Open Authorization (OAuth)
		OAuth is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords. This mechanism is used by companies such as Amazon, Google, Facebook, Microsoft and Twitter to permit the users to share information about their accounts with third party applications or websites.
	OAuth 2.0
		OAuth 2.0 provides specific authorization flows for web applications, desktop applications, mobile phones, and smart devices. The specification and associated RFCs are developed by the IETF OAuth WG; the main framework was published in October 2012.
	OpenID
		OpenID is an open standard and decentralized authentication protocol. Promoted by the non-profit OpenID Foundation, it allows users to be authenticated by co-operating sites (known as relying parties, or RP) using a third-party service, eliminating the need for webmasters to provide their own ad hoc login systems, and allowing users to log into multiple unrelated websites without having to have a separate identity and password for each.
	eXtensible Access Control Markup Language (XACML)
		Not as common a form of identity management. The standard defines a declarative fine-grained, attribute-based access control policy language, an architecture, and a processing model describing how to evaluate access requests according to the rules defined in policies.
	System for Cross-Domain Identity Management (SCIM)
		Not as common a form of identity management. SCIM is a standard for automating the exchange of user identity information between identity domains, or IT systems.
	“Free Form” Model
		Internal identity providers/sources (often directory servers) connect directly to cloud providers.
	“Hub & Spoke” Model
		Internal identity providers/sources communicate with a central broker or repository that then serves as the identity provider for federation to cloud providers.
	Identity Providers
		Identity providers don’t need to be located only on-premises; many cloud providers now support cloud-based directory servers that support federation internally and with other cloud services.
	Identity Brokers
		Identity brokers handle federating between identity providers and relying parties (which may not always be a cloud service). They can be located on the network edge or even in the cloud in order to enable web-SSO.
	Incident Response
		An organized approach to addressing and managing the aftermath of a security breach or cyberattack, also known as an IT incident, computer incident or security incident. The goal is to handle the situation in a way that limits damage and reduces recovery time and costs.
	Provisioning
		Provisioning is the process of coordinating the creation of user accounts, e-mail authorizations in the form of rules and roles, and other tasks such as provisioning of physical resources associated with enabling new users.
	Deprovisioning
		Deprovisioning involves deactivating user accounts, email authorizations, and other tasks such as deprovisioning of physical resources associated with disabling new users.
	Role-Based Access Controls (RBAC)
		RBAC is an approach to restricting system access to authorized users. It is used by the majority of enterprises with more than 500 employees, and can implement mandatory access control (MAC) or discretionary access control (DAC).
	Attribute-Based Access Controls (ABAC)
		Also known as policy-based access control, defines an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together. The policies can use any type of attributes (user attributes, resource attributes, object, environment attributes, etc.). This is the best model for cloud when comparing to RBAC, as it is far more granular and flexible.

Module 6
	Security as a Service (SecaaS)
		SecaaS providers secure systems and data in the cloud as well as hybrid and traditional enterprise networks via cloud-based services. This includes dedicated SecaaS providers, as well as packaged security features from general cloud-computing providers. Security as a Service encompasses a very wide range of possible technologies, but they must meet the following criteria:
		SecaaS includes security products or services that are delivered as a cloud service.
		To be considered SecaaS, the services must still meet the essential NIST characteristics for cloud computing, as defined in Domain 1.
	Autoscaling
		Autoscaling is a method used in cloud computing, whereby the amount of computational resources in a server farm, typically measured in terms of the number of active servers, scales automatically based on the load on the farm. It is closely related to, and builds upon, the idea of load balancing.
	Patch Management
		Patch management is a strategy for managing patches or upgrades for software applications and technologies. A patch management plan can help a business or organization handle these changes efficiently.
	Web Security Gateways
		Web security gateways involves real-time protection, offered either on-premises through software and/or appliance installation, or via the Cloud by proxying or redirecting web traffic to the cloud provider (or a hybrid of both).
	Security Information and Event Management (SIEM)
		SIEM systems aggregate (via push or pull mechanisms) log and event data from virtual and real networks, applications, and systems. This information is then correlated and analyzed to provide real-time reporting on and alerting of information or events that may require intervention or other types of responses. Cloud SIEMs collect this data in a cloud service, as opposed to a customer-managed, on-premises system.
	Intrusion Detection/Prevention (IDS/IPS)
		IDS/IPS systems monitor behavior patterns using rule-based, heuristic, or behavioral models to detect anomalies in activity which might present risks to the enterprise. With IDS/IPS as a service, the information feeds into a service-provider’s managed platform, as opposed to the customer being responsible for analyzing events themselves.
	Big Data
		Big data includes a collection of technologies for working with extremely large datasets that traditional data-processing tools are unable to manage. It’s not any single technology but rather refers commonly to distributed collection, storage, and data-processing frameworks.
	High Volume
		A large size of data, in terms of number of records or attributes.
	High Velocity
		Fast generation and processing of data, i.e., real-time or stream data.
	High Variety
		Structured, semi-structured, or unstructured data.
	Distributed Data Collection
		Mechanisms to ingest large volumes of data, often of a streaming nature. This could be as “lightweight” as web-click streaming analytics and as complex as highly distributed scientific imaging or sensor data. Not all big data relies on distributed or streaming data collection, but it is a core big data technology.
	Distributed Storage
	The ability to store the large data sets in distributed file systems (such as Google File System, Hadoop Distributed File System, etc.) or databases (often NoSQL), which is often required due to the limitations of non-distributed storage technologies.
	Distributed Processing
		Tools capable of distributing processing jobs (such as mapreduce, spark, etc.) for the effective analysis of data sets so massive and rapidly changing that single origin processing can’t effectively handle them.
	Internet of Things
		Internet of Things is a blanket term for non-traditional computing devices used in the physical world that utilize Internet connectivity. It includes everything from Internet-enabled operational technology (used by utilities like power and water) to fitness trackers, connected light bulbs, medical devices, and beyond.