CCSP Certified Cloud Security Professional Official Study Guide

(ISC)2® CCSP® Certified Cloud Security Professional: Official Study Guide......Page 3
Acknowledgments......Page 7
About the Author......Page 9
About the Technical Editor......Page 11
Contents at a Glance......Page 13
Contents......Page 15
Introduction......Page 23
Assessment Test......Page 30
Answers to Assessment Test......Page 36
Chapter 1 Architectural Concepts......Page 41
 Cloud Characteristics......Page 42
 Business Requirements......Page 44
  Existing State......Page 45
  Quantifying Benefits and Opportunity Cost......Page 46
  Intended Impact......Page 48
  New Technology, New Options......Page 49
  Cloud Computing Service Models......Page 50
  Cloud Deployment Models......Page 52
 Cloud Computing Roles and Responsibilities......Page 53
 Cloud Computing Definitions......Page 54
  Encryption......Page 56
  Cloud Service Provider Contracts......Page 57
 Related and Emerging Technologies......Page 58
 Exam Essentials......Page 59
 Written Labs......Page 60
 Review Questions......Page 61
Chapter 2 Design Requirements......Page 65
  Inventory of Assets......Page 66
  Determination of Criticality......Page 67
  Risk Appetite......Page 69
 Security Considerations for Different Cloud Categories......Page 71
  SaaS Considerations......Page 72
  Hardening Devices......Page 73
  Layered Defenses......Page 75
 Summary......Page 76
 Written Labs......Page 77
 Review Questions......Page 78
Chapter 3 Data Classification......Page 83
  Data Ownership......Page 85
  The Data Lifecycle......Page 86
  Data Discovery Methods......Page 90
 Jurisdictional Requirements......Page 91
  Intellectual Property Protections......Page 93
  IRM Tool Traits......Page 97
 Data Control......Page 99
  Data Retention......Page 100
  Data Audit......Page 101
  Data Destruction/Disposal......Page 103
 Exam Essentials......Page 105
 Written Labs......Page 106
 Review Questions......Page 107
Chapter 4 Cloud Data Security......Page 111
 Cloud Data Lifecycle......Page 113
  Create......Page 114
  Share......Page 115
  Archive......Page 116
  Destroy......Page 117
  Object-Based Storage......Page 118
  Encryption......Page 119
  Masking, Obfuscation, Anonymization, and Tokenization......Page 121
  Security Information and Event Management......Page 124
  Egress Monitoring (DLP)......Page 125
 Exam Essentials......Page 126
 Written Labs......Page 127
 Review Questions......Page 128
Chapter 5 Security in the Cloud......Page 133
 Shared Cloud Platform Risks and Responsibilities......Page 135
 Cloud Computing Risks by Deployment Model......Page 137
  Community Cloud......Page 138
  Public Cloud......Page 140
  Infrastructure as a Service (IaaS)......Page 144
  Platform as a Service (PaaS)......Page 145
 Virtualization......Page 146
  Threats......Page 147
  Countermeasure Methodology......Page 149
  Cloud-Specific BIA Concerns......Page 152
  Customer/Provider Shared BC/DR Responsibilities......Page 153
 Exam Essentials......Page 156
 Written Labs......Page 157
 Review Questions......Page 158
Chapter 6 Responsibilities in the Cloud......Page 163
 Foundations of Managed Services......Page 166
  Business Requirements: The Cloud Provider Perspective......Page 167
  SaaS......Page 173
 Operating System Baseline Configuration and Management......Page 174
 Shared Responsibilities: Data Access......Page 176
 Lack of Physical Access......Page 177
  Audits......Page 178
  Shared Monitoring and Testing......Page 182
 Exam Essentials......Page 183
 Written Labs......Page 184
 Review Questions......Page 185
Chapter 7 Cloud Application Security......Page 189
 Training and Awareness......Page 191
  Common Cloud Application Deployment Pitfalls......Page 194
 Cloud-Secure Software Development Lifecycle (SDLC)......Page 196
  Configuration Management for the SDLC......Page 197
 ISO/IEC 27034-1 Standards for Secure Application Development......Page 198
 Identity and Access Management (IAM)......Page 199
  Identity Repositories and Directory Services......Page 200
  Federated Identity Management......Page 201
  Multifactor Authentication......Page 202
  Supplemental Security Components......Page 203
  Application Programming Interfaces......Page 204
  Cryptography......Page 205
  Sandboxing......Page 206
  Threat Modeling......Page 207
  Quality of Service......Page 209
  Software Security Testing......Page 210
  Securing Open-Source Software......Page 212
  Application Orchestration......Page 213
  The Secure Network Environment......Page 214
 Exam Essentials......Page 215
 Written Labs......Page 216
 Review Questions......Page 217
Chapter 8 Operations Elements......Page 221
 Physical/Logical Operations......Page 223
  Facilities and Redundancy......Page 224
  Virtualization Operations......Page 234
  Storage Operations......Page 236
  Physical and Logical Isolation......Page 239
  Application Testing Methods......Page 240
  Continuous Monitoring......Page 241
  Incident Management......Page 242
 Summary......Page 243
 Written Labs......Page 244
 Review Questions......Page 245
Chapter 9 Operations Management......Page 249
  Monitoring......Page 251
  Maintenance......Page 253
 Change and Configuration Management (CM)......Page 257
  Deviations and Exceptions......Page 258
  Roles and Process......Page 259
  Release Management......Page 261
 IT Service Management and Continual Service Improvement......Page 262
 Business Continuity and Disaster Recovery (BC/DR)......Page 263
  Primary Focus......Page 264
  The BC/DR Plan......Page 265
  The BC/DR Kit......Page 267
  Relocation......Page 268
  Power......Page 269
  Testing......Page 270
 Exam Essentials......Page 271
 Written Labs......Page 272
 Review Questions......Page 273
Chapter 10 Legal and Compliance Part 1......Page 277
  Legal Concepts......Page 279
  US Laws......Page 282
  Laws, Frameworks, and Standards Around the World......Page 286
  Information Security Management Systems (ISMSs)......Page 292
 Potential Personal and Data Privacy Issues in the Cloud Environment......Page 294
  eDiscovery......Page 295
  Conflicting International Legislation......Page 296
  Cloud Forensic Challenges......Page 297
  Forensic Data Collection Methodologies......Page 298
  Scope......Page 299
  Restrictions of Audit Scope Statements......Page 300
  Different Types of Audit Reports......Page 301
  AICPA Reports and Standards......Page 302
 Summary......Page 303
 Written Labs......Page 304
 Review Questions......Page 305
Chapter 11 Legal and Compliance Part 2......Page 309
 The Impact of Diverse Geographical Locations and Legal Jurisdictions......Page 311
  Policies......Page 312
  Choices Involved in Managing Risk......Page 316
  Risk Management Frameworks......Page 319
  Contracts and Service-Level Agreements (SLAs)......Page 321
 Cloud Contract Design and Management for Outsourcing......Page 324
  Common Criteria Assurance Framework (ISO/IEC 15408-1:2009)......Page 325
  CSA Security, Trust, and Assurance Registry (STAR)......Page 326
  Supply Chain Risk......Page 327
  Manage Communication with Relevant Parties......Page 328
 Written Labs......Page 329
 Review Questions......Page 330
Appendix A Answers to Written Labs......Page 335
 Chapter 2: Design Requirements......Page 336
 Chapter 3: Data Classification......Page 337
 Chapter 4: Cloud Data Security......Page 338
 Chapter 6: Responsibilities in the Cloud......Page 339
 Chapter 8: Operations Elements......Page 340
 Chapter 9: Operations Management......Page 341
 Chapter 11: Legal and Compliance Part 2......Page 342
Appendix B Answers to Review Questions......Page 343
 Chapter 1: Architectural Concepts......Page 344
 Chapter 2: Design Requirements......Page 345
 Chapter 3: Data Classification......Page 347
 Chapter 4: Cloud Data Security......Page 348
 Chapter 5: Security in the Cloud......Page 350
 Chapter 6: Responsibilities in the Cloud......Page 351
 Chapter 7: Cloud Application Security......Page 353
 Chapter 8: Operations Elements......Page 354
 Chapter 9: Operations Management......Page 356
 Chapter 10: Legal and Compliance Part 1......Page 357
 Chapter 11: Legal and Compliance Part 2......Page 359
Index......Page 361
Advert......Page 380
EULA......Page 381