CCSP Training - Mali

Certified Cloud Security Professional Course Outline

Domain 1: Cloud Concepts, Architecture and Design

Module 1: Understand Cloud Computing Concepts

• Cloud Computing Essentials
• Cloud Roles and Responsibilities 
• Building Block Technologies

Module 2: Describe Cloud Reference Architecture

• Cloud Computing Activities 
• Cloud Service Capabilities
• Cloud Service Categories 
• Cloud Deployment Models 
• Cloud Shared Considerations
• Impact of Related Technologies 

Module 3: Understand Security Concepts Relevant to Cloud Computing

• Cryptographic Key Management 
• Identity and Access Control 
• Data and Media Sanitisation
• Integrated Network and Virtualisation Security
• Common Threats
• Security Hygiene 

Module 4: Understand Design Principles of Secure Cloud Computing

• Cloud Secure Data Lifecycle
• Cloud-Based Business Continuity (BC) 
• Disaster Recovery (DR)
• Business Impact Analysis (BIA) 
• Functional Security Requirements 
• Security Considerations and Responsibilities for Different Cloud Categories
• Cloud Design Patterns 
• DevOps Security 

Module 5: Evaluate Cloud Service Providers

• System and Subsystem Product Certification

Domain 2: Cloud Concepts, Architecture and Security

Module 1: Describe Cloud Data Concepts

• Cloud Data Lifecycle Phases
• Data Dispersion 
• Data Flows 

Module 2: Design and Implement Cloud Data Storage Architectures

• Storage Types and Their Threats
• General Threats to Cloud Storage and Mitigations

Module 3: Design and Apply Data Security Technologies and Strategies

• Integrated Encryption and Key Management
• Hashing
• Data Obfuscation
• Tokenisation
• Data Loss Prevention (DLP)

Module 4: Implement Data Discovery

• Structured Data 
• Unstructured Data 
• Semi-structured Data
• Data Location

Module 5: Implement Data Classification

• Data Classification Policies 
• Data Mapping 

Module 6: Design and Implement Information Rights Management (IRM)

• Objective
• Appropriate Tools 

Module 7: Plan and Implement Data Retention, Deletion, and Archiving Policies

• Data Retention Policies 
• Data Deletion Procedures and Mechanisms 
• Data Archiving Procedures and Mechanisms 
• Legal Hold

Module 8: Design and Implement Auditability, Traceability, and Accountability of Data Events

• Definition of Event Sources and Requirement of Event Attributes
• Logging, Storage and Analysis of Data Events 
• Chain of Custody and Non-repudiation 

Domain 3: Cloud Platform and Infrastructure Security

Module 1: Comprehend Cloud Infrastructure Components

• Cloud Infrastructure 
• Physical Environment
• Network and Communications
• Computing and Storage
• Virtualisation 
• Management Plane

Module 2: Design a Secure Data Center

• Logical Design
• Physical Design
• Environmental Design
• Design Resilient

Module 3: Analyse Risks Associated with Cloud Infrastructure

• Risk Assessment
• Cloud Vulnerabilities, Threats and Attacks
• Risk Mitigation Strategies

Module 4: Design and Plan Security Controls

• Physical and Environmental Protection
• Cloud Security: Systems and Access Protection
• Audit Mechanisms

Module 5: Plan Disaster Recovery (DR) and Business Continuity (BC)

• Business Continuity/ Disaster Recovery Strategy
• Business Requirements
• Implementing a BCDR Plan

Domain 4: Cloud Application Security

Module 1: Advocate Training and Awareness for Application Security

• Cloud Development Basics
• Common Pitfalls
• Common Cloud Vulnerabilities

Module 2: Describe the Secure Software Development Lifecycle (SDLC)

• Business Requirements
• Phases and Methodologies

Module 3: Apply the Secure Software Development Life Cycle (SDLC)

• Cloud Threat and Vulnerability Mitigation
• Verification Standard (ASVS), Software Assurance Forum for Excellence in Code (SAFECode)
• Software Configuration Management and Versioning

Module 4: Apply Cloud Software Assurance and Validation

• Functional and Non-functional Testing
• Security Testing Methodologies
• Quality Assurance (QA)
• Abuse Case Testing

Module 5: Use Verified Secure Software

• Securing Application Programming Interfaces (API)
• Supply-chain Management
• Third-party Software Management
• Validated Open-source Software

Module 6: Comprehend the Specifics of Cloud Application Architecture

• Supplemental Security Components
• Cryptography
• Sandboxing
• Application Virtualisation and Orchestration

Module 7: Design Appropriate Identity and Access Management (IAM) Solutions

• Federated Identity
• Identity Providers (IdP)
• Single Sign-on (SSO)
• Multi-factor Authentication (MFA)
• Cloud Access Security Broker (CASB)
• Secrets Management

Domain 5: Cloud Security Operations

Module 1: Build and Implement Physical and Logical Infrastructure for Cloud Environment

• Virtual Hardware Specific Security Configuration Requirements
• Hardware Specific Security Configuration Requirements
• Installation and Configuration of Management Tools
• Installation of Guest Operating System (OS) Virtualisation Toolsets

Module 2: Operate and Maintain Physical and Logical Infrastructure for Cloud Environment

• Access Controls for Local and Remote Access
• Integrated Network Security Management
• Operating System (OS) Hardening through the Application of Baselines, Monitoring and Remediation
• Patch Management
• Infrastructure as Code (IaC) Strategy
• Availability of Clustered Hosts
• Availability of Guest Operating System
• Performance and Capacity Monitoring
• Configuration of Host and Guest Operating System (OS) Backup and Restore Functions
• Management Plane

Module 3: Implement Operational Controls and Standards

• Incident Management
• Problem Management
• Release and Deployment Management
• Configuration Management
• Service Level Management
• Availability Management
• Capacity Management

Module 4: Support Digital Forensics

• Forensic Data Collection Methodologies
• Evidence Management
• Collect, Acquire, and Preserve Digital Evidence

Module 5: Manage Communication with Relevant Parties

• Vendors
• Customers and Partners
• Regulators and Other Stakeholders

Module 6: Manage Security Operations

• Security Operations Center (SOC)
• Intelligent Monitoring of Security Controls
• Log Capture and Analysis
• Vulnerability Assessments

Domain 6: Legal, Risk, and Compliance

Module 1: Articulate Legal Requirements and Unique Risks Within the Cloud Environment

• Conflicting International Legislation
• Evaluation of Legal Risks Specific to Cloud Computing
• Legal Framework and Guidelines
• eDiscovery and Forensics Requirements

Module 2: Understand Privacy Issues

• Difference between Contractual and Regulated Private Data
• Country-Specific Legislation Related to Private Data
• Jurisdictional Differences in Data Privacy

Module 3: Understand Audit Process, Methodologies, and required Adaptations for a Cloud Environment

• Internal and External Audit Control 
• Impact of Audit Requirements
• Identify Assurance Challenges of Virtualisation and Cloud
• Audit Reporting: Types, Scope, and Gap Analysis
• Audit Planning
• Internal Information Security Management System (ISMS)
• Internal Information Security Controls System
• Policies and Identification and Involvement of Relevant Stakeholders
• Specialised Compliance Requirements for Highly-Regulated Industries
• Impact of Distributed IT Models

Module 4: Understand Implications of Cloud to Enterprise Risk Management

• Assess Providers Risk Management Programs
• Difference and Regulatory Transparency Requirements
• Risk Treatment and Different Risk Frameworks
• Assessment of the Risk Environment

Module 5: Understand Outsourcing and Cloud Contract Design

• Business Requirements
• Vendor Management and Contract Management
• Supply Chain Management
• Implementation of Network Security Controls
• Management Plan