Certificate of Cloud Security Knowledge (CCSK) Plus (CSA authorized) Training Course

Module 1. Cloud Architecture

This section establishes the fundamentals of cloud computing, covering definitions, architectures, and the significance of virtualization. It examines key areas such as service models, delivery models, and core characteristics. Additionally, it introduces the Shared Responsibilities Model and provides a framework for approaching cloud security.

Topics Covered:

• Unit 1 - Introduction to Cloud Computing
• Unit 2- Introduction & Cloud Architecture
• Unit 3 - Cloud Essential Characteristics
• Unit 4 - Cloud Service Models
• Unit 5 - Cloud Deployment Models
• Unit 6 - Shared Responsibilities

Module 2. Infrastructure Security for Cloud

This module explores the specific measures required to secure core cloud infrastructure, including components, networks, management interfaces, and administrator credentials. It delves deeper into virtual networking and workload security, covering the basics of containers and serverless architectures.

Topics Covered:

• Unit 1 - Module Intro
• Unit 2 - Intro to Infrastructure Security for Cloud Computing
• Unit 3 - Software Defined Networks
• Unit 4 - Cloud Network Security
• Unit 5 - Securing Compute Workloads
• Unit 6 - Management Plane Security
• Unit 7 - BCDR

Module 3. Managing Cloud Security and Risk

This area addresses critical aspects of managing cloud security. It begins with risk assessment and governance, proceeding to legal and compliance matters, such as discovery requirements in cloud environments. It also highlights key CSA risk management tools, including the CAIQ, CCM, and STAR registry.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Governance
• Unit 3 - Managing Cloud Security Risk
• Unit 4 - Legal
• Unit 5 - Legal Issues In Cloud
• Unit 6 - Compliance
• Unit 7 - Audit
• Unit 8 - CSA Tools

Module 4. Data Security for Cloud Computing

Focusing on the information lifecycle in the cloud, this module details the application of security controls, with a particular emphasis on public cloud environments. Topics include the Data Security Lifecycle, cloud storage models, security challenges associated with different delivery models, and encryption management, including the use of customer-managed keys (BYOK).

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Cloud Data Storage
• Unit 3 - Securing Data In The Cloud
• Unit 4 - Encryption For IaaS
• Unit 5 - Encryption For PaaS & SaaS
• Unit 6 - Encryption Key Management
• Unit 7 - Other Data Security Options
• Unit 8 - Data Security Lifecycle

Module 5. Application Security and Identity Management for Cloud Computing

This section addresses identity management and application security within cloud deployments. It covers federated identity, various IAM applications, secure development practices, and strategies for managing application security both within and for the cloud.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Secure Software Development Life Cycle (SSDLC)
• Unit 3 - Testing & Assessment
• Unit 4 - DevOps
• Unit 5 - Secure Operations
• Unit 6 - Identity & Access Management Definitions
• Unit 7 - IAM Standards
• Unit 8 - IAM In Practice

Module 6. Cloud Security Operations

This part discusses key factors to consider when evaluating, selecting, and managing cloud computing providers. It also examines the role of Security as a Service providers and the influence of cloud environments on Incident Response capabilities.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Selecting A Cloud Provider
• Unit 3 - SECaaS Fundamentals
• Unit 4 - SECaaS Categories
• Unit 5 - Incident Response
• Unit 6 - Domain 14 Considerations
• Unit 7 - CCSK Exam Preparation

Additional material

Core Account Security

Participants learn the essential configurations to perform immediately upon creating a new cloud account, focusing on enabling security controls such as MFA, basic monitoring, and IAM.

IAM and Monitoring In-Depth

Building on the initial lab, attendees implement more complex identity management and monitoring solutions. This involves extending IAM with Attribute Based Access Controls, setting up security alerting, and understanding the structuring of enterprise-scale IAM and monitoring systems.

Network and Instance Security

Students construct a virtual network (VPC) and apply baseline security configurations. They also learn how to securely select and launch a virtual machine (instance), conduct cloud vulnerability assessments, and establish secure connections to the instance.

Encryption and Storage Security

Participants extend their deployment by adding a storage volume encrypted with a customer-managed key. The session also covers methods for securing snapshots and other data assets.

Application Security and Federation

To conclude the technical labs, students fully build a 2-tier application and implement federated identity using OpenID.

Risk and Provider Assessment

Using the CSA Cloud Controls Matrix and the STAR registry, students evaluate risks and select an appropriate cloud provider.