1 / 31

Cloud as a Certificate

Cloud as a Certificate. What is Interesting in the CCSP certification ?. INtroduction. György Kollár Electrical Engineer , (Old School Informatics ) Small Business Owner Technical Director since 1991 Early Adopter type Working in Security in the last 13 years

lisamontgomery
Download Presentation

Cloud as a Certificate

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Cloudas a Certificate What is Interesting in the CCSP certification?

  2. INtroduction • György Kollár • ElectricalEngineer, (Old SchoolInformatics) • Small Business Owner • TechnicalDirectorsince 1991 • EarlyAdoptertype • Working in Security in the last 13 years • CISSP (2005-), CCSP (2016-) • Collecting old HP calculators

  3. AbouttheCloud • Everybodyusesit • Itcostsnothing • Soneonetakescare of everything • Itwillalways be there • IT IS SAFE!

  4. About CCSP • Jointcertification of (ISC)2 and CSA (CloudSecurityAlliance) • „A CCSP applies information security expertise to a cloud computing environment anddemonstrates competence in cloud security architecture, design, operations, and service orchestration.” • Successful candidates are competent in the following 6 domains

  5. sixdomains of Common Body of Knowledge (CBK) • Architectural Concepts and Design Requirements • Cloud Data Security • Cloud Platform and Infrastructure Security • Cloud Application Security • Operations • Legal and Compliance

  6. Experience Requirements • Minimum of 5 yearsexperience • Or • CISSP credential

  7. Examination

  8. Domain 1:Architectural Concepts and DesignRequirements • Cloud Computing Concepts • Cloud Reference Architecture • Security Concepts Relevant to Cloud Computing • Design Principles of Secure Cloud Computing • Trusted Cloud Services

  9. meaning of cloud • on-demand self-service, • broad network access, • resource pooling, • rapid elasticity or expansion, • measured service

  10. "service models" • Software, • Platform, • Infrastructure

  11. "deployment models" • Private, • Public, • Community, • Hybrid

  12. Domain 2:Cloud Data Security • Cloud Data Lifecycle • Cloud Data Storage Architectures • Data Security Strategies • Data Discovery and Classification • Design and Implement Relevant Jurisdictional Data Protections for Personally IdentifiableInformation (PII) • Data Rights Management • Data Retention, Deletion, and Archiving Policies • Auditability, Traceability and Accountability of Data Events

  13. Movingtothecloud • CRM • Customer database • Scheduler • Financial data • Project management • Subcontractors • Time management • Calculations • Design documents • Schematics • Mechanicaldrawings • Software • Network diagrams • Bookkeeping • Taxforms • Invoices

  14. Changes in theCloud • Where is mydata? • Where is my backup? • Howcan I usemysystems? • Howcan I securemysystems? • Howcan I deletemydata?

  15. Risks shifted and changed • Assets • Whoownstheasset? • Who is responsiblefortheasset? • Whatasset?

  16. "service models" • Software, • Platform, • Infrastructure

  17. Domain 3:Cloud Platform and InfrastructureSecurity • Cloud Infrastructure Components • Risks Associated to Cloud Infrastructure • Design and Plan Security Controls • Plan Disaster Recovery and Business Continuity Management

  18. LayeredSecurity • PhisicalLayer • Cabling • Services • Power • HVAC • Emergency

  19. Domain 4:Cloud Application Security • Training and Awareness • Cloud Software Assurance and Validation • Use Verified Secure Software • Software Development Life-Cycle (SDLC) Process • Apply the Secure Software Development Life-Cyclethe Specifics of Cloud Application Architecture • Identity and Access Management

  20. Domain 5:Operations • Support the Planning Process for the Data Center Design • Implement and Build/ Run / Manage Physical Infrastructure for Cloud Environment • Build/ Run / Manage Logical Infrastructure for Cloud Environment • Ensure Compliance with Regulations and Controls • Conduct Risk Assesment to Logical and Physical Infrastructure • Understand the Collection, Acquisition and Preservation of Digital Evidence • Manage Communication with Relevant Parties

  21. differencesbetweenclassic and cloudenvironments • Sizematters • Redundancyneedsatleasttwo of everything • Cost matters • Ifyoucanshareresourcesyoucansharecosts • Locationmatters • Youwanttoreachitfromanywhere, don’tyou?

  22. Domain 6:Legal and Compliance • Legal Requirements and Unique Risks within the Cloud Environment • Privacy Issues, Including Jurisdictional Variation • Audit Process, Methodologies, and Required Adaptations for aCloud Environment • Implications of Cloud to Enterprise Risk Management • Outsourcing and Cloud Contract Design • Vendor Management

  23. GDPR and otherregulations • Location • Local Law • Customer Country Law • Etc.

  24. Responsibilities • Youcanoutsoureeverythingbutresponsibility • But… • Youcanbuyservices • Makecontracts • Sharerisks • Ifyouwantsomethingto be doneputitintothecontract

  25. Costs and benefits • Efficiency • Reliability • Security • Vendorlock-in • Service drift

  26. Most overlookedthings • Backup (and restore!) • Upgrades • Patch management • Vulnerability management • Confidentiality • Privacy

  27. Cloudguide • Security is notsomethingfor free • Itwillnot be includedifyoudonotaskforit • Checkingeverything is a must • Read thesmall text aswell • Encryption is necessary • Keep a clearway out

  28. Conclusion • Cloud is thenextbigthing • Thisknowledge is onhighdemand • Therearelots of opportunities • Cloudsecurity is extremlyinextricable (impossible to disentangle or separate.) • References: www.isc2.org/ccsp-cbk-references

  29. John CleeseonStupidity

  30. Questions Thankyou!

More Related