Certified Cloud Security Officer

Are you ready for the cloud?  The cloud has everyone up in arms when discussing security!  The benefits of the Cloud are great; however, many companies have concerns about adopting a cloud architecture due to the inherent security risks of adding this additional architectural layer.  This course will provide for you what you do not find in other classes!  The combination of knowledge tailored around the 6 domains in the C)CSO examination along with implementing cloud security, auditing and compliance. This is all managed by a unique delivery of the C)CSO domains along with the hands on labs needed to truly understand what is happening to your data at all the layers of the cloud stack. This is a relevant course which introduces many technologies used in the cloud from implementing a vRealize cloud to using a new key management solution from various vendors.

Virtualization Administrators, Cloud Administrators, CIO, Virtualization and Cloud Auditors, Virtualization and Cloud Compliance Officers, anyone that needs a general understanding of security in the Cloud, those seeking the CCSP Certification.

Recommended minimum one-year experience with virtualization technology or equivalent knowledge.  General understanding of cloud architectures.  Minimum one-year experience with general security.

• To gain the knowledge needed to pass the Certified Cloud Security Officer Exam
• To fully understand Cloud Security from a real-world view point.
• To receive the hands-on experience needed to implement Cloud Security with VMware vRealize, VMware vSphere, Amazon AWS, Microsoft Azure and other products generally used in cloud implementations.
• To have a general working knowledge on what to audit in a cloud architecture.
• To know hands-on methods of auditing a cloud environment from a best practices Security view point.
• To understand how compliance is viewed and dealt with in the cloud.

Continuing education: 40 CEUs

The Certified Cloud Security Officer exam is taken online through Mile2’s Assessment and Certification System (“MACS”), which is accessible on your mile2.com account. The exam will take 2 hours and consist of 100 multiple choice questions. The cost is $400 USD and must be purchased from Mile2.com.

Module 0 – Course Introduction

Module 1 – Cloud introduction and Design Fundamentals

1. Cloud Introduction
   1. Including deep dive into the virtualization layer
2. Cloud and Business Objectives Meet as One
3. Cloud Security from A-Z
4. Design Doctrines
5. How do we find Trusted Cloud Services?

Module 2 – Data Security in the Cloud

1. Data Life Cycle
2. Data Storage Designs for the Cloud
3. Strategies for Designing Data Security
4. Data Discovery and Classification Technologies
5. Understanding Jurisdictional Data Protection for Personally Identifiable Information (PII)
6. All about Data Rights Management
7. Data Retention, Deletion, and Archival Policies
8. Auditability, Traceability, and Accountability of Data Events

Module 3 – The Basis for Cloud Security and surrounding Environment

1. Understanding Cloud Infrastructure Components
2. Analyze Risks in the Cloud Infrastructure
3. Security Control Design for the Cloud
4. Disaster Recovery and Business Continuity Management for the Cloud

Module 4 – Application Security in the Cloud

1. Training and Awareness for Application Security
2. Software Development Life Cycle (SDLC) Process
3. Learning to apply the Secure Software Development Life Cycle
4. Verifying the use of Secure Software
5. Proper use of Identity and Access Management (IAM) Solutions
6. Additional components used in the Cloud Application Architecture
7. Software Assurance and Validation

Module 5 – Managing Cloud Security

1. Supporting the Data Center Design
2. Physical Infrastructure for the Cloud
3. Running the Physical Infrastructure
4. Managing the Physical Infrastructure
5. Building the Logical Infrastructure for the Cloud
6. Running the Logical Infrastructure for the Cloud
7. Managing the Logical Infrastructure for the Cloud
8. Maintaining Compliance with Regulations and Controls
9. Conducting Risk Assessment for the Logical and Physical Infrastructure
10. Properly plan for the Collection, Acquisition and Preservation of Digital Evidence
11. Managing Communications with Relevant Parties

Module 6 – Legal Issues, Auditing, and Compliance

1. Discussing the Legal Requirements and Risks Unique to the Cloud
2. Privacy Issues and the relevance of Jurisdiction
3. The Audit Process and Methodologies for the Cloud
4. Cloud to Enterprise Risk Management
5. Contract design for Outsourcing and Cloud Agreements
6. Managing Vendors in the Cloud

Labs – These are not all required during class but will be leveraged to better understand the complexities in cloud security. This is a general list, not a complete list of every lab.

1. Cloud Migration Evaluation
2. Understanding the virtual layer, hacking included
3. Understanding how network traffic routes in the virtual and cloud layer
4. Harden the virtual layer Management layer, Hypervisor and the VMs.
5. Setup and Deploy an IaaS Solution
6. Setup SaaS Solution
7. Setup PaaS Solution
8. Evaluate SaaS, PaaS, and IaaS solutions for security capabilities
9. Cloud Business Driver Audit
10. Service Level Agreement Exercise
11. Identity and Access Control Management
12. Encryption and Key Management
13. Small Scope Private Cloud Security Audit