Certificate of Cloud Security Knowledge (CCSK) Plus (CSA authorized) Training Course

Module 1. Cloud Architecture

Explores the core principles of cloud computing, including definitions, architectural frameworks, and the critical role of virtualization. Key areas of focus include service models, delivery mechanisms, and essential characteristics, alongside an introduction to the Shared Responsibilities Model and strategic frameworks for cloud security.

Topics Covered:

• Unit 1 - Introduction to Cloud Computing
• Unit 2- Introduction & Cloud Architecture
• Unit 3 - Cloud Essential Characteristics
• Unit 4 - Cloud Service Models
• Unit 5 - Cloud Deployment Models
• Unit 6 - Shared Responsibilities

Module 2. Infrastructure Security for Cloud

Examines the specifics of securing core cloud infrastructure, covering cloud components, network structures, management interfaces, and administrator credential management. The module also delves into virtual networking and workload security, including foundational concepts of containers and serverless architectures.

Topics Covered:

• Unit 1 - Module Intro
• Unit 2 - Intro to Infrastructure Security for Cloud Computing
• Unit 3 - Software Defined Networks
• Unit 4 - Cloud Network Security
• Unit 5 - Securing Compute Workloads
• Unit 6 - Management Plane Security
• Unit 7 - BCDR

Module 3. Managing Cloud Security and Risk

Addresses critical considerations for overseeing security in cloud environments. The discussion begins with risk assessment and governance, extending to legal and compliance matters, such as data discovery requirements. It further highlights essential CSA risk management tools, including the CAIQ, CCM, and STAR registry.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Governance
• Unit 3 - Managing Cloud Security Risk
• Unit 4 - Legal
• Unit 5 - Legal Issues In Cloud
• Unit 6 - Compliance
• Unit 7 - Audit
• Unit 8 - CSA Tools

Module 4. Data Security for Cloud Computing

Focuses on information lifecycle management within the cloud and the application of security controls, with particular emphasis on public cloud environments. Topics range from the Data Security Lifecycle and cloud storage models to data security challenges across various delivery models, as well as the management of encryption within the cloud, including the use of customer-managed keys (BYOK).

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Cloud Data Storage
• Unit 3 - Securing Data In The Cloud
• Unit 4 - Encryption For IaaS
• Unit 5 - Encryption For PaaS & SaaS
• Unit 6 - Encryption Key Management
• Unit 7 - Other Data Security Options
• Unit 8 - Data Security Lifecycle

Module 5. Application Security and Identity Management for Cloud Computing

Discusses identity management and application security strategies for cloud-based deployments. Covered topics include federated identity systems, various IAM applications, secure development practices, and the ongoing management of application security within cloud environments.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Secure Software Development Life Cycle (SSDLC)
• Unit 3 - Testing & Assessment
• Unit 4 - DevOps
• Unit 5 - Secure Operations
• Unit 6 - Identity & Access Management Definitions
• Unit 7 - IAM Standards
• Unit 8 - IAM In Practice

Module 6. Cloud Security Operations

Examines key factors when evaluating, selecting, and managing cloud service providers. The module also explores the role of Security as a Service (SECaaS) providers and the impact of cloud adoption on incident response capabilities.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Selecting A Cloud Provider
• Unit 3 - SECaaS Fundamentals
• Unit 4 - SECaaS Categories
• Unit 5 - Incident Response
• Unit 6 - Domain 14 Considerations
• Unit 7 - CCSK Exam Preparation

Additional material

Core Account Security

Participants learn to configure essential settings during the initial setup of a new cloud account, enabling foundational security controls such as Multi-Factor Authentication (MFA), basic monitoring, and IAM.

IAM and Monitoring In-Depth

Building on initial laboratory exercises, attendees implement more sophisticated identity management and monitoring strategies. This includes extending IAM with Attribute Based Access Controls, establishing security alerting mechanisms, and understanding the structuring of enterprise-scale IAM and monitoring.

Network and Instance Security

Participants design a virtual network (VPC) and apply baseline security configurations. The exercise also covers the secure selection and launching of virtual machines, conducting cloud-based vulnerability assessments, and establishing secure connections to instances.

Encryption and Storage Security

Participants enhance their deployment by incorporating storage volumes encrypted with customer-managed keys. The module further covers the secure handling of snapshots and other data assets.

Application Security and Federation

Concluding the technical laboratories, participants build a complete two-tier application and implement federated identity using OpenID.

Risk and Provider Assessment

Participants utilize the CSA Cloud Controls Matrix and STAR registry to assess risks and make informed decisions when selecting cloud providers.