Certificate of Cloud Security Knowledge (CCSK) Plus (CSA authorized) Training Course

Module 1. Cloud Architecture

This module establishes the basics of cloud computing, covering definitions, architectural frameworks, and the significance of virtualization. It highlights cloud service and delivery models, along with core characteristics. Additionally, it introduces the Shared Responsibilities Model and provides a structured approach to addressing cloud security.

Topics Covered:

• Unit 1 - Introduction to Cloud Computing
• Unit 2- Introduction & Cloud Architecture
• Unit 3 - Cloud Essential Characteristics
• Unit 4 - Cloud Service Models
• Unit 5 - Cloud Deployment Models
• Unit 6 - Shared Responsibilities

Module 2. Infrastructure Security for Cloud

This section explores the nuances of securing core cloud infrastructure, including components, networks, management interfaces, and administrator credentials. It also examines virtual networking and workload security, touching on the fundamentals of containers and serverless architectures.

Topics Covered:

• Unit 1 - Module Intro
• Unit 2 - Intro to Infrastructure Security for Cloud Computing
• Unit 3 - Software Defined Networks
• Unit 4 - Cloud Network Security
• Unit 5 - Securing Compute Workloads
• Unit 6 - Management Plane Security
• Unit 7 - BCDR

Module 3. Managing Cloud Security and Risk

This module addresses critical aspects of managing security within cloud environments. It starts with risk assessment and governance, then moves to legal and compliance matters, such as discovery requirements in the cloud. It also features key CSA risk management tools, including the CAIQ, CCM, and STAR registry.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Governance
• Unit 3 - Managing Cloud Security Risk
• Unit 4 - Legal
• Unit 5 - Legal Issues In Cloud
• Unit 6 - Compliance
• Unit 7 - Audit
• Unit 8 - CSA Tools

Module 4. Data Security for Cloud Computing

Focuses on information lifecycle management in the cloud and the application of security controls, with a particular emphasis on public cloud environments. Topics include the Data Security Lifecycle, cloud storage models, security challenges across different delivery models, and encryption management, including customer-managed keys (BYOK).

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Cloud Data Storage
• Unit 3 - Securing Data In The Cloud
• Unit 4 - Encryption For IaaS
• Unit 5 - Encryption For PaaS & SaaS
• Unit 6 - Encryption Key Management
• Unit 7 - Other Data Security Options
• Unit 8 - Data Security Lifecycle

Module 5. Application Security and Identity Management for Cloud Computing

Examines identity management and application security within cloud deployments. Key topics include federated identity, various IAM applications, secure development practices, and the management of application security both in and for the cloud.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Secure Software Development Life Cycle (SSDLC)
• Unit 3 - Testing & Assessment
• Unit 4 - DevOps
• Unit 5 - Secure Operations
• Unit 6 - Identity & Access Management Definitions
• Unit 7 - IAM Standards
• Unit 8 - IAM In Practice

Module 6. Cloud Security Operations

Discusses essential considerations for evaluating, selecting, and managing cloud service providers. The module also explores the role of Security as a Service (SECaaS) providers and the implications of cloud computing on Incident Response strategies.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Selecting A Cloud Provider
• Unit 3 - SECaaS Fundamentals
• Unit 4 - SECaaS Categories
• Unit 5 - Incident Response
• Unit 6 - Domain 14 Considerations
• Unit 7 - CCSK Exam Preparation

Additional material

Core Account Security

Learners identify the critical configurations required during the initial setup of a new cloud account, enabling security controls such as MFA, basic monitoring, and IAM.

IAM and Monitoring In-Depth

Participants build upon initial lab work by implementing more complex identity management and monitoring solutions. This includes extending IAM with Attribute Based Access Controls, setting up security alerting, and structuring enterprise-scale IAM and monitoring frameworks.

Network and Instance Security

Students design a virtual network (VPC) and apply baseline security settings. They also learn to securely provision and launch virtual machines (instances), conduct cloud-based vulnerability assessments, and establish secure connections to the instances.

Encryption and Storage Security

Learners enhance their deployment by incorporating storage volumes encrypted with customer-managed keys. They also gain insight into securing snapshots and other data assets.

Application Security and Federation

Students complete the technical labs by constructing a full two-tier application and implementing federated identity using OpenID.

Risk and Provider Assessment

Participants utilize the CSA Cloud Controls Matrix and STAR registry to assess risk levels and make informed decisions when selecting a cloud provider.