Certificate of Cloud Security Knowledge (CCSK) Plus (CSA authorized) Training Course

Module 1. Cloud Architecture

This module establishes the basics of cloud computing, covering definitions, architectural frameworks, and the critical role of virtualization. Key areas of focus include service models, delivery models, and inherent characteristics of the cloud. It also introduces the Shared Responsibilities Model and provides a structured approach to addressing cloud security.

Topics Covered:

• Unit 1 - Introduction to Cloud Computing
• Unit 2- Introduction & Cloud Architecture
• Unit 3 - Cloud Essential Characteristics
• Unit 4 - Cloud Service Models
• Unit 5 - Cloud Deployment Models
• Unit 6 - Shared Responsibilities

Module 2. Infrastructure Security for Cloud

This section examines the protection of core cloud infrastructure, including components, network structures, management interfaces, and administrative credential management. It explores virtual networking and workload security, incorporating the fundamentals of containers and serverless architectures.

Topics Covered:

• Unit 1 - Module Intro
• Unit 2 - Intro to Infrastructure Security for Cloud Computing
• Unit 3 - Software Defined Networks
• Unit 4 - Cloud Network Security
• Unit 5 - Securing Compute Workloads
• Unit 6 - Management Plane Security
• Unit 7 - BCDR

Module 3. Managing Cloud Security and Risk

Addressing the critical aspects of overseeing security in cloud environments, this module starts with risk assessment and governance strategies. It then moves to legal and compliance considerations, such as data discovery requirements. Additionally, it introduces essential CSA risk management tools, including the CAIQ, CCM, and the STAR registry.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Governance
• Unit 3 - Managing Cloud Security Risk
• Unit 4 - Legal
• Unit 5 - Legal Issues In Cloud
• Unit 6 - Compliance
• Unit 7 - Audit
• Unit 8 - CSA Tools

Module 4. Data Security for Cloud Computing

This module focuses on managing the information lifecycle within the cloud and applying appropriate security controls, with a particular emphasis on public cloud environments. Subjects include the Data Security Lifecycle, cloud storage models, data protection challenges across various delivery models, and encryption management, including the use of customer-managed keys (BYOK).

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Cloud Data Storage
• Unit 3 - Securing Data In The Cloud
• Unit 4 - Encryption For IaaS
• Unit 5 - Encryption For PaaS & SaaS
• Unit 6 - Encryption Key Management
• Unit 7 - Other Data Security Options
• Unit 8 - Data Security Lifecycle

Module 5. Application Security and Identity Management for Cloud Computing

Focuses on implementing identity management and securing applications in cloud deployments. Key topics involve federated identity, various IAM applications, secure development practices, and the management of application security within and for the cloud.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Secure Software Development Life Cycle (SSDLC)
• Unit 3 - Testing & Assessment
• Unit 4 - DevOps
• Unit 5 - Secure Operations
• Unit 6 - Identity & Access Management Definitions
• Unit 7 - IAM Standards
• Unit 8 - IAM In Practice

Module 6. Cloud Security Operations

This section addresses key factors in evaluating, choosing, and managing cloud computing providers. It also examines the role of Security as a Service (SECaaS) providers and how cloud adoption influences Incident Response strategies.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Selecting A Cloud Provider
• Unit 3 - SECaaS Fundamentals
• Unit 4 - SECaaS Categories
• Unit 5 - Incident Response
• Unit 6 - Domain 14 Considerations
• Unit 7 - CCSK Exam Preparation

Additional material

Core Account Security

Participants learn the essential configurations to perform immediately upon creating a new cloud account, including enabling security controls like MFA, basic monitoring, and IAM.

IAM and Monitoring In-Depth

Built upon the initial lab work, attendees implement more complex identity management and monitoring solutions. This includes expanding IAM using Attribute Based Access Controls, setting up security alerting, and understanding the architecture of enterprise-scale IAM and monitoring.

Network and Instance Security

Learners create a virtual network (VPC) and establish a baseline security configuration. The curriculum also covers the secure selection and launch of a virtual machine (instance), conducting vulnerability assessments in the cloud, and establishing secure connections to the instance.

Encryption and Storage Security

Participants extend their deployment by adding storage volumes encrypted with customer-managed keys. They also explore methods for securing snapshots and other data assets.

Application Security and Federation

Concluding the technical labs, students fully construct a 2-tier application and implement federated identity using OpenID.

Risk and Provider Assessment

Using the CSA Cloud Controls Matrix and the STAR registry, learners evaluate risk profiles and select appropriate cloud providers.