1. 3. Cloud Data Security
1.1. Mod 1. Cloud Data Security Concepts
1.1.1. 6 Phases of Data Lifecycle
1.1.2. Location & Access
1.2. P240 Mod 2: Cloud Data Storage Architectures: Storage types (SSD, HDD), Threats, Data security controls, Data Archiving options
1.2.1. P241. IaaS (5 types) - Ephemeral (Non billable) , Raw, Long Term, Volume (Vmware VMFS, EBS), object (File share)
1.2.2. P242 PaaS (Database, Big data as a service)
1.2.3. P SaaS (Information Storage & Management, content/file storage/Content Delivery network (CDN)
1.2.4. P244: Threats to Cloud storage (Unauthorized usage, access, liability to reg compliance, DOS, Corruption, destruction, Data leakage, Threat, Malware, Improper Treatment/Sensitization after end of use
1.3. P245 Mod 3: Data Security Technologies and Strategies: Masking/ obfuscation, anonymization, tokenization, DLP arhitecture components/topologies
1.3.1. Data Masking/Obfuscation (Direct Identifiers)
1.3.2. Data Anonymization (Indirect Identifiers)
1.3.3. Tokenization as a service (Cloud)
1.3.3.1. Basic Tokenisation Architecture
1.3.4. Data Loss Prevention (DLP) : Stages 1. Discovery and Classification, 2 Monitoring, 3 Enforcement (Alert, log, block, Encrypt)
1.3.4.1. Architecture for Data in Motion (DIM) -http/https (decrypt)/SFTP, Data at Rest (DAR), Data in Use (DIU) - endpoint based
1.4. Symmetric
1.5. P254 Mod4 Cryptography*
1.5.1. Encryption Alogorithms
1.5.1.1. Asymetric/Public Key Infra (PKI)
1.5.1.2. Transparent encryption (DB)
1.5.1.3. Hashing
1.5.2. P260 Encryption Implementation
1.5.2.1. Data In motion (DIM)
1.5.2.2. Data at Rest (DAR)
1.5.2.3. Data in user (DIU)
1.5.3. P262 Cloud Encryption challenges
1.5.4. P263 Cloud Data Encryption Archiecture and Options (Data, Encryption : Engine, Keys) - IaaS, PaaS, SaaS
1.5.4.1. IaaS - Basic storage level, Volume, Object
1.5.4.2. Paas & SaaS - File-level, Application Level
1.5.4.3. Database - File Level, Transparent, Application Level, Proxy Level
1.5.5. P267 Encryption Key Management
1.5.5.1. Common challenges
2. 4. Cloud Platform & Infrastructure Security
3. 5. Cloud Application Security
4. 1. Cloud Concepts, Architecture and Design
4.1. Mod 1. Cloud Computing concepts
4.1.1. Evolution of IT Service Maturation
4.1.1.1. 1970 - Big Infra, Thick Client Terminals, point to point network (decentralized), Tighly coupled apps
4.1.1.2. 1980 - Rise of Internet. Network latency/application timeouts (due tightly coupled apps), Business exploit WAN
4.1.1.3. 1990 - Wireless mobility, Thin Clients. virtualization, Cloud Computing
4.1.1.4. 2000 - Loosely coupled apps, Elastic and Scalable infra. Agile business, adoption of cloud, Data centric security model not infrastructure centric model
4.1.2. Cloud computing Characteristics (5)
4.1.2.1. Ondemand Self Service/ Scalability
4.1.2.2. Broad network access/ Mobility/Collaboration
4.1.2.3. Resource Pooling/Virtualization
4.1.2.4. Rapid Elasticity - dynamically changing needs
4.1.2.5. Measured Service/Cost Pay per usage/Opex not CapEx
4.1.2.6. Risk reduction - Test ideas before major investments in Technology
4.1.3. Technology Implementation options
4.1.3.1. Enterprise IT - - develop and impose IT Governance
4.1.3.2. Managed service provider - Compliance with enterprise imposed IT governance
4.1.3.3. CSP - acceptance of CSP IT policy (shared model)
4.1.4. Due Diligence
4.1.4.1. CSP, enterprise responsibilities & demarcation
4.1.4.2. CSP IT processes/procedures/operating environment compatible with enterprise
4.1.4.3. CSP infra compliant legal, regulatory, industry requirement
4.1.4.4. Have operational visibility and documentation for audit and security req.
4.1.5. Technology fundamental Services
4.1.5.1. Compute services - auto scaling
4.1.5.2. Storage Services
4.1.5.3. Network Services
4.1.6. CSP Structure
4.1.6.1. Data Centres (Physical)
4.1.6.2. Availability Zones - physical separate location within a region
4.1.6.3. Regions - two or more availability zones - Operational redundancy
4.1.7. Cloud Orchestration operational process, API = REST
4.2. Mod 2 Cloud Reference Architecture
4.2.1. ISO/IEC 17788 Cloud Service Capabilities
4.2.1.1. Software
4.2.1.2. Platform
4.2.1.3. Infrastructure
4.2.2. ISO/IEC 17789 Cloud Computing Reference Architecture (CCRA)
4.2.2.1. User View
4.2.2.1.1. Roles : CSC, CSP, CSN
4.2.2.2. Functional View
4.2.2.2.1. User, Access, Services, Resource Layer
4.2.2.3. Implementation View
4.2.2.4. Deployment View
5. 2. Cloud Goverence - Legal, Risk and Compliance
5.1. Mod 5 : Understand Implications of Cloud to Enterprise Risk management (Organisation change)
5.1.1. Data Owner /Controller & Data Custodian/Processor (GDPR)
5.1.2. Regulatory Transparency Requirement
6. 6. Cloud Security Operations
7. 0. Code of Ethics
7.1. Code of Ethics Premable
7.1.1. Safety & welfare - society, common good, principals, each other - adhere highest ethical behavior
7.1.2. Strict adherence to code
7.2. Code of Ethics Canons
7.2.1. Protect Society, common good, public trust & confidence ad infrastructure
7.2.2. Act Honorably, honestly, justly responsibly and legally
7.2.3. Provide diligent & competent service to principals
7.2.4. Advance & Protect the profession