The Official (ISC)2 Guide to the CCSP CBK

Globally recognized and backed by the Cloud Security Alliance (CSA) and the (ISC)2 the CCSP credential is the ideal way to match marketability and credibility to your cloud security skill set. The Official (ISC)2® Guide to the CCSPSM CBK® is your ticket for expert insight through the 6 CCSP domains. You will find step-by-step guidance through real-life scenarios, illustrated examples, tables, best practices, and more. Sample questions help you reinforce what you have learned and prepare smarter. Easy-to-follow content guides you through • Major topics and subtopics within the 6 domains • Detailed description of exam format • Exam registration and administration policies Reviewed by cloud security experts, and developed by (ISC)2, this is your study guide to fully preparing for the CCSP and reaffirming your unique cloud security skills. Get ready for the next step in your career with Official (ISC)2 Guide to the CCSP CBK.

Table of Contents:
Foreword xix Introduction xxi Domain 1: Architectural Concepts and Design Requirements Domain 1 Introduction 3 Drivers for Cloud Computing 4 Security/Risks and Benefits 5 Cloud Computing Definitions 7 Cloud Computing Roles 12 Key Cloud Computing Characteristics 13 Cloud Transition Scenario 15 Building Blocks 16 Cloud Computing Activities 17 Cloud Service Categories 18 Infrastructure as a Service (IaaS) 18 Platform as a Service (PaaS) 20 Software as a Service (SaaS) 22 Cloud Deployment Models 24 The Public Cloud Model 24 The Private Cloud Model 24 The Hybrid Cloud Model 25 The Community Cloud Model 26 Cloud Cross-Cutting Aspects 26 Architecture Overview 26 Key Principles of an Enterprise Architecture 28 The NIST Cloud Technology Roadmap 29 Network Security and Perimeter 33 Cryptography 34 Encryption 34 Key Management 36 IAM and Access Control 38 Provisioning and De-Provisioning 38 Centralized Directory Services 39 Privileged User Management 39 Authorization and Access Management 40 Data and Media Sanitization 41 Vendor Lock-In 41 Cryptographic Erasure 42 Data Overwriting 42 Virtualization Security 43 The Hypervisor 43 Security Types 44 Common Threats 44 Data Breaches 45 Data Loss 45 Account or Service Traffic Hijacking 46 Insecure Interfaces and APIs 46 Denial of Service 47 Malicious Insiders 47 Abuse of Cloud Services 47 Insufficient Due Diligence 48 Shared Technology Vulnerabilities 48 Security Considerations for Different Cloud Categories 49 Infrastructure as a Services (IaaS) Security 49 Platform as a Service (PaaS) Security 52 Software as a Service (SaaS) Security 53 Open Web Application Security Project (OWASP) Top Ten Security Threats 55 Cloud Secure Data Lifecycle 57 Information/Data Governance Types 58 Business Continuity/Disaster Recovery Planning 58 Business Continuity Elements 59 Critical Success Factors 59 Important SLA Components 60 Cost-Benefit Analysis 61 Certification Against Criteria 63 System/Subsystem Product Certification 69 Summary 73 Review Questions 74 Notes 78 Domain 2: Cloud Data Security Domain 81 Introduction 83 The Cloud Data Lifecycle Phases 84 Location and Access of Data 86 Location 86 Access 86 Functions, Actors, and Controls of the Data 86 Key Data Functions 87 Controls 88 Process Overview 88 Tying It Together 89 Cloud Services, Products, and Solutions 89 Data Storage 90 Infrastructure as a Service (IaaS) 90 Platform as a Service (PaaS) 91 Software as a Service (SaaS) 92 Threats to Storage Types 93 Technologies Available to Address Threats 94 Relevant Data Security Technologies 94 Data Dispersion in Cloud Storage 95 Data Loss Prevention (DLP) 95 Encryption 98 Masking, Obfuscation, Anonymization, and Tokenization 105 Application of Security Strategy Technologies 109 Emerging Technologies 110 Bit Splitting 110 Homomorphic Encryption 111 Data Discovery 111 Data Discovery Approaches 112 Different Data Discovery Techniques 112 Data Discovery Issues 113 Challenges with Data Discovery in the Cloud 114 Data Classification 115 Data Classification Categories 116 Challenges with CloudData 116 Data Privacy Acts 117 Global P&DP Laws in the United States 117 Global P&DP Laws in the European Union (EU) 118 Global P&DP Laws in APEC 119 Differences Between Jurisdiction and Applicable Law 119 Essential Requirements in P&DP Laws 119 Typical Meanings for Common Privacy Terms 119 Privacy Roles for Customers and Service Providers 120 Responsibility Depending on the Type of Cloud Services 121 Implementation of Data Discovery 123 Classification of Discovered Sensitive Data 124 Mapping and Definition of Controls 127 Privacy Level Agreement (PLA) 128 PLAs vs. Essential P&DP Requirements Activity 128 Application of Defined Controls for Personally Identifiable Information (PII) 132 Cloud Security Alliance Cloud Controls Matrix (CCM) 133 Management Control for Privacy and Data Protection Measures 136 Data Rights Management Objectives 138 IRM Cloud Challenges 138 IRM Solutions 139 Data-Protection Policies 140 Data-Retention Policies 140 Data-Deletion Procedures and Mechanisms 141 Data Archiving Procedures and Mechanisms 143 Events 144 Event Sources 144 Identifying Event Attribute Requirements 146 Storage and Analysis of Data Events 148 Security and Information Event Management (SIEM) 148 Supporting Continuous Operations 150 Chain of Custody and Non-Repudiation 151 Summary 152 Review Questions 152 Notes 155 Domain 3: Cloud Platform and Infrastructure Security Domain 157 Introduction 159 The Physical Environment of the Cloud Infrastructure 159 Datacenter Design 160 Network and Communications in the Cloud 161 Network Functionality 162 Software Defined Networking (SDN) 162 The Compute Parameters of a Cloud Server 163 Virtualization 164 Scalability 164 The Hypervisor 164 Storage Issues in the Cloud 166 Object Storage 166 Management Plane 167 Management of Cloud Computing Risks 168 Risk Assessment/Analysis 169 Cloud Attack Vectors 172 Countermeasure Strategies Across the Cloud 172 Continuous Uptime 173 Automation of Controls 173 Access Controls 174 Physical and Environmental Protections 175 Key Regulations 175 Examples of Controls 175 Protecting Datacenter Facilities 175 System and Communication Protections 176 Automation of Configuration 177 Responsibilities of Protecting the Cloud System 177 Following the Data Lifecycle 178 Virtualization Systems Controls 178 Managing Identification, Authentication, and Authorization in the Cloud Infrastructure 180 Managing Identification 181 Managing Authentication 181 Managing Authorization 181 Accounting for Resources 181 Managing Identity and Access Management 182 Making Access Decisions 182 The Entitlement Process 182 The Access Control Decision-Making Process 183 Risk Audit Mechanisms 184 The Cloud Security Alliance Cloud Controls Matrix 185 Cloud Computing Audit Characteristics 185 Using a Virtual Machine (VM) 186 Understanding the Cloud Environment Related to BCDR 186 On-Premise, Cloud as BCDR 186 Cloud Consumer, Primary Provider BCDR 187 Cloud Consumer, Alternative Provider BCDR 187 BCDR Planning Factors 188 Relevant Cloud Infrastructure Characteristics 188 Understanding the Business Requirements Related to BCDR 189 Understanding the BCDR Risks 191 BCDR Risks Requiring Protection 191 BCDR Strategy Risks 191 Potential Concerns About the BCDR Scenarios 192 BCDR Strategies 192 Location 193 Data Replication 194 Functionality Replication 195 Planning, Preparing, and Provisioning 195 Failover Capability 195 Returning to Normal 196 Creating the BCDR Plan 196 The Scope of the BCDR Plan 196 Gathering Requirements and Context 196 Analysis of the Plan 197 Risk Assessment 197 Plan Design 198 Other Plan Considerations 198 Planning, Exercising, Assessing, and Maintaining the Plan 199 Test Plan Review 201 Testing and Acceptance to Production 204 Summary 204 Review Questions 205 Notes 207 Domain 4: Cloud Application Security 209 Introduction 211 Determining Data Sensitivity and Importance 212 Understanding the Application Programming Interfaces (APIs) 212 Common Pitfalls of Cloud Security Application Deployment 213 On-Premise Does Not Always Transfer (and Vice Versa) 214 Not All Apps Are “Cloud-Ready” 214 Lack of Training and Awareness 215 Documentation and Guidelines (or Lack Thereof) 215 Complexities of Integration 215 Overarching Challenges 216 Awareness of Encryption Dependencies 217 Understanding the Software Development Lifecycle (SDLC) Process for a Cloud Environment 217 Secure Operations Phase 218 Disposal Phase 219 Assessing Common Vulnerabilities 219 Cloud-Specific Risks 222 Threat Modeling 224 STRIDE Threat Model 224 Approved Application Programming Interfaces (APIs) 225 Software Supply Chain (API) Management 225 Securing Open Source Software 226 Identity and Access Management (IAM) 226 Identity Management 227 Access Management 227 Federated Identity Management 227 Federation Standards 228 Federated Identity Providers 229 Federated Single Sign-on (SSO) 229 Multi-Factor Authentication 229 Supplemental Security Devices 230 Cryptography 231 Tokenization 232 Data Masking 232 Sandboxing 233 Application Virtualization 233 Cloud-Based Functional Data 234 Cloud-Secure Development Lifecycle 235 ISO/IEC 27034-1 236 Organizational Normative Framework (ONF) 236 Application Normative Framework (ANF) 237 Application Security Management Process (ASMP) 237 Application Security Testing 238 Static Application Security Testing (SAST) 238 Dynamic Application Security Testing (DAST) 239 Runtime Application Self Protection (RASP) 239 Vulnerability Assessments and Penetration Testing 239 Secure Code Reviews 240 Open Web Application Security Project (OWASP) Recommendations 240 Summary 241 Review Questions 241 Notes 243 Domain 5: Operations Domain 245 Introduction 247 Modern Datacenters and Cloud Service Offerings 247 Factors That Impact Datacenter Design 247 Logical Design 248 Physical Design 250 Environmental Design Considerations 253 Multi-Vendor Pathway Connectivity (MVPC) 257 Implementing Physical Infrastructure for Cloud Environments 257 Enterprise Operations 258 Secure Configuration of Hardware: Specific Requirements 259 Best Practices for Servers 259 Best Practices for Storage Controllers 260 Network Controllers Best Practices 262 Virtual Switches Best Practices 263 Installation and Configuration of Virtualization Management Tools for the Host 264 Leading Practices 265 Running a Physical Infrastructure for Cloud Environments 265 Configuring Access Control and Secure KVM 269 Securing the Network Configuration 270 Network Isolation 270 Protecting VLANs 270 Using Transport Layer Security (TLS) 271 Using Domain Name System (DNS) 272 Using Internet Protocol Security (IPSec) 273 Identifying and Understanding Server Threats 274 Using Stand-Alone Hosts 275 Using Clustered Hosts 277 Resource Sharing 277 Distributed Resource Scheduling (DRS)/Compute Resource Scheduling 277 Accounting for Dynamic Operation 278 Using Storage Clusters 279 Clustered Storage Architectures 279 Storage Cluster Goals 279 Using Maintenance Mode 280 Providing High Availability on the Cloud 280 Measuring System Availability 280 Achieving High Availability 281 The Physical Infrastructure for Cloud Environments 281 Configuring Access Control for Remote Access 283 Performing Patch Management 285 The Patch Management Process 286 Examples of Automation 286 Challenges of Patch Management 287 Performance Monitoring 289 Outsourcing Monitoring 289 Hardware Monitoring 289 Redundant System Architecture 290 Monitoring Functions 290 Backing Up and Restoring the Host Configuration 291 Implementing Network Security Controls: Defense in Depth 292 Firewalls 292 Layered Security 293 Utilizing Honeypots 295 Conducting Vulnerability Assessments 296 Log Capture and Log Management 297 Using Security Information and Event Management (SIEM) 299 Developing a Management Plan 300 Maintenance 301 Orchestration 301 Building a Logical Infrastructure for Cloud Environments 302 Logical Design 302 Physical Design 302 Secure Configuration of Hardware-Specific Requirements 303 Running a Logical Infrastructure for Cloud Environments 304 Building a Secure Network Configuration 304 OS Hardening via Application Baseline 305 Availability of a Guest OS 307 Managing the Logical Infrastructure for Cloud Environments 307 Access Control for Remote Access 308 OS Baseline Compliance Monitoring and Remediation 309 Backing Up and Restoring the Guest OS Configuration 309 Implementation of Network Security Controls 310 Log Capture and Analysis 310 Management Plan Implementation Through the Management Plane 311 Ensuring Compliance with Regulations and Controls 311 Using an IT Service Management (ITSM) Solution 312 Considerations for Shadow IT 312 Operations Management 313 Information Security Management 314 Configuration Management 314 Change Management 315 Incident Management 319 Problem Management 322 Release and Deployment Management 322 Service Level Management 323 Availability Management 324 Capacity Management 324 Business Continuity Management 324 Continual Service Improvement (CSI) Management 325 How Management Processes Relate to Each Other 325 Incorporating Management Processes 327 Managing Risk in Logical and Physical Infrastructures 327 The Risk-Management Process Overview 328 Framing Risk 328 Risk Assessment 329 Risk Response 338 Risk Monitoring 344 Understanding the Collection and Preservation of Digital Evidence 344 Cloud Forensics Challenges 345 Data Access within Service Models 346 Forensics Readiness 347 Proper Methodologies for Forensic Collection of Data 347 The Chain of Custody 353 Evidence Management 355 Managing Communications with Relevant Parties 355 The Five Ws and One H 355 Communicating with Vendors/Partners 356 Communicating with Customers 357 Communicating with Regulators 358 Communicating with Other Stakeholders 359 Wrap Up: Data Breach Example 359 Summary 359 Review Questions 360 Notes 365 Domain 6: Legal and Compliance Domain 369 Introduction 371 International Legislation Conflicts 371 Legislative Concepts 372 Frameworks and Guidelines Relevant to Cloud Computing 374 Organization for Economic Cooperation and Development (OECD)—Privacy & Security Guidelines 374 Asia Pacific Economic Cooperation (APEC) Privacy Framework 375 EU Data Protection Directive 375 General Data Protection Regulation 378 ePrivacy Directive 378 Beyond Frameworks and Guidelines 378 Common Legal Requirements 378 Legal Controls and Cloud Providers 380 eDiscovery 381 eDiscovery Challenges 381 Considerations and Responsibilities of eDiscovery 382 Reducing Risk 382 Conducting eDiscovery Investigations 383 Cloud Forensics and ISO/IEC 27050-1 383 Protecting Personal Information in the Cloud 384 Differentiating Between Contractual and Regulated Personally Identifiable Information (PII) 385 Country-Specific Legislation and Regulations Related to PII/Data Privacy/Data Protection 389 Auditing in the Cloud 398 Internal and External Audits 399 Types of Audit Reports 400 Impact of Requirement Programs by the Use of Cloud Services 402 Assuring Challenges of the Cloud and Virtualization 402 Information Gathering 404 Audit Scope 404 Cloud Auditing Goals 407 Audit Planning 407 Standard Privacy Requirements (ISO/IEC 27018) 410 Generally Accepted Privacy Principles (GAPP) 410 Internal Information Security Management System (ISMS) 411 The Value of an ISMS 412 Internal Information Security Controls System: ISO 27001:2013 Domains 412 Repeatability and Standardization 413 Implementing Policies 414 Organizational Policies 414 Functional Policies 415 Cloud Computing Policies 415 Bridging the Policy Gaps 416 Identifying and Involving the Relevant Stakeholders 416 Stakeholder Identification Challenges 417 Governance Challenges 417 Communication Coordination 418 Impact of Distributed IT Models 419 Communications/Clear Understanding 419 Coordination/Management of Activities 420 Governance of Processes/Activities 420 Coordination Is Key 421 Security Reporting 421 Understanding the Implications of the Cloud to Enterprise Risk Management 422 Risk Profile 423 Risk Appetite 423 Difference Between Data Owner/Controller and Data Custodian/Processor 423 Service Level Agreement (SLA) 424 Risk Mitigation 429 Risk-Management Metrics 429 Different Risk Frameworks 430 Understanding Outsourcing and Contract Design 432 Business Requirements 432 Vendor Management 433 Understanding Your Risk Exposure 433 Accountability of Compliance 434 Common Criteria Assurance Framework 434 CSA Security, Trust, and Assurance Registry (STAR) 435 Cloud Computing Certification: CCSL and CCSM 436 Contract Management 437 Importance of Identifying Challenges Early 438 Key Contract Components 438 Supply Chain Management 441 Supply Chain Risk 441 Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) 442 The ISO 28000:2007 Supply Chain Standard 442 Summary 443 Review Questions 444 Notes 446 Appendix A: Answers to Review Questions 449 Domain 1: Architectural Concepts and Design Requirements 449 Domain 2: Cloud Data Security 459 Domain 3: Cloud Platform and Infrastructure Security 469 Domain 4: Cloud Application Security 475 Domain 5: Operations 479 Domain 6: Legal and Compliance Issues 492 Notes 499 Appendix B: Glossary 501 Appendix C: Helpful Resources and Links 511 Index 535