This course provides a solid foundation in cloud security and includes a full day of hands-on labs to apply the principles in practice. We cover all the material needed to pass the Cloud Security Alliance Certificate of Cloud Security Knowledge (CCSK) exam, but add a pragmatic approach to immediately kick start your cloud security projects. For Black Hat we also add expanded material to show you how to take cloud security to the next level by leveraging DevOps techniques and the characteristics of the cloud.
The course is designed to appeal to a wide range of skill levels, but we highly recommend a solid security foundation and, for the labs, experience making SSH connections. While most of the labs occur in a web browser, you will need to connect to Linux cloud servers and copy and paste a handful of command lines.
Day 1 - The first day of the class is all lecture, with 6 modules that cover the 14 domains of the CSA Guidance. The material is expanded to show the theory working in practice. The modules are:
Module 1: Introduction to Cloud Computing. This module covers the fundamentals of cloud computing, including definitions, architectures, and the role of virtualization. Key topics include cloud computing service models, delivery models, and fundamental characteristics. It also introduces a model for assessing the risk of moving to the cloud.
Module 2: Securing Cloud Infrastructure. This module digs into the details of the different cloud delivery models and their basic security issues. Students will learn the differences between security responsibilities for SaaS, PaaS, and IaaS and key questions to ask a potential provider. It includes recommendations for both public and private cloud. The instructors will also demonstrate creating and applying security to a simple cloud instance on IaaS.
Module 3: Managing Cloud Security and Risk. This module covers important considerations for managing security for cloud computing. It begins with risk assessment and governance, then covers legal and compliance issues such as discovery requirements in the cloud. It finishes with a discussion of portability and interoperability and managing incident response when working with cloud providers.
Module 4: Securing Cloud Data. One of the biggest issues in cloud security is protecting data. This module covers information lifecycle management for the cloud and how to apply security controls. Topics include the data security lifecycle, cloud storage models, data security issues with different delivery models, and managing encryption in and for the cloud.
Module 5: Securing Cloud Users and Applications. This module covers identity management and application security for cloud deployments. Topics include federated identity and different IAM applications, secure development, and managing application security in and for the cloud.
Module 6: Selecting and Working with Cloud Providers. In this module, we review the key questions and considerations when selecting a cloud provider and how to work with them over time. This includes both cloud computing providers and security-as-a-service providers.
Day 2 - The second day of CCSK-Plus training includes expanded material and extensive hands-on activities. Students will learn to apply their knowledge, performing a series of exercises as they complete a scenario bringing a fictional organization securely into the cloud. This second day of training includes additional lecture (although students will spend most of their time assessing), building, and securing a cloud infrastructure during the exercises.
Course Outline:
Exercise 1: Introduction and Risk Analysis. Students will be introduced to the day's scenario and build a threat model for migrating to the cloud.
Exercise 2: Create and Secure a Public Cloud Instance. Students will create a basic cloud instance on a public cloud infrastructure and establish a security baseline. Topics include creating an AWS instance, establishing network security, and understanding machine images.
Exercise 3: Encrypt Public Cloud Data. In this module, students will dive into cloud storage options and learn the basics to encrypt data for their public cloud deployment.
Exercise 4: Create and Secure a Cloud Application: Now the students will secure their first public application for the cloud, following best practices such as architecting their cloud application stack and managing appropriate network security.
Advanced Interlude: For Black Hat, we expand with a section on leveraging DevOps techniques and Software Defined Security. Students will learn to leverage AWS IAM Roles to automatically provision Chef security configurations to new instances through launch scripts. Then, we demonstrate a Ruby program (code provided) to instantly identify all unmanaged instances in the cloud.
Exercise 5: Identity Management for the Cloud. Students will create a basic federated identity infrastructure to support their cloud application and learn additional details on standards like SAML and OAuth.
Exercise 6: Create and Secure a Private Cloud. Students will establish a basic private cloud, then launch and secure their first cloud instances.
WHAT MAKES YOUR COURSE UNIQUE?
This course meets the Cloud Security Alliance CCSK-Plus requirements, which were developed by the instructors (Securosis). For Black Hat, we build upon the base course with the inclusion of advanced material that is not taught any place else.
Security professionals who need to understand cloud computing security.
A basic understanding of security fundamentals. You should know what most or all of the following terms mean: IAM, federated identity, hypervisor, SSH, key management, SDLC, IDS, and DLP. We cover more, but if you know most of those, you are ready. We also highly recommend you know how to use SSH and aren't afraid of entering a few pre-scripted commands into a terminal because we will be connecting to Linux instances.
A laptop with wireless connectivity. Preferably a 64-bit processor with a minimum of 4 GBof RAM (students can still use less powerful laptops if needed). Students will also need to create an Amazon Web Services account prior to the start of class (instructions will be provided).
Rich Mogull, analyst and CEO, has twenty years experience in information security, physical security, and risk management. He specializes in cloud security, data security, emerging security technologies, and security management. Rich is the primary developer of the Cloud Security Alliance CCSK training program. Prior to founding Securosis, Rich was a research vice president at Gartner on the security team, where he also served as research co-chair for the Gartner Security Summit. Prior to his seven years at Gartner, Rich worked as an independent consultant, web application developer, software development manager at the University of Colorado, and systems and network administrator. Rich is the Security Editor of TidBITS, a monthly columnist for Dark Reading, and a frequent contributor to publications ranging from Information Security Magazine to Macworld. He is a frequent industry speaker at events including the RSA Security Conference and DEF CON, and has spoken on every continent except Antarctica (where he's happy to speak for free -- assuming travel is covered).
