CONTENTS
Chapter 1 Cloud Computing Concepts and Architectures
Cloud Security Scope and the Shared Responsibility Model
Consensus Assessments Initiative Questionnaire
Cloud Reference and Architecture Models
Chapter 2 Governance and Enterprise Risk Management
The Effects of Service and Deployment Models
Cloud Risk Management Trade-Offs
Assessing Cloud Service Providers
Chapter 3 Legal Issues, Contracts, and Electronic Discovery
Legal Frameworks Governing Data Protection and Privacy
Restrictions to Cross-Border Data Transfers
European Union and European Economic Area
Contracts and Provider Selection
Monitoring, Testing, and Updating
Third-Party Audits and Attestations
Possession, Custody, and Control
Relevant Cloud Applications and Environment
Searchability and E-Discovery Tools
Data Retention Laws and Recordkeeping Obligations
Cooperation Between Provider and Client in E-Discovery
Response to a Subpoena or Search Warrant
Chapter 4 Compliance and Audit Management
Impact of the Cloud on Contracts
How the Cloud Changes Compliance
SOC Reports and ISO Certifications Backgrounder
Chapter 5 Information Governance
Cloud Information Governance Domains
Information Classification Backgrounder
Information Management Backgrounder
Functions, Actors, and Controls
Chapter 6 Management Plane and Business Continuity
Application Programming Interface Backgrounder
Accessing the Management Plane
Business Continuity and Disaster Recovery in the Cloud
Business Continuity Within the Cloud Provider
Business Continuity for Loss of the Cloud Provider
Continuity for Private Cloud and Providers
Chapter 7 Infrastructure Security
OSI Reference Model Backgrounder
Networking Planes Backgrounder
Network Functions Virtualization
How Security Changes with Cloud Networking
Challenges of Virtual Appliances
Microsegmentation and the Software Defined Perimeter
Additional Considerations for CSPs or Private Clouds
Cloud Compute and Workload Security
Compute Abstraction Technologies
How the Cloud Changes Workload Security
Immutable Workloads Enable Security
The Impact of the Cloud on Standard Workload Security Controls
Changes to Workload Security Monitoring and Logging
Changes to Vulnerability Assessment
Chapter 8 Virtualization and Containers
Major Virtualization Categories Relevant to Cloud Computing
Container Definitions Backgrounder
Container Security Recommendations
Incident and Event Backgrounder
Containment, Eradication, and Recovery Phase
How the Cloud Impacts Incident Response
Containment, Eradication, and Recovery
Chapter 10 Application Security
Cloud Impacts on Vulnerability Assessments
Cloud Impact on Penetration Testing
Impact of IaC and Immutable Workloads
How the Cloud Impacts Application Design and Architectures
Security Implications and Advantages of DevOps
Chapter 11 Data Security and Encryption
Managing Data Migrations to the Cloud
Storage (at Rest) Encryption and Tokenization
Key Management (Including Customer-Managed Keys)
Monitoring, Auditing, and Alerting
Additional Data Security Controls
Cloud Platform/Provider-Specific Controls
Data Masking and Test Data Generation
Enforcing Lifecycle Management Security
Chapter 12 Identity, Entitlement, and Access Management
Managing Users and Identities for Cloud Computing
Authentication and Credentials
Entitlements and Access Management
Chapter 13 Security as a Service
Potential Benefits and Concerns of SecaaS
Major Categories of SaaS Offerings
Identity, Entitlement, and Access Management Services
Intrusion Detection/Prevention
Security Information and Event Management (SIEM)
Business Continuity and Disaster Recovery
Distributed Denial of Service Protection
Chapter 14 Related Technologies
Distributed Data Collection Backgrounder
Security and Privacy Considerations
Identity and Access Management
Chapter 15 ENISA Cloud Computing: Benefits, Risks, and Recommendations for Information Security
Security and the Benefits of Scale
Security as a Market Differentiator
Standardized Interfaces for Managed Security Services
Rapid, Smart Scaling of Resources
Timely, Effective, and Efficient Updates and Defaults
Audit and SLAs Force Better Risk Management
Benefits of Resource Concentration
Management Interface Compromise
Insecure or Incomplete Data Deletion
Five Key Legal Issues Common Across All Scenarios
Outsourcing Service and Changes in Control
Risk Concerns of a Cloud Provider Being Acquired
Data Controller vs. Data Processor Definitions
Guest System Monitoring in IaaS Responsibilities
User Provisioning Vulnerability
Underlying Vulnerability in Loss of Governance
Risks R.1–R.35 and Underlying Vulnerabilities
Appendix A Cloud Computing Security Policy Examples
Cloud Security Policy: Centralized Example
Cloud Security Policy: Classification Example
Appendix B About the Online Content
Your Total Seminars Training Hub Account