Cloud Security is the set of security protocols, methodologies and technologies that protect the availability of cloud resources and the integrity of data stored in a cloud computing environment.
Economy of scale and flexibility are the most important aspects of cloud computing even from a security standpoint, since cloud-based defenses can be more robust, scalable and cost-effective. However, all the data and resources available at a single point present a very attractive target for unauthorized access.
Since cloud security requires a multi-layered defense which includes hardening, access control and encryption into the cloud / virtualization layer, it is essential to have a firm understanding of security and compliance requirements prior to moving to the cloud.
Two factors will determine the type and amount of security controls needed and who is responsible for them.
| Type of Cloud: | Public, Private, Hybrid |
| Service Model: | Software-As-A-Service (SAAS) Platform-As-A-Service (PAAS) Infrastructure-As-A-Service (IAAS) |
Cloud Security should be implemented after an informed assessment of the security risks and benefits of using cloud computing.
About this workshop
Security issues / concerns associated with cloud computing fall broadly into two categories:
- Security issues faced by cloud providers offering Software-Platform-Infrastructure (SPI) service models
- Security issues faced by their customers.
This workshop helps participants understand cloud computing fundamentals and the requirements of cloud security covering all the domains outlined by the Cloud Security Alliance (CSA) and the recommendations given by the European Network and Information Security Agency (ENISA).
Participants work on a set of exercises involving scenarios where they need to assess, build and secure a cloud infrastructure and understand how an organization can effectively transition securely into a cloud computing environment.
Benefits
The objective of the workshop is to educate participants how to do an informed assessment of the security risks and benefits of using cloud computing and providing security guidance for potential and existing users of cloud computing.
This workshop covers the essential concepts of cloud security and ensures that the candidate has the fundamental knowledge and skills required to manage cloud computing in a secure environment.
Upon successful completion of this workshop, the participants will be able to:
- understand the cloud computing architectural framework
- understand cloud computing security challenges
- implement cloud computing security controls
This workshop is especially useful for those responsible for managing information security within the organization.
Who should attend
This workshop will significantly benefit professionals responsible for security in a cloud computing environment.
- CEO / CFO / CIO / CTO / CISO
- IS / IT Specialist / Analyst / Manager
- IS / IT Auditor / Consultant
- IS / IT Head / Director
- IT Operations Manager / Head / Director
- IT Compliance Manager / Head / Director
- Security Head / Director
- Security Specialist / Analyst
- Security Manager / Architect
- Security Consultant / Professional
- Security Officer / Engineer
- Security Administrator
- Security Auditor
- Network Specialist / Analyst
- Network Manager / Architect
- Network Consultant / Professional
- Network Administrator
- Senior Systems Engineer
- Systems Analyst
- Systems Administrator
The program is restricted to participants who have basic understanding of security fundamentals, firewalls, secure development, encryption, and identity management.
Workshop Outline
CSA Guidance for Critical Areas of Focus in Cloud Computing
- Domain 1 - Cloud Architecture
- Domain 2 - Governance and Enterprise Risk
- Domain 3 - Legal and Electronic Discovery
- Domain 4 - Compliance and Audit
- Domain 5 - Information Lifecycle Management
- Domain 6 - Portability and Interoperability
- Domain 7 - Traditional Security, BCM, D/R
- Domain 8 - Data Center Operations
- Domain 9 - Incident Response
- Domain 10 - Application Security
- Domain 11 - Encryption and Key Management
- Domain 12 - Identity and Access Management
- Domain 13 - Virtualization
ENISA Cloud Computing: Benefits, Risks and Recommendations for Information Security
- Security benefits of cloud
- Risks and underlying vulnerabilities
- Information assurance framework
- Division of liabilities
- Key legal issues
- Applied Knowledge
- Classify popular cloud providers into S-P-I model
- Redundancy
- Securing popular cloud services
- Vulnerability assessment considerations
- Practical encryption use cases