(ISC)2 CCSP Training Course - The complete six domains

Explore why organizations move to cloud and compare saas, paas, and iaas with public, private, and hybrid deployment models, covering network security, identity and access management, media sanitization, virtualization security.

Explore cloud terminology, computing resources, and service models (software as a service, platform as a service, infrastructure as a service) with deployment models (private, public, hybrid) per Special Publication 801-45.

Discover how a managed service provider remotely manages customer IT infrastructure on a proactive, subscription-based model, offering predictable monthly costs and cloud-based outsourcing.

Compare IaaS, PaaS, and SaaS by showing how much the MSP manages versus what you control, from infrastructure to data and applications, with Office 365 as a SaaS example.

Discover software as a service (saas) as a cloud-based, subscription-driven model you access online without installation or licenses, with provider-managed backups, redundancy, and universal versioning.

Explore platform as a service, where cloud providers supply environments and tools to build online applications via Google App Engine, Azure, and Force.com, with data and app managed by you.

Learn infrastructure as a service (IaaS): lease physical or virtual machines from a cloud provider and manage the OS, apps, and data, with examples like AWS and Rackspace.

Explore cloud deployment types—from public and private to hybrid and community—and weigh their advantages and disadvantages to select the right, cost-effective or secure solution for your organization.

Define cloud deployment by who owns the physical server and virtualization, then outline the public cloud's cost savings, uptime, provider support, service level agreements, and compliance considerations.

Choose a private cloud to keep servers internal with hardware control and physical security. It offers stronger security and easier compliance, but higher costs due to staffing.

Explore how the hybrid cloud connects private and public clouds to balance security and efficiency. Understand the high-level definition, the connection protocols, and safeguarding confidential data.

Explore the community cloud, a rare deployment owned and shared by multiple organizations (e.g., universities) and compare it with public, private, and hybrid options based on cost, security, and compliance.

Explore how to select a cloud solution from a security perspective by defining protection, implementing robust access control (aaa), and considering federation, ease of use, and audits.

Explore cloud data security by examining storage architecture, data lifecycle security, database security, data loss prevention, data encryption, and key management.

Compare storage architecture types: volume (block) storage, object storage, and virtual machine setups. See how per-tenant virtual drives and Dropbox illustrate data storage and why laws shape compliance.

Discover data life cycle security across create, store, use, share, archive, and destroy, with controls like classification, access and rights management, encryption, monitoring, DLP, asset management, and crypto shredding.

Explore information rights management as a data life cycle control that encrypts files and grants specific permissions like read, write, and print. See its use in Office 365 and SharePoint.

Explore information rights management in Office 365, protecting documents and emails by restricting forwarding and printing. Activate it in the Office 365 admin to secure SharePoint libraries.

Explore data loss prevention (DLP) and how it differs from information rights management, with a demonstration of tagging files to prevent leakage.

Use DAM to monitor and record SQL activity in real time, preventing SQL injection. Use FAM to alert on file policy violations, with DLP as an additional safeguard.

Learn encryption considerations for cloud data, including encryption in transit with ssl/tls, encryption at rest, regulatory compliance, and strong open standards with proper key management to protect against third-party access.

Explore management control by enforcing separation of duties, implement identification authentication authorization and accounting procedures, and conduct annual vulnerability assessments, penetration tests, and policy-driven backup, logging, and secure disposal practices.

Learn best practices for log management, including what logs to manage, retention, storage, and disposal. Understand infrastructure, planning, and regular review to prevent access gaps and lingering firewall configurations.

Explore cloud platform and infrastructure security, focusing on virtualization benefits, vulnerabilities, and best practices to secure hypervisors, virtual machines, performance, operation, and physical security.

Secure the hypervisor and virtualization environment by applying guest operating system security practices, baseline security policies, patch management, and restricted admin access, especially for cloud deployments.

Examine virtualization attacks such as internal vm attacks and blind spots between virtual machines, their impact on availability and performance, and issues with too many virtual machines on one host.

Explore perimeter security for data centers using the four ds: deter, detect, delay, deny, covering site location, surveillance, access controls, and cloud backup and business continuity planning.

Explore securing cloud applications across the sdlc, implement software security controls, apply cloud cryptography, understand common computing architectures and cloud threats, and master vulnerability assessment and penetration testing.

Master the software development life cycle with a security focus, from requirement analysis and design to implementation and testing, including penetration testing and vulnerability assessment across all phases (cloud included).

Explore the OWASP top ten web application attacks, including SQL injection, cross-site scripting, and broken authentication. Identify practical security controls and see demonstrations to prevent these threats in software.

Learn how SQL injection exploits poorly validated inputs to bypass authentication, map the structure of databases, and test vulnerabilities in a lab using sqlmap in Kali Linux.

Explore SQL injection attack, its weaknesses in websites, and how attackers can dump database information and gain admin access, all demonstrated in a controlled simulation with Kali Linux tools.

Explore cross-site scripting, including stored and reflected forms, where JavaScript injections target servers and steal user session IDs. Learn how attackers use browsers and tools like Greasemonkey.

Review code during development with cloud-based analysis to identify security flaws, then validate inputs, enforce access control, and protect data with encryption and logs.

Explore how cryptography secures cloud data via the CIA triad by encrypting data in motion and at rest, with organization-owned key management and TLS/SSL, IPsec, and BitLocker.

Explores centralized computing with mainframes and terminals, then server-client and distributed architectures, including thin clients and client-side data, and examines peer-to-peer risks and security implications.

Master access management with authentication, authorization, and accounting, comparing password, biometric, and token options, and exploring DAC, MAC, RBAC models, plus logging and compliance requirements.

Examine cloud threats, including data breaches and account hijacking that threaten confidentiality, and emphasize access controls, authentication, authorization, backups, redundancy, and disaster recovery planning for availability.

Explore how business continuity planning and disaster recovery planning protect information in cloud environments and ensure services remain available for critical organizations. Clarify RTO, RPO, MTD, and exam relevance.

Differentiate business continuity planning from disaster recovery planning. Identify critical business functions and perform risk evaluation and business impact analysis to guide strategy and training.

Explore how disaster recovery plans focus on technical recovery of systems, assess risk and cost-benefit, and cover short-term, mid-term, long-term backups—mirroring, rebuilding, and full, incremental, and differential backups.

This lecture defines MTD, RTO, RPO, MTBF, and MTTR used in a BCP. It covers the program coordinator role, full interrupt test, walking-through, and parallel tests, plus evacuation.

Conduct vulnerability assessment and penetration testing to identify weaknesses, prove exploitability, and guide patch management and remediation.

Explore domain five of the ISC2 CCSP program: operation security and risk management, examining physical, environmental, air control, and network controls to verify cloud service provider safeguards.

Assess cloud service provider physical security by verifying data center temperature, humidity, sprinklers, and electricity stability. Evaluate location and barriers to protect data from earthquakes and intruders.

Explains administrative security practices for human resource and operation security, detailing policies on background checks, ndas, termination, and separation of duties, job rotation, and mandatory vacations to prevent insider risk.

Secure hardware with a baseline image including antivirus and firewall, so devices join the network safely. Implement vlans, dmz, nac, and secure wireless settings to reduce exposure.

Explore risk management basics, defining risk as an uncertain event, and learn to plan risk management, assess risk tolerance, and compute risk as probability times impact for contingency and reserve.

Identify assets, vulnerabilities, and threats, quantify risk with formulas like risk equals threat into vulnerability or probability into impact, and apply mitigation, acceptance, avoidance, or transferring to control losses.

Identify data and information assets, apply exposure factor and single loss expectancy and annual loss expectancy formulas, and use Delphi technique to prioritize risks and assess countermeasure cost effectiveness.

Explore domain six: legal and compliance, covering incident management and incident response, computer forensics, type of evidence, and cybercrime laws and regulations.

Learn how incident response and incident management distinguish events, alerts, and incidents, and how documenting, reporting, and acting on security incidents improves organizational security through a full incident lifecycle.

Explore computer forensics in incident management by learning how to collect legal digital evidence—logs and surveillance videos—without modification and with proper qualifications or supervision.

Identify the main types of evidence, including direct evidence like witness testimony and physical devices, best evidence such as signed contracts, and secondary evidence like expert opinions.

Understand law, regulation, and compliance in information security, including common law, civil, criminal, and administrative frameworks, with HIPAA and Sox considerations guiding responsibility.

Understand legal responsibility in security, emphasizing due diligence, due care, prudent person standard, and annual penetration testing and vulnerability assessments to respond to breaches within regulatory expectations.