CCSP Domain 5 - Cloud Security Operations

In this video we will cover:

• Firewall/NSG

In this video you will learn:

There are two basic types of firewalls. They are static packet filtering and dynamic packet filters. Static is the oldest and dynamic is the newer.

Static packet filters basically look at the individual packet, a single packet comes in and the firewall analyzes that packet. This does not catch bad packets that spread an attack over many packets.

For example, one individual packet comes through and the firewall will take a look at it based on what type of firewall it is. If it’s good, the firewall will let the packet move to its destination and then the other packet comes along and the firewall follows the same method.

Bad actors learned that we did this so they split the attacks into multiple packets. So we updated to dynamic packet filtering also known as stateful inspection.

This takes the last packet(s) into consideration before forwarding a packet on.

We encourage you to learn more about Firewalls/NSG by watching this complete video. See you in the Next Video.

In this video we will cover:

• IDS/IPS

In this video you will learn:

An IDS (Intrusion Detection System) is either a hardware device or software that monitors and logs network events. A network-based IDS is usually installed on a span port on a switch. This allows it to view traffic by receiving a copy of what was sent through the switch.

It can also be installed as a host-based IDS, meaning it can be installed on the end device: the computer, virtual machine, server, etc. When installed on the host it often examines the logs, not the packets.

Meanwhile, the IPS (Intrusion Prevention System) is also a device or software installed on the network or the host. It is inline, for network based IPS. Traffic must pass through the IPS. By being inline it can actively react to malicious traffic and block its transmission.

The intrusion detection system (IDS) is passive, Intrusion prevention system is active.

We encourage you to learn more about IDS/IPS by watching this complete video. See you in the Next Video.

In this video we will cover:

• ITIL/ISO 20000

  
  

In this video you will learn:

ITIL used to be an acronym that stands for Information technology infrastructure library. It is now known just as ITIL. The international community created a version of ITIL known now as ISO 20000. ISO 20000 is compatible with ITIL.

ITIL is really all about data centers and running networks, it is how to manage networks effectively. It is about managing the services that IT provides to the business. If it’s not managed properly then it’s a big problem for a business and can cost it a lot of money. So, it’s all about management and how you manage IT is all about processes. We can also say that ITIL is all about change management and configuration management.

We encourage you to learn more about ITIL/ISO 20000 by watching this complete video. See you in the Next Video.

In this video we will cover:

• ITIL Continuity/Incident/Problem management

  
  

In this video you will learn:

In data centers, you need to have processes and procedures. When you get into those processes and procedures we get into more specific things like continuity, incident management, and problem management.

Business continuity is something that is in this domain and we will talk about that. Also disaster recovery we need to talk about. We talk about incident management and incident response. Problem is something that keeps happening and it is essential to find the root cause so that we can prevent it from happening again.

We encourage you to learn more about ITIL Continuity/Incident/Problem management by watching this complete video. See you in the Next Video.

In this video we will cover:

• Security Operations Center

  
  

In this video you will learn:

The security operation center is responsible for monitoring and managing security. The goal is to know that the incidents are happening (detect) and then respond accordingly. Incident response and disaster recovery are managed out of the SOC.

Incidents should be contained and their impact minimized. The SOC is going to respond to the indications of compromise (IoC) that are a result of logs coming in from all devices into the Security Information Event Manager (SIEM).

We encourage you to learn more about the Security Operations Center by watching this complete video. See you in the Next Video.

In this video we will cover:

• Logging

In this video you will learn:

Logs are fed into the security information event manager (SIEM) from everything. In the cloud, you must turn logging on, and direct the logs to the correct destination for storage and processing. Logs are going to come from everything like IDS, IPS, and Firewalls servers and it doesn’t matter whether they are virtual or real and it doesn’t matter what kind of applications, they should be coming from everything and anything. Now exactly what you want to log is a question that must be answered first.

In SaaS, the customer should be able to see events related to their own user access control events. In PaaS logs from the applications and software installed on the platform should generate logs that are visible to the customer. Logs from the OS may provide the customer with access control information.

In IaaS the customer should have access to all of the logs for the VMs that they build as well as logs for access to the Hypervisor for that creation and monitoring.

We encourage you to learn more about Logging by watching this complete video. See you in the Next Video.