CCSP Domain 5 - Cloud Security Operations

Name: CCSP Domain 5 - Cloud Security Operations
Rating: 4.6 (152 reviews)

Exam preparation - This domain is in alignment with the August 2022 exam outline

Created byGwen Bettwy | over 31,000 enrollments worldwide

Last updated 2/2023

English

English [Auto],Japanese [Auto],

What you'll learn

Understand what (ISC)2 expects you to know about the cloud operations.
Comprehend
Explain
Understand

Course content

9 sections • 33 lectures • 3h 5m total length

Introduction to Operations1:21
In this video we will cover:

Operations

In this video you will learn:

This domain is mainly from the cloud provider’s perspective. There is some from the customer perspective as well, but mainly this domain is about the cloud providers' side. If you are not familiar with working with big data centers or carriers, watch some videos about data centers.

We encourage you to learn more about Introduction to Operations by watching this complete video. See you in the Next Video.
Building Secure Data Center10:33
Explore building secure data centers: rack hardware, initial device configuration via kvm, and remote management with rdp or ssh, plus stringent access, surveillance, and drive disposal practices.
Manage Cloud Environment /DC5:37
In this video we will cover:

Manage Physical Networks

In this video you will learn:

Managing data centers gets us into maintaining the physical network. Somebody does have to monitor the CPU, fans, temperature of the equipment, and temperature of the data center. Making sure each system is working properly.

Somebody needs to take care of that part. They know If the drive is failing because they are looking at the screens, or the power supply is failing or the fan is failing or some part of the equipment is failing. With datacenter switches, routers, and servers are usually hot-swappable. So it is possible to replace a failing part without disrupting the environment. This is definitely from the cloud provider's perspective.

We encourage you to learn more about Manage Physical Networks by watching this complete video. See you in the Next Video.
Patch Management3:22
In this video we will cover:

Patch Management

In this video you will learn:

There is also the patching of the equipment. The operating systems that are on the servers, the switches, and the routers all have to be patched. They have to be taken care of.

You need to back up the router configuration, switch configuration, and server configuration, and If you back up something you have to test the backup.

We encourage you to learn more about Patch Management by watching this complete video. See you in the Next Video.

Firewalls & Network Security Groups4:40
In this video we will cover:

Firewall/NSG

In this video you will learn:

There are two basic types of firewalls. They are static packet filtering and dynamic packet filters. Static is the oldest and dynamic is the newer.
Static packet filters basically look at the individual packet, a single packet comes in and the firewall analyzes that packet. This does not catch bad packets that spread an attack over many packets.

For example, one individual packet comes through and the firewall will take a look at it based on what type of firewall it is. If it’s good, the firewall will let the packet move to its destination and then the other packet comes along and the firewall follows the same method.
Bad actors learned that we did this so they split the attacks into multiple packets. So we updated to dynamic packet filtering also known as stateful inspection.
This takes the last packet(s) into consideration before forwarding a packet on.

We encourage you to learn more about Firewalls/NSG by watching this complete video. See you in the Next Video.
Intrusion Detection and Intrusion Prevention Systems4:16
In this video we will cover:

IDS/IPS

In this video you will learn:

An IDS (Intrusion Detection System) is either a hardware device or software that monitors and logs network events. A network-based IDS is usually installed on a span port on a switch. This allows it to view traffic by receiving a copy of what was sent through the switch.

It can also be installed as a host-based IDS, meaning it can be installed on the end device: the computer, virtual machine, server, etc. When installed on the host it often examines the logs, not the packets.

Meanwhile, the IPS (Intrusion Prevention System) is also a device or software installed on the network or the host. It is inline, for network based IPS. Traffic must pass through the IPS. By being inline it can actively react to malicious traffic and block its transmission.

The intrusion detection system (IDS) is passive, Intrusion prevention system is active.

We encourage you to learn more about IDS/IPS by watching this complete video. See you in the Next Video.

ITIL & ISO/IEC 200005:48
In this video we will cover:

ITIL/ISO 20000

In this video you will learn:

ITIL used to be an acronym that stands for Information technology infrastructure library. It is now known just as ITIL. The international community created a version of ITIL known now as ISO 20000. ISO 20000 is compatible with ITIL.

ITIL is really all about data centers and running networks, it is how to manage networks effectively. It is about managing the services that IT provides to the business. If it’s not managed properly then it’s a big problem for a business and can cost it a lot of money. So, it’s all about management and how you manage IT is all about processes. We can also say that ITIL is all about change management and configuration management.
We encourage you to learn more about ITIL/ISO 20000 by watching this complete video. See you in the Next Video.
ITIL Continuity, Incident and Problem management7:48
In this video we will cover:

ITIL Continuity/Incident/Problem management

In this video you will learn:

In data centers, you need to have processes and procedures. When you get into those processes and procedures we get into more specific things like continuity, incident management, and problem management.

Business continuity is something that is in this domain and we will talk about that. Also disaster recovery we need to talk about. We talk about incident management and incident response. Problem is something that keeps happening and it is essential to find the root cause so that we can prevent it from happening again.

We encourage you to learn more about ITIL Continuity/Incident/Problem management by watching this complete video. See you in the Next Video.

Security Operations Center (SOC)4:55
In this video we will cover:

Security Operations Center

In this video you will learn:

The security operation center is responsible for monitoring and managing security. The goal is to know that the incidents are happening (detect) and then respond accordingly. Incident response and disaster recovery are managed out of the SOC.

Incidents should be contained and their impact minimized. The SOC is going to respond to the indications of compromise (IoC) that are a result of logs coming in from all devices into the Security Information Event Manager (SIEM).

We encourage you to learn more about the Security Operations Center by watching this complete video. See you in the Next Video.
Logging10:12
In this video we will cover:

Logging

In this video you will learn:

Logs are fed into the security information event manager (SIEM) from everything. In the cloud, you must turn logging on, and direct the logs to the correct destination for storage and processing. Logs are going to come from everything like IDS, IPS, and Firewalls servers and it doesn’t matter whether they are virtual or real and it doesn’t matter what kind of applications, they should be coming from everything and anything. Now exactly what you want to log is a question that must be answered first.

In SaaS, the customer should be able to see events related to their own user access control events. In PaaS logs from the applications and software installed on the platform should generate logs that are visible to the customer. Logs from the OS may provide the customer with access control information.

In IaaS the customer should have access to all of the logs for the VMs that they build as well as logs for access to the Hypervisor for that creation and monitoring.

We encourage you to learn more about Logging by watching this complete video. See you in the Next Video.
Packet Capture9:26

Data Center Tiers - Tier 1 & 24:31
Explore data center tiers 1 and 2, covering dedicated space, cooling, and redundancy with UPS and generators to ensure continuous operation.
Data Center Tiers - Tier 3 & 43:20
Explore data center tier 3 and tier 4 designs, focusing on redundant power paths, different routing paths, and data center class equipment with hot-swappable components and doubled network gear to meet tier requirements.

Honeypots4:19
Honeypots and honey nets attract attackers with decoy systems, triggering alarms for rapid detection and containment by security operations. Build convincing, real-looking environments and avoid hacking back.
Vulnerability Assessments & Penetration Testing8:22
Learn how vulnerability assessments and penetration testing reveal security gaps, manage true and false positives and negatives, and why signed permission and careful project management are essential.
Penetration Testing Process9:30
Begin with information gathering (reconnaissance) and enumeration to fingerprint systems, then perform vulnerability mapping using known exposures and patches, and finally test exploits only under permission and rules of engagement.

Business Continuity Management3:28
View business continuity management as the umbrella for all plans, including BCP, DRP, incident response, and problem management, guiding high-level policies for threats like phishing, ransomware, and even war.
BCM - Issues9:09
Define events as changes of state, incidents as adverse occurrences, and problems as recurring incidents with root-cause analysis. Apply incident response and disaster recovery for data centers and cloud.
Business Continuity Plans - Policy1:24
Establish a cloud-focused business continuity management policy that covers business continuity, disaster recovery, and incidents to guide preparedness.
Project Management & Initiation1:46
Implement project management initiation by forming a team and a team leader, defining timelines, budgets, and deliverables to prepare disaster recovery and incident response plans.
Business Impact Assessment (BIA)3:28
MTD to Disaster Declaration8:37
Learn how to prioritize life safety, assess damage, and declare disaster. Define maximum tolerable downtime and test backups, then plan automated failover to maintain services.
BIA - RTO & RPO4:29
Explain recovery time objective and recovery point objective, and show how image-based virtualization enables rapid restoration from backups within a defined data-loss window.
BIA - SDO & RSL3:49
Disaster Recovery Strategies3:21
Explore cloud-focused disaster recovery strategies that include failover from a physical data center to the cloud, intra-cloud region failover, and cross-provider failover, with planning for portability and data reentry.
Document the plan0:37
Document everything we learned and outline the steps to create the business continuity plan, disaster recovery plan, and instant response plan with step-by-step instructions.
Implement, Test, and Update7:46
Embed In the user community2:17
Embed the plan in your cloud community; ensure those who need to know are informed. Practice to develop muscle memory for backups, starting up systems, and informing customers in incidents.

Introduction to forensics7:27
Explore cloud forensics and the three investigations—operational, civil, and criminal—and learn to start with court readiness, ensuring admissible forensic evidence.
Basic cloud forensics6:34
Preserve evidence and maintain the chain of custody in cloud forensics while managing dispersed data through memory capture via virtual machine introspection and standard forensic imaging tools.
E-Discovery8:40
Explains the e-discovery forensics workflow, outlining identification, preservation, collection, processing, review, production, and presentation of digital evidence from seized servers and legal holds.
Basic forensic rules5:49
Examine basic forensic rules for investigations, stressing training, certifications, chain of custody, and order of volatility; prioritize approved tools, memory, screens, drives, and thorough documentation.

Requirements

There are no requirements.
A desire to learn what you need to know about the cloud operations for the CCSP exam is very beneficial to have.
A basic understanding of information security is recommended.

Description

In this course we walk through all of the critical concepts within the Cloud Platform & Infrastructure domain. This domain is 16% of the test as of August 2022. I will guide you through all of the concepts that you need to know and advise you on the level of knowledge that you need to get comfortable with.

There are over three hours of video content plus course notes based on information from my book: Cloud Guardians.

We will explore the what it means to manage a cloud infrastructure. Beginning with building a secure datacenter. This includes looking at the different management processes of ITIL and ISO/IEC 20000.

A solid understanding of networking involved in data centers is explored including firewalls, network security groups, intrusion detection systems, intrusion prevention systems and more.

An exploration of managing the equipment of a data center to include monitoring the temperature of the datacenter and the equipment is also in here.

The process of logging and managing logs through a Security Information Event Manager (SIEM) through the different offerings of the cloud, Infrastructure aa a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) is explored.

We finish this domain with Business Continuity Management.

Who this course is for:

This course is intended for people that are preparing for the (ISC)2 CCSP exam.
This course would benefit anyone working to expand their knowledge and understanding of the cloud operations.

CCSP Domain 5 - Cloud Security Operations

What you'll learn

Explore related topics

Course content

Introduction4 lectures • 21min

Network Security Controls2 lectures • 9min

ITIL & ISO/IEC 200002 lectures • 14min

Security Operations Center (SOC)3 lectures • 25min

Data Center Tiers2 lectures • 8min

Defensive tools3 lectures • 22min

Data and Media Sanitization1 lecture • 9min

Business Continuity Management12 lectures • 50min

Forensics4 lectures • 29min

Requirements

Description

Who this course is for: