Certified Cloud Security Professional (CCSP)

Explore cloud service offerings, multi-tenancy concepts, and cloud deployment models through CCSP definitions, analyzing a provider-created virtual server scenario to identify the deployment model used.

Explore the three cloud service offerings—IaaS, PaaS, SaaS—and compare deployment models—private cloud, public cloud, multi cloud, community cloud, and hybrid—along with oversubscription and resource pooling.

Analyze data sanitisation options for ssds, comparing secure erase, data overwriting, and cryptographic erasure, with emphasis on key management for secure reuse of drives.

Evaluate virtualization with hypervisors, containers, and serverless computing to bundle workloads, move them across operating systems, and achieve isolation, scalability, and cost efficiency in cloud environments.

Explore the cloud reference architecture defined by ISO 17789, detailing the three roles: cloud service customer, cloud service provider, and cloud service partner, and their 15 subroles with activities.

Explore eight cloud service provider sub roles, from operations and deployment to business, security, and network management. Learn how these roles govern asset lifecycles, audits, service level agreements, and delivery.

Identify the three CSN subroles: cloud service developer, cloud auditor, broker. Explain their ISO 17789 activities, including service design and testing, problem resolution, audits with evidence, and SLA establishment.

Explore how cloud computing delivers on-demand, scalable resources through auto scaling, elasticity, and resource pooling across availability zones, with pay for what you consume and security controls via security groups.

Compare zero trust architecture, which continuously verifies identity, devices, and context to adapt access. Contrast perimeter-based security that relies on one-time authentication and policies with multifactor authentication and continuous monitoring.

Discover how type one hypervisors enhance security with reduced attack surfaces and stronger isolation, compared to type two, while improving resource efficiency and deployment use cases.

Explore security controls for securing communications and infrastructure, including network security groups and bastion hosts, to restrict internet-facing ports on cloud servers within zero trust architectures.

Explore instance level security groups and subnet level network access control lists for AWS EC2 and Azure VMs, and highlight stateful versus stateless traffic controls and interface level rules.

Geofencing restricts cloud resource access by geographic location to boost security, compliance, and data residency, demonstrated with AWS S3, CloudFront, and WAF to block Mauritius and improve latency.

Honeypots attract attackers in a controlled environment for observation and early warnings, while honeynets emulate larger networks for broader threat analysis.

Define the need for vulnerability assessments as a systematic process to identify vulnerabilities. Regulations like PCI DSS drive assessment frequency to protect confidentiality, integrity, and availability.

Use a bastion server as a gateway to isolate internal resources and enforce access controls. Demonstrate SSH tunneling to a MySQL database and rotating credentials with AWS Secrets Manager.

Explore storage as a service with platform as a service, using AWS DynamoDB, Lambda, and API gateway to build a serverless http CRUD API for managing items.

Identify the three encryption categories: data at rest, data in use, and data in transit. Explain how each uses distinct algorithms and protections like memory encryption, secure enclaves, and TLS/SSL.

Design robust backup strategies with full, incremental, and differential backups, meet recovery point objectives, enforce encryption and retention and lifecycle management, and test restorations for rapid, compliant long-term data protection.

Compare vendor neutral cloud security design patterns from Sans Institute principles and the Cloud Security Alliance's enterprise architecture reference guide, and contrast them with CIS controls for cloud adoption.

Explore the CSA's egregious 11, the top cloud security threats, and learn best practices to identify, assess, and mitigate them for CCSP professionals in line with regulatory standards.

Explore how data breaches cause unauthorized access to data, causing exposure, loss, and theft of customer data, and map threats to the Cloud Controls Matrix with encryption and access controls.

Misconfiguration of cloud assets, including unsecured data storage, excessive permissions, and default settings, drives data breaches and service disruption, while weak change control undermines configuration management and security assessment.

Learn how insufficient identity, credential, access, and key management causes data breaches, and implement multifactor authentication, least privilege, key rotation, and Secrets Manager via AWS KMS to secure resources.

Account hijacking lets attackers gain full control of highly privileged cloud accounts, risking services, data, and business logic; mitigate with defense in depth and identity and access management controls.

Explore how insecure interfaces and APIs threaten cloud security, emphasizing authentication, access control, encryption, and activity monitoring. Practice good API hygiene through inventory testing, auditing, and guarding against abnormal activity.

Explore the four logical layers of cloud computing, focusing on the meta structure and applistructure, and how API implementations and misconfigurations affect confidentiality, integrity, and availability.

Improve cloud visibility by monitoring approved and non-approved cloud services, detect shadow IT and insider risks, and implement zero trust with cloud access security brokers and a web application firewall.

Expose how malicious actors misuse cloud resources to host malware, launch spam and phishing, or mine digital currency, and highlight cloud data loss protection to stop data exfiltration.

Define the secure data lifecycle by integrating security by design, data classification, access controls, encryption, integrity checks, auditing, monitoring, retention and secure deletion, and incident response with end-user training.

Explore data creation from human inputs, IoT sensors, and applications, producing text, numbers, images, or audio, and apply security by design and privacy by design.

Learn the data store phase, selecting storage systems, organizing data, and enforcing security, integrity, backups, recovery, retention, indexing, and auditing to protect and access data.

Explore how the data use phase actively utilizes data to drive insights and support operations. Secure API and database access through authentication, authorization, and encryption.

Explore securely sharing data within and outside an organization, using Macie to discover sensitive data, query results with Athena, and visualize findings in QuickSight.

Explore archive and destroy phases for long-term data security, focusing on cryptography, key management, and cryptographic erasure, plus using S3 lifecycle rules and Glacier storage classes for archival and deletion.

Explore the need for identity and access management by examining how automation, policy enforcement, and audit trails secure access across cloud, mobile, and diverse apps to meet compliance.

Explore user access, privileged access, and service access within identity and access management, with real-world examples and Unix file permissions that show how roles govern access.

Explore the CIA triad by examining how confidentiality, integrity, and availability form core information security goals and how security controls address them. Upcoming tutorials describe each principle in detail.

Ensure confidentiality by restricting access to data and resources for authorized subjects through strict access control, encryption, authentication, and data classification, supported by training and privacy practices.

Explore integrity as protecting data reliability and correctness, enabling authorized changes while preventing unauthorized modification and mistakes, across data in transit, at rest, and during processing.

Improve availability by ensuring authorized access to data and resources, defending against denial of service, and implementing redundancy, monitoring, firewalls, and backup systems.

Understand how identity, authentication, authorization, and accountability shape security policy, with authentication factors such as something you know, have, or are, and the role of auditing and MFA.

Assess risk by combining probability of occurrence within a timeframe with the magnitude of financial impact, assign a conceptual score, and apply two risk assessment methodologies.

Quantitative risk assessment uses numerical values to quantify risk probability and impact, calculating asset value, annualized rate of occurrence, exposure factor, single loss expectancy, and annualized loss expectancy.

Examine IT systems with structured security evaluations using common criteria to determine assurance levels, identify vulnerabilities via scanning and testing, and prioritize remediation for improved security and compliance.

Differentiate four security control frameworks and understand how ISO 27,001 family, NIST risk management framework, SOC two, and PCI DSS guide information security management in cloud environments.

Explore the differences between symmetric and asymmetric cryptography, emphasizing how public and private keys enable private communication, digital signatures, and non-repudiation, while highlighting scalability limits of symmetric systems.

Differentiate descriptive, diagnostic, predictive, and prescriptive analytics, with techniques like charts, data mining, forecasting, and neural networks, to turn data into actionable business insights.

Understand disaster recovery metrics, including the recovery point objective (RPO) and recovery time objective (RTO), across four stages to minimize downtime and guide data restoration.

Learn to request a certificate from a certificate authority by choosing a type, submitting the CSR, completing validation, receiving the certificate, and installing it to establish trust.

Examine how browsers validate https by verifying certificates issued by trusted authorities through a root-to-leaf certification path, including intermediate certificates and trust anchors, to thwart man-in-the-middle attacks.

Discover patterns across structured, semi-structured, and unstructured data using labeling, pattern matching, lexical analysis, and hashing to uncover trends. Enhances security and speeds decisions with actionable insights.

Explore how data loss prevention relies on data classification and labeling to identify sensitive information and enforce policies. Encrypting data in transit hides content from DLP, hindering exfiltration detection.

Explore data obfuscation methods such as masking and anonymisation, contrast with hashing, and emphasize encryption and robust key management within a shared cloud security model.

Track data events with robust auditability, chain of custody, and non-repudiation, leveraging SIEM for attribution, regulatory compliance, and secure incident investigations.

Compare cold, warm, hot, and mobile disaster recovery sites, service bureaus, and cloud-based IaaS to select cost-effective, rapid recovery options aligned with business continuity goals.

Learn how SIEM centralizes, normalizes, and correlates logs from multiple sources to detect anomalies, generate alerts, and support compliant, secure log management.

Explore how security orchestration, automation, and response (soar) automates incident response with predefined playbooks, enhancing security operations by integrating with siem for real-time threat detection.

Design secure, scalable cloud applications from architecture to ongoing security and the software supply chain. Learn testing, threat modeling, and role of casbs, iam, sso, and mfa in protecting data.

Explore cloud application architecture from cryptography to sandboxing, including data-at-rest and data-in-transit protection, key management, containerization, Kubernetes orchestration, API security, and multi-tenancy.

Explore cloud-secure software development lifecycle (SDLC) by examining planning, requirements, design, coding, testing, deployment, and maintenance, with secure coding practices and security considerations.

Demonstrates securing an AWS environment with GitHub actions in a production CI/CD pipeline, using an identity and access management user and GitHub environment secrets to deploy via S3 sync.

Explore quality assurance in software development, blending automated and manual testing across functional and non-functional types, including UAT, regression, static and dynamic testing, and supply chain risk management.

Explore the core principles of identity and access management, including identification, authentication, authorization, monitoring, and lifecycle management, to secure digital resources.

secure cloud environments by implementing cloud identity and access control with least privilege, rbac, conditional access policies, jit, mfa, vaults, pam, and robust secrets management across Kubernetes and ci/cd pipelines.

Learn how to perform a business impact analysis (BIA) that identifies critical resources, assigns asset values, and derives RTO, MTD, SLE, ALE, EF, and ARO through qualitative and quantitative methods.

Identify assets and their value, map critical paths, and define risk appetite to guide security decisions; apply defense-in-depth with encryption, access controls, and cloud governance across IaaS, PaaS, and SaaS.

Compare cloud service models by likening on-premises, IaaS, PaaS, and SaaS to owning, leasing, taxi, and bus; evaluate migration from on-premises to cloud based on business needs.

Classify data, assign ownership and custody, and manage the data lifecycle from creation to destruction in cloud settings. Explore labeling, retention, audit, disposal, and DRM alongside regulatory and location considerations.

Clarify the split of responsibilities between cloud customers and providers across IaaS, PaaS, and SaaS, including data protection, governance, audits, SLAs, and risk management.

Master cloud application design and architecture, secure testing and validation, and the cloud secure software development lifecycle, with training, awareness, and IAM considerations.

Explore ISO/IEC 27034-1 and the ONF/ANF frameworks to manage application security across the software lifecycle, guided by risk assessments and an application security management process.

Explore identity and access management, provisioning identities, password management, directory services, authentication and authorization, federation, and standards like SAML, OAuth, and OpenID Connect for cross-organizational SSO.

Examine the security mechanisms that power cloud applications, including API risks for REST and SOAP, and the role of encryption, cryptography, and tenancy separation in safeguarding data.

Investigate STRIDE threat modelling and QoS assurance to validate cloud applications. Compare vulnerability scanning, penetration testing, and both white-box and black-box approaches, with SAST and DAST.

Explore three approaches to threat modeling through application and infrastructure decomposition, data flow diagrams, process flow diagrams, and attack trees, to identify threats, prioritize countermeasures, and protect IT resources.

Explore cloud data center monitoring and capacity management, maintenance practices, and change management to meet service level agreements, including patching, updates, and BC/DR considerations.

Explore cloud data centers, security and privacy challenges, three US legal bodies: criminal, civil, administrative; intellectual property protections and Doctrine of the Proper Law and Restatement (Second) Conflict of Law.

Explore how U.S. laws like the ECPA, SCA, GLBA, SOX, HIPAA, and FERPA impact cloud computing, and examine international treaty frameworks and export controls.

Explore how the EU data protection directive and GDPR govern personal data handling, rights of data subjects, notices, consent, and cross-border responsibilities of data controllers and processors.

Compare US and EU privacy laws with reviews of Australia, Canada, Argentina, Switzerland, and APEC frameworks, and distinguish laws, regulations, and standards, including PCI DSS with its 12 requirements.

Cover eDiscovery, evidence types, forensics, and cloud audit reporting, including the eDiscovery reference model steps, admissibility, chain of custody, and SOC 1, SOC 2, SOC 3 frameworks.

Define and implement a comprehensive security policy that integrates risk management, governance, due diligence, and compliance for outsourcing, contracts, and SLAs in global cloud environments.

Identify and evaluate assets, threats, vulnerabilities, and countermeasures to reduce risk to an acceptable level, using quantitative and qualitative risk analysis and cost-benefit reporting.

Apply cost-benefit analysis in risk management to select security controls that protect assets and deter attacks. Use defense-in-depth with administrative, technical, and physical controls that are testable and tamperproof.