Enterprise Cloud Security with CCSP - Part 1 : Foundations

Build a security-first mental model of cloud concepts, architecture, and design. Learn about shared responsibility, multi-tenancy, and evaluations of providers, certifications, and SLAs.

Explore the core cloud computing concepts per NIST, including on-demand service, broad network access, resource pooling, rapid elasticity, and measured service, plus IaaS, PaaS, SaaS, and deployment models.

Discover cloud computing essentials, including on-demand access, cost efficiency, and scalable service models (IaaS, PaaS, SaaS) with deployment options (public, private, hybrid, community) for secure, value-driven IT.

Explore deployment models from private and public to hybrid and community clouds, highlighting security, elasticity, control, and cost, with building blocks like virtualization, storage, networking, databases, and orchestration.

Explore cloud reference architecture, outlining roles like provider, customer, broker, partner, and auditor, and how services are provisioned, delivered, and managed across the stack with security, privacy, resiliency, and virtualization.

Explore cloud consumer activities across IaaS, PaaS, and SaaS, from development and testing to business applications, and explain provider roles, cloud auditors, brokers, carriers, and security and privacy responsibilities.

Explore the three cloud service capabilities—infrastructure, platform, and application—and how they map to IaaS, PaaS, and SaaS, outlining control and responsibility across cloud and on-premises models.

Explore cloud deployment models, including public, private, community, hybrid, and multi-cloud, and learn how each balances security, governance, cost, and scalability for diverse business needs.

Explore cloud shared considerations across environments, including interoperability, portability, reversibility, performance, availability, resiliency, security, privacy, governance, and maintenance, with a focus on SLAs, auditability, and regulatory compliance.

Explore how data science, machine learning, artificial intelligence, and related technologies like blockchain, IoT, containers, edge computing, quantum computing, confidential computing, and DevSecOps reshape cloud security and innovation.

Explore security concepts relevant to cloud computing, including the CIA triad and shared security responsibilities, and learn best practices for protecting data, systems, and users across cloud models.

Manage cryptographic keys across the cloud with a key lifecycle—generation, distribution, usage, rotation, and destruction—supported by secure storage and clear access policies. Evaluate storage options: on-premises, cloud-based KMS, or hybrid.

Define and control who can access networks, applications, and files through identity and access management, then tighten privileged access with monitoring and MFA.

Master data and media sanitization in cloud contexts by detailing overwriting, encryption, and cryptographic erasure as secure, scalable methods for irreversible data disposal across shared infrastructure.

Integrate network and virtualization security across physical and cloud environments with NSGs, segmentation, micro-segmentation, geofencing, zero trust, UTM, and automated security policies.

Examine cloud threats linked to virtualization, media sanitization, and network security while addressing traditional risks such as unauthorized access and data leakage, and emphasize adapting legacy controls for cloud.

Strengthen cyber hygiene through proactive patching, baselining, and robust access controls. Educate users, protect data, monitor threats, and implement recovery strategies to prevent breaches.

Cover the cloud data lifecycle, ensure business continuity and disaster recovery, and define security requirements across IaaS, PaaS, and SaaS with design patterns and devops security.

Secure data across the cloud data lifecycle—from creation to destruction—by applying stage-specific protections and preparing cloud-based business continuity and disaster recovery plans.

Analyze business impact and cost-benefit for cloud adoption, shifting capex to opex, leveraging pay-as-you-go, licensing savings, and efficiency gains to boost ROI.

Explore functional security requirements in the cloud, focusing on portability, vendor lock, and interoperability, and learn to use vendor management plans, service level agreements, and rfps to align security needs.

Explore the shared responsibility model across IaaS, PaaS, and SaaS, detailing risks like multi-tenancy and hypervisor attacks, and define who secures data, identity management, and applications.

Explore cloud design patterns for scalable, fault-tolerant applications, and apply security principles, the Well-Architected framework, and CSA guidance with enterprise architectures like Sabsa, TOGAF, and Jericho for secure, resilient clouds.

Embrace DevSecOps by integrating security into the development lifecycle, aligning development, operations, and security to deliver fast, secure software with automated testing, vulnerability scans, and continuous monitoring.

Evaluate cloud providers by assessing security, compliance, uptime service level agreements (slas), data center availability, support, cost transparency, and integrations to ensure alignment with your security, regulatory, and business needs.

Verify cloud service providers against established security standards and frameworks, including ISO 7001, ISO 27,002, ISO 27,017, SOC reports, NIST SP 853, and PCI DSS.

Assess product security with Common Criteria—Protection Profiles and EAL levels—alongside FIPS cryptographic module standards, and evaluate cloud security via the STAR program and CAQ based on the Cloud Control Matrix.

Explore cloud concepts and architecture, data flows, and data types. Design scalable storage across public, private, and hybrid clouds with encryption, tokenization, masking, discovery, classification, and governance.

Explore the cloud data lifecycle from creation to destruction, and how data dispersion across regions and data flows require encryption in transit and access controls.

Apply protections across the cloud data lifecycle by managing six phases: create, store, use, share, archive, destroy, with phase-specific controls like data classification, in transit protection, DLP, and access controls.

Explore data dispersion in cloud computing—break data into chunks, disperse across locations, use erasure coding with parity bits, and safeguard data flows for availability and security.

Understand how data moves in cloud environments across in transit, at rest, and in use, and apply data lifecycle management, compliance, cloud architectures, and data loss prevention to secure data.

Explore cloud data storage architectures, compare object, block, and file storage, and learn to mitigate breaches, misconfigurations, and insecure APIs through encryption and proper access controls.

Explore cloud storage types—ephemeral, volume, object, database/blob, and SaaS storage—and their threats. Apply encryption, access controls, and auditing to prevent data loss, misconfigurations, and data exposure.

Explore data security technologies and strategies in cloud environments, including encryption and key management, hashing, data obfuscation, tokenization, and data loss prevention across the data lifecycle.

Explore encryption in the cloud and robust key management, including application, database, file, and volume level techniques, plus cloud KMS and customer managed keys to protect data at rest.

Wraps up the key management lifecycle with archiving inactive keys to preserve data availability and compliance, then highlights secret manager and certificate manager for centralized, automated renewal, issuance, and revocation.

Explore hashing as a one-way method that protects data integrity by producing verifiable hash values and enabling digital signatures for authentication in cloud environments.

Learn data obfuscation, a privacy technique for cloud security that uses substitution, shuffling, and value variance to create usable, de-identified datasets for testing, development, and analytics, ensuring regulatory compliance.

Learn tokenization, a method that replaces sensitive data with non-sensitive tokens and maps back via a secure lookup, enabling data minimization and secure payments.

Master data loss prevention (DLP) to detect and block data exfiltration across structured and unstructured data, apply policy management, monitoring, and incident reporting for GDPR, HIPAA, and PCI DSS compliance.

Discover, classify, and manage data across cloud environments with automated discovery tools, covering structured, unstructured, and semi-structured data, to support privacy, compliance, risk management, and incident response.

Structured data follows a predefined format, enabling storage, validation, and SQL-based querying. As cloud security professionals, we leverage discovery and classification tools to protect this high-value data in cloud platforms.

Explore unstructured data and its security challenges, from emails to images and videos, and learn discovery, classification, DLP, metadata tagging, and AI-based pattern recognition in cloud environments.

Learn how semi-structured data sits between structured and unstructured forms, using tags, markers, and hierarchies in XML, JSON, and YAML for scalable cloud data exchange via APIs and security-aware classification.

Map data location across cloud zones to maintain governance, compliance, and data sovereignty; align with GDPR, Hipa, and regulatory requirements while negotiating data residency in SLAs.

Master data classification to govern cloud data through policies, mapping, and labeling, enabling compliant, cross-cloud protection aligned with GDPR, HIPAA, and PCI DSS.

Define and implement a data classification policy to label, protect, and manage data across its lifecycle in cloud environments, using encryption and access controls. Align with governance and regulatory standards.

Explore how data mapping identifies and documents data flows across cloud environments, reveals where sensitive data resides, and uses discovery and metadata to govern and protect data.

Label data with metadata such as ownership, sensitivity, department, and location to enable automated classification engines that apply labels and enforce encryption and access controls.

Master information rights management by embedding usage policies, encryption, watermarking, policy enforcement, and expiration controls into data to control access across cloud and hybrid environments, aligning with zero trust.

Embed information rights management into data to enforce rights, enable layered access control and ACL-based permissions, and uphold least privilege across on-premises, cloud, and hybrid environments.

Verify revoked certificates in PKI using CRLs from the CA by serial numbers and revocation dates; use OCSP for checks, with CRL distribution, updates, expiry, and caching for cloud trust.

Learn how data retention, deletion, and archiving policies govern the data lifecycle, supported by automation, cloud storage tiers, and data classification in CCSP cloud governance.

Define data retention policies to govern how long data is kept, aligning with regulatory compliance, cost management, and cloud security across the data lifecycle.

Define a robust data retention policy by outlining purpose and scope, retention periods, and data classification, then assign roles, secure storage, disposal procedures, and ongoing compliance for CSPs.

Outline a comprehensive data retention policy with purpose, scope, data classification, retention periods, roles, storage, retrieval, disposal, compliance, and ongoing review and auditing.

Define a data retention policy with purpose, scope, data classification, and retention periods to guide secure deletion, archiving, and compliant data management, including roles and responsibilities and secure disposal procedures.

Explore legal holds as a formal data preservation process triggered by legal orders, ensuring data integrity, authenticity, and immutability for litigation readiness in cloud environments.

Explore auditability, traceability, and accountability of data events to support reliable cloud operations, using centralized logging and tools like AWS CloudTrail, Azure Monitor, and Google Cloud Audit Logs.

Identify event sources and attributes to enable traceability and accountability in cloud security. Capture timestamps, event types, source and destination, user IDs, and outcomes to support auditing and compliance.

Explore how logging, secure storage, and analysis of data events support threat detection, performance monitoring, and regulatory compliance with GDPR, HIPAA, PCI DSS, and ISO 27,001.

Master chain of custody and non-repudiation to ensure authenticity, integrity, and legal admissibility of digital evidence through documented handling, logs, and cryptographic proof.