| Foreword |
|
xix | |
| Acknowledgments |
|
xxi | |
| Introduction |
|
xxiii | |
| Chapter 1 Cloud Computing Concepts and Architectures |
|
1 | (28) |
|
|
|
4 | (2) |
|
|
|
4 | (1) |
|
|
|
4 | (2) |
|
|
|
6 | (1) |
|
|
|
6 | (1) |
|
Cloud Computing Definitions |
|
|
6 | (10) |
|
Essential Characteristics |
|
|
7 | (2) |
|
|
|
9 | (5) |
|
|
|
14 | (2) |
|
Cloud Security Scope and the Shared Responsibility Model |
|
|
16 | (3) |
|
Shared Responsibility Model |
|
|
16 | (3) |
|
Cloud Security Alliance Tools |
|
|
19 | (5) |
|
|
|
19 | (1) |
|
Consensus Assessments Initiative Questionnaire |
|
|
20 | (1) |
|
|
|
21 | (1) |
|
Cloud Reference and Architecture Models |
|
|
22 | (2) |
|
|
|
24 | (5) |
|
|
|
25 | (2) |
|
|
|
27 | (2) |
| Chapter 2 Governance and Enterprise Risk Management |
|
29 | (20) |
|
|
|
30 | (7) |
|
|
|
30 | (2) |
|
|
|
32 | (5) |
|
|
|
37 | (2) |
|
Risk Management Backgrounder |
|
|
37 | (2) |
|
|
|
39 | (5) |
|
The Effects of Service and Deployment Models |
|
|
39 | (3) |
|
Cloud Risk Management Trade-Offs |
|
|
42 | (1) |
|
Assessing Cloud Service Providers |
|
|
43 | (1) |
|
|
|
44 | (5) |
|
|
|
45 | (2) |
|
|
|
47 | (2) |
| Chapter 3 Legal Issues, Contracts, and Electronic Discovery |
|
49 | (26) |
|
Legal Frameworks Governing Data Protection and Privacy |
|
|
50 | (4) |
|
Required Security Measures |
|
|
52 | (1) |
|
|
|
53 | (1) |
|
Restrictions to Cross-Border Data Transfers |
|
|
53 | (1) |
|
|
|
53 | (1) |
|
|
|
54 | (8) |
|
|
|
54 | (2) |
|
European Union and European Economic Area |
|
|
56 | (4) |
|
|
|
60 | (2) |
|
Contracts and Provider Selection |
|
|
62 | (4) |
|
|
|
63 | (1) |
|
Monitoring, Testing, and Updating |
|
|
64 | (1) |
|
|
|
64 | (1) |
|
|
|
65 | (1) |
|
Third-Party Audits and Attestations |
|
|
65 | (1) |
|
|
|
66 | (4) |
|
Possession, Custody, and Control |
|
|
66 | (1) |
|
Relevant Cloud Applications and Environment |
|
|
67 | (1) |
|
Searchability and E-Discovery Tools |
|
|
67 | (1) |
|
|
|
67 | (1) |
|
Data Retention Laws and Recordkeeping Obligations |
|
|
67 | (1) |
|
|
|
68 | (1) |
|
|
|
68 | (1) |
|
|
|
69 | (1) |
|
|
|
69 | (1) |
|
|
|
69 | (1) |
|
|
|
69 | (1) |
|
Cooperation Between Provider and Client in E-Discovery |
|
|
69 | (1) |
|
Response to a Subpoena or Search Warrant |
|
|
70 | (1) |
|
|
|
70 | (5) |
|
|
|
71 | (2) |
|
|
|
73 | (2) |
| Chapter 4 Compliance and Audit Management |
|
75 | (20) |
|
|
|
77 | (1) |
|
Impact of the Cloud on Contracts |
|
|
78 | (1) |
|
How the Cloud Changes Compliance |
|
|
79 | (3) |
|
|
|
79 | (1) |
|
|
|
80 | (2) |
|
|
|
82 | (1) |
|
Audit Management in the Cloud |
|
|
83 | (1) |
|
SOC Reports and ISO Certifications Backgrounder |
|
|
84 | (4) |
|
|
|
84 | (2) |
|
|
|
86 | (2) |
|
How the Cloud Changes Audits |
|
|
88 | (2) |
|
|
|
89 | (1) |
|
|
|
89 | (1) |
|
|
|
90 | (1) |
|
|
|
90 | (5) |
|
|
|
91 | (2) |
|
|
|
93 | (2) |
| Chapter 5 Information Governance |
|
95 | (18) |
|
Cloud Information Governance Domains |
|
|
96 | (9) |
|
Information Classification Backgrounder |
|
|
97 | (4) |
|
Information Management Backgrounder |
|
|
101 | (4) |
|
The Data Security Lifecycle |
|
|
105 | (4) |
|
Locations and Entitlements |
|
|
106 | (1) |
|
Functions, Actors, and Controls |
|
|
107 | (2) |
|
|
|
109 | (4) |
|
|
|
109 | (2) |
|
|
|
111 | (2) |
| Chapter 6 Management Plane and Business Continuity |
|
113 | (20) |
|
|
|
114 | (8) |
|
Application Programming Interface Backgrounder |
|
|
115 | (3) |
|
Accessing the Management Plane |
|
|
118 | (1) |
|
Securing the Management Plane |
|
|
119 | (3) |
|
Business Continuity and Disaster Recovery in the Cloud |
|
|
122 | (7) |
|
|
|
123 | (2) |
|
|
|
125 | (1) |
|
Business Continuity Within the Cloud Provider |
|
|
126 | (1) |
|
|
|
127 | (1) |
|
Business Continuity for Loss of the Cloud Provider |
|
|
128 | (1) |
|
Continuity for Private Cloud and Providers |
|
|
128 | (1) |
|
|
|
129 | (4) |
|
|
|
129 | (2) |
|
|
|
131 | (2) |
| Chapter 7 Infrastructure Security |
|
133 | (28) |
|
Cloud Network Virtualization |
|
|
134 | (8) |
|
OSI Reference Model Backgrounder |
|
|
135 | (1) |
|
|
|
136 | (1) |
|
|
|
137 | (2) |
|
Networking Planes Backgrounder |
|
|
139 | (1) |
|
Software Defined Networking |
|
|
139 | (2) |
|
Network Functions Virtualization |
|
|
141 | (1) |
|
How Security Changes with Cloud Networking |
|
|
142 | (5) |
|
Challenges of Virtual Appliances |
|
|
142 | (1) |
|
|
|
143 | (1) |
|
Microsegmentation and the Software Defined Perimeter |
|
|
144 | (2) |
|
Additional Considerations for CSPs or Private Clouds |
|
|
146 | (1) |
|
Hybrid Cloud Considerations |
|
|
146 | (1) |
|
Cloud Compute and Workload Security |
|
|
147 | (8) |
|
Compute Abstraction Technologies |
|
|
147 | (3) |
|
How the Cloud Changes Workload Security |
|
|
150 | (1) |
|
Immutable Workloads Enable Security |
|
|
150 | (3) |
|
The Impact of the Cloud on Standard |
|
|
|
Workload Security Controls |
|
|
153 | (1) |
|
Changes to Workload Security Monitoring and Logging |
|
|
153 | (1) |
|
Changes to Vulnerability Assessment |
|
|
154 | (1) |
|
|
|
155 | (6) |
|
|
|
156 | (2) |
|
|
|
158 | (3) |
| Chapter 8 Virtualization and Containers |
|
161 | (18) |
|
Major Virtualization Categories Relevant to Cloud Computing |
|
|
162 | (8) |
|
|
|
162 | (3) |
|
|
|
165 | (2) |
|
|
|
167 | (3) |
|
|
|
170 | (3) |
|
Container Definitions Backgrounder |
|
|
172 | (1) |
|
Container Security Recommendations |
|
|
172 | (1) |
|
|
|
173 | (6) |
|
|
|
174 | (2) |
|
|
|
176 | (3) |
| Chapter 9 Incident Response |
|
179 | (16) |
|
Incident Response Lifecycle |
|
|
180 | (4) |
|
Incident and Event Backgrounder |
|
|
180 | (1) |
|
|
|
181 | (1) |
|
Detection and Analysis Phase |
|
|
182 | (1) |
|
Containment, Eradication, and Recovery Phase |
|
|
183 | (1) |
|
Post-Incident Activity Phase |
|
|
183 | (1) |
|
How the Cloud Impacts Incident Response |
|
|
184 | (7) |
|
|
|
184 | (4) |
|
|
|
188 | (2) |
|
Containment, Eradication, and Recovery |
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
191 | (4) |
|
|
|
192 | (1) |
|
|
|
193 | (2) |
| Chapter 10 Application Security |
|
195 | (20) |
|
The SSDLC and Cloud Computing |
|
|
196 | (1) |
|
Secure Design and Development |
|
|
197 | (4) |
|
|
|
197 | (1) |
|
|
|
198 | (1) |
|
|
|
198 | (2) |
|
|
|
200 | (1) |
|
|
|
201 | (1) |
|
|
|
201 | (3) |
|
Cloud Impacts on Vulnerability Assessments |
|
|
202 | (1) |
|
Cloud Impact on Penetration Testing |
|
|
202 | (1) |
|
Deployment Pipeline Security |
|
|
202 | (1) |
|
Impact of IaC and Immutable Workloads |
|
|
203 | (1) |
|
|
|
204 | (1) |
|
How the Cloud Impacts Application Design and Architectures |
|
|
205 | (2) |
|
Microservices Backgrounder |
|
|
206 | (1) |
|
The Rise and Role of DevOps |
|
|
207 | (2) |
|
|
|
207 | (1) |
|
Security Implications and Advantages of DevOps |
|
|
208 | (1) |
|
|
|
209 | (6) |
|
|
|
210 | (2) |
|
|
|
212 | (3) |
| Chapter 11 Data Security and Encryption |
|
215 | (20) |
|
|
|
216 | (1) |
|
|
|
216 | (1) |
|
Managing Data Migrations to the Cloud |
|
|
217 | (3) |
|
|
|
218 | (1) |
|
Securing Cloud Data Transfers |
|
|
219 | (1) |
|
Securing Data in the Cloud |
|
|
220 | (6) |
|
Cloud Data Access Controls |
|
|
220 | (1) |
|
Storage (at Rest) Encryption and Tokenization |
|
|
221 | (4) |
|
Key Management (Including Customer-Managed Keys) |
|
|
225 | (1) |
|
Data Security Architecture |
|
|
226 | (1) |
|
Monitoring, Auditing, and Alerting |
|
|
227 | (1) |
|
Additional Data Security Controls |
|
|
227 | (2) |
|
Cloud Platform/Provider-Specific Controls |
|
|
227 | (1) |
|
|
|
228 | (1) |
|
Enterprise Rights Management |
|
|
228 | (1) |
|
Data Masking and Test Data Generation |
|
|
229 | (1) |
|
Enforcing Lifecycle Management Security |
|
|
229 | (1) |
|
|
|
230 | (5) |
|
|
|
231 | (2) |
|
|
|
233 | (2) |
| Chapter 12 Identity, Entitlement, and Access Management |
|
235 | (22) |
|
How IAM Works in the Cloud |
|
|
236 | (1) |
|
|
|
237 | (1) |
|
|
|
238 | (9) |
|
|
|
241 | (6) |
|
Managing Users and Identities for Cloud Computing |
|
|
247 | (4) |
|
Authentication and Credentials |
|
|
251 | (1) |
|
Entitlements and Access Management |
|
|
252 | (1) |
|
Privileged User Management |
|
|
252 | (1) |
|
|
|
252 | (5) |
|
|
|
253 | (2) |
|
|
|
255 | (2) |
| Chapter 13 Security as a Service |
|
257 | (10) |
|
Potential Benefits and Concerns of SecaaS |
|
|
258 | (1) |
|
Major Categories of SaaS Offerings |
|
|
259 | (5) |
|
Identity, Entitlement, and Access Management Services |
|
|
259 | (1) |
|
Cloud Access Security Broker |
|
|
260 | (1) |
|
|
|
260 | (1) |
|
|
|
261 | (1) |
|
|
|
261 | (1) |
|
|
|
262 | (1) |
|
Intrusion Detection/Prevention |
|
|
262 | (1) |
|
Security Information and Event Management (SIEM) |
|
|
262 | (1) |
|
Encryption and Key Management |
|
|
263 | (1) |
|
Business Continuity and Disaster Recovery |
|
|
263 | (1) |
|
|
|
263 | (1) |
|
Distributed Denial of Service Protection |
|
|
263 | (1) |
|
|
|
264 | (3) |
|
|
|
264 | (2) |
|
|
|
266 | (1) |
| Chapter 14 Related Technologies |
|
267 | (16) |
|
|
|
267 | (6) |
|
Distributed Data Collection Backgrounder |
|
|
269 | (1) |
|
|
|
269 | (2) |
|
Security and Privacy Considerations |
|
|
271 | (1) |
|
|
|
271 | (1) |
|
|
|
272 | (1) |
|
|
|
272 | (1) |
|
Identity and Access Management |
|
|
272 | (1) |
|
|
|
272 | (1) |
|
|
|
273 | (1) |
|
|
|
274 | (1) |
|
|
|
274 | (2) |
|
|
|
276 | (7) |
|
|
|
278 | (2) |
|
|
|
280 | (3) |
| Chapter 15 ENISA Cloud Computing: Benefits, Risks, and Recommendations for Information Security |
|
283 | (20) |
|
Security Benefits of Cloud |
|
|
284 | (2) |
|
Security and the Benefits of Scale |
|
|
284 | (1) |
|
Security as a Market Differentiator |
|
|
285 | (1) |
|
Standardized Interfaces for Managed Security Services |
|
|
285 | (1) |
|
Rapid, Smart Scaling of Resources |
|
|
285 | (1) |
|
Audit and Evidence Gathering |
|
|
285 | (1) |
|
Timely, Effective, and Efficient Updates and Defaults |
|
|
285 | (1) |
|
Audit and SLAB Force Better Risk Management |
|
|
286 | (1) |
|
Benefits of Resource Concentration |
|
|
286 | (1) |
|
|
|
286 | (4) |
|
|
|
286 | (1) |
|
|
|
287 | (1) |
|
|
|
287 | (2) |
|
|
|
289 | (1) |
|
|
|
289 | (1) |
|
Management Interface Compromise |
|
|
289 | (1) |
|
|
|
289 | (1) |
|
Insecure or Incomplete Data Deletion |
|
|
289 | (1) |
|
|
|
290 | (1) |
|
Five Key Legal Issues Common Across All Scenarios |
|
|
290 | (1) |
|
|
|
290 | (1) |
|
|
|
291 | (1) |
|
|
|
291 | (1) |
|
|
|
291 | (1) |
|
Outsourcing Service and Changes in Control |
|
|
291 | (1) |
|
Additional Items for the Exam |
|
|
291 | (4) |
|
Open Virtualization Format |
|
|
292 | (1) |
|
|
|
292 | (1) |
|
Economic Denial of Service |
|
|
292 | (1) |
|
|
|
292 | (1) |
|
Risk Concerns of a Cloud Provider Being Acquired |
|
|
292 | (1) |
|
Data Controller vs. Data Processor Definitions |
|
|
293 | (1) |
|
Guest System Monitoring in IaaS Responsibilities |
|
|
293 | (1) |
|
User Provisioning Vulnerability |
|
|
293 | (1) |
|
Underlying Vulnerability in Loss of Governance |
|
|
294 | (1) |
|
Risks R.1-R.35 and Underlying Vulnerabilities |
|
|
295 | (4) |
|
|
|
299 | (4) |
|
|
|
299 | (2) |
|
|
|
301 | (2) |
| Appendix A Cloud Computing Security Policy Examples |
|
303 | (4) |
|
Cloud Security Policy: Centralized Example |
|
|
303 | (2) |
|
|
|
303 | (1) |
|
|
|
304 | (1) |
|
|
|
304 | (1) |
|
|
|
304 | (1) |
|
Cloud Security Policy: Classification Example |
|
|
305 | (2) |
|
|
|
305 | (1) |
|
|
|
305 | (1) |
|
|
|
305 | (1) |
|
|
|
305 | (2) |
| Appendix B About the Online Content |
|
307 | (4) |
|
|
|
307 | (1) |
|
Your Total Seminars Training Hub Account |
|
|
307 | (1) |
|
|
|
307 | (1) |
|
Single User License Terms and Conditions |
|
|
307 | (2) |
|
|
|
309 | (1) |
|
|
|
309 | (2) |
| Glossary |
|
311 | (12) |
| Index |
|
323 | |
