A presentation at SysAdminDay 2022 by Tanat Tonguthaisri
How CSA help shaping proper cloud services through CCSK and CCM Tanat Tonguthaisri https://LinkedIn.com/in/epicure/
How CSA help shaping properly secured cloud services through CCSK and CCM Tanat Tonguthaisri https://LinkedIn.com/in/epicure/
Agenda (1) In your current role at xxxx, as a xxxx, you do xxx (insert your job description). Can you tell us about what your job involves? (2) Can you share with us some complexities in managing cloud computing projects? (3) In managing (outsourced) cloud projects, what are useful tips you could share with IT professionals to avoid common pitfalls? (4) What made you decide to earn your CCSK? What part of the material from the CCSK has been the most relevant in your work and why? (5) How does CCM help communicate with customers? (6) Whatโs the value in a vendor-neutral certificate like the CCSK or CCSP versus getting certified by AWS? In what scenario are the different certificates important? (7) Would you encourage your staff and/or colleagues to obtain CCSK or other CSA qualifications? Why? (8) What is the best advice you will give to IT professionals in order for them to scale new heights in their careers?
Days of Future Past (1) In your current role at xxxx, as a xxxx, you do xxx (insert your job description). Can you tell us about what your job involves?
Next Endeavour (1) In your current role at xxxx, as a xxxx, you do xxx (insert your job description). Can you tell us about what your job involves?
(2) Can you share with us some complexities in managing cloud computing projects? Contractor controls access to applications and data on cloud. Monitoring is not easy for Thai cloud.
(3) In managing (outsourced) cloud projects, what are useful tips you could share with IT professionals to avoid common pitfalls? As contracting office, designated officers should have at least read access to cloud resources.
Motivation What made you decide to earn your CCSK?
CCSK Plus #1, November 2014
Nantawan Wongkachonkitti, Ph.D. CIO & Deputy Manager General of Student Loan Funds, first CCSK passer in Thailand
Two attempts per CCSK exam token
Preparation What part of the material from the CCSK has been the most relevant in your work and why? DEPA program KMITL
CCSK, CCSP & vendor specific cert Whatโs the value in a vendor-neutral certificate like the CCSK or CCSP versus getting certified by AWS? In what scenario are the different certificates important? Broad and general knowledge, plus overall best practices. AWS, Azure, GCP, Alibaba, Huawei, Tencent
Certificate vs Certification A certificate recognizes a candidateโs knowledge, skills and abilities typically as framed by a job role. A certificate scope is narrower, and only provides proof of a training course completion.
Certificate vs Certification A certification grants a candidate access to a membership organization, and almost always requires an annual continuing professional education (CPE) commitment to maintain the certification. But a certificate does not often associate one with any membership organization, and the body of knowledge gained does not evolve over time or require a CPE.
CCSP Domain 1. Cloud Concepts, Architecture and Design Domain 2. Cloud Data Security Domain 3. Cloud Platform and Infrastructure Security Domain 4. Cloud Application Security Domain 5. Cloud Security Operations Domain 6. Legal, Risk and Compliance
CCSK
CCSK
On-demand self-service A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.
Rapid elasticity Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
Without essential characteristics, it can never be a โproperโ cloud service, but rather a Virtual Private Server (VPS).
Data Security Lifecycle
Common networks underlying IaaS
Software Defined Perimeter
deployment pipeline for creating images for immutable VMs or containers.
Virtual networks move packets in software and monitoring canโt rely on sniffing the physical network connections.
Incident Response Lifecycle
Secure application design and development phases
continuous deployment pipeline
Managing data migrations to the cloud.
SECaaS https://cloudsecurityalliance.org/research/artifacts/?term=security-as-a-service 1. 2. 3. 4. 5. Identity and Access Management Data Loss Prevention Web Security Email Security Security Assessments 6. 7. 8. 9. 10. Intrusion Management Security, Information and Event Management Encryption BC/DR Network Security
The current list of Related Tech includes: โข Big Data โข Internet of Things (IoT) โข Mobile devices โข Serverless computing
(5) How does CCM help communicate with customers? https://downloads.cloudsecurityalliance.org/initiatives/ccm/CSA_CCM_v3.0.xlsx https://docs.google.com/presentation/d/1qFr9Mm8jiCzfm2roGsfhTR8GaUKwudfgw-t JLYOwnfg/edit?usp=sharing
CCMโs Control Domains 1. 2. 3. 4. 5. 6. 7. 8. Application & Interface Security Audit Assurance & Compliance Business Continuity Management & Operational Resilience Change Control & Configuration Management Data Security & Information Lifecycle Management Datacenter Security Encryption & Key Management Governance and Risk Management 9. 10. 11. 12. 13. 14. 15. 16. Human Resources Identity & Access Management Infrastructure & Virtualization Security Interoperability & Portability Mobile Security Security Incident Management, E-Discovery & Cloud Forensics Supply Chain Management, Transparency and Accountability Threat and Vulnerability Management
Application & Interface Security
Application Security Customer Access Requirements Data Integrity Data Security / Integrity
Audit Assurance & Compliance
Business Continuity Management & Operational Resilience 1. 2. 3. 4. 5. 6. Business Continuity Planning 7. Equipment Maintenance Business Continuity Testing 8. Equipment Power Failures Datacenter Utilities / Environmental Conditions 9. Impact Analysis Documentation 10. Management Program Environmental Risks 11. Policy Equipment Location 12. Retention Policy
Change Control & Configuration Management 1. 2. 3. 4. 5. New Development / Acquisition Outsourced Development Quality Testing Unauthorized Software Installations Production Changes
Data Security & Information Lifecycle Management 1. 2. 3. 4. Classification Data Inventory / Flows eCommerce Transactions Handling / Labeling / Security Policy 5. 6. 7. 8. Information Leakage Non-Production Data Ownership / Stewardship Secure Disposal
Datacenter Security 1. 2. 3. 4. 5. Asset Management Controlled Access Points Equipment Identification Off-Site Authorization Off-Site Equipment 6. 7. 8. 9. Policy Datacenter Security - Secure Area Authorization Unauthorized Persons Entry User Access
Encryption & Key Management
Entitlement Key Generation Sensitive Data Protection Storage and Access
Governance and Risk Management 1. 2. 3. 4. 5. 6. Baseline Requirements Data Focus Risk Assessments Management Oversight Management Program Management Support/Involvement Policy 7. 8. 9. 10. 11. 12. Policy Enforcement Policy Impact on Risk Assessments Policy Reviews Risk Assessments Risk Management Framework Risk Mitigation / Acceptance
Human Resources 1. 2. 3. 4. 5. 6. Asset Returns Background Screening Employment Agreements Employment Termination Industry Knowledge / Benchmarking Mobile Device Management 7. 8. 9. 10. 11. 12. Non-Disclosure Agreements Roles / Responsibilities Technology Acceptable Use Training / Awareness User Responsibility Workspace
Identity & Access Management 1. 2. 3. 4. 5. 6. Audit Tools Access Credential Lifecycle / Provision Management Diagnostic / Configuration Ports Access Policies and Procedures Segregation of Duties Source Code Access Restriction 7. 8. 9. 10. 11. 12. 13. Third Party Access Trusted Sources User Access Authorization User Access Reviews User Access Revocation User ID Credentials Utility Programs Access
Infrastructure & Virtualization Security 1. 2. 3. 4. 5. 6. Audit Logging / Intrusion Detection Change Detection Clock Synchronization Information System Documentation Management - Vulnerability Management Network Security 7. 8. 9. 10. 11. 12. OS Hardening and Base Conrols Production / Non-Production Environments Segmentation VM Security - vMotion Data Protection VMM Security - Hypervisor Hardening Wireless Security
Interoperability & Portability 1. 2. 3. 4. 5. APIs Data Request Policy & Legal Standardized Network Protocols Virtualization
Mobile Security 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Anti-Malware Application Stores Approved Applications Approved Software for BYOD Awareness and Training Cloud Based Services Compatibility Device Eligibility Device Inventory Device Management 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. Encryption Jailbreaking and Rooting Legal Lockout Screen Operating Systems Passwords Policy Remote Wipe Security Patches Users
Security Incident Management, E-Discovery & Cloud Forensics 1. 2. 3. 4. 5. Contact / Authority Maintenance Incident Management Incident Reporting Incident Response Legal Preparation Incident Response Metrics
Supply Chain Management, Transparency and Accountability 1. 2. 3. 4. 5. Data Quality and Integrity Incident Reporting Network / Infrastructure Services Provider Internal Assessments Supply Chain Agreements 6. 7. 8. 9. Supply Chain Governance Reviews Supply Chain Metrics Third Party Assessment Third Party Audits
Threat and Vulnerability Management
Scope Applicability 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. AICPA, TS Map AICPA, Trust Service Criteria (SOC 2SM Report) BITS Shared Assessments, AUP v5.0 BITS Shared Assessments, SIG v6.0 BSI Germany CCM V1.X COBIT 4.1 CSA Enterprise Architecture / Trust Cloud Initiative CSA Guidance V3.0 ENISA IAF 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. FedRAMP Security Controls (Final Release, Jan 2012) โLOW IMPACT LEVEL-FedRAMP Security Controls (Final Release, Jan 2012) โMODERATE IMPACT LEVEL-GAPP (Aug 2009) HIPAA / HITECH Act ISO/IEC 27001-2005 Jericho Forum NERC CIP NIST SP800-53 R3 NZISM PCI DSS v2.0
ENISAโs Cloud Computing Risk Assessment European Network and Information Security Agency European Union Agency for Cybersecurity https://www.enisa.europa.eu/publication s/cloud-computing-risk-assessment
(7) Would you encourage your staff and/or colleagues to obtain CCSK or other CSA qualifications? Why? CCSK then CCAK to understand how to assess proper cloud services.
(8) What is the best advice you will give to IT professionals in order for them to scale new heights in their careers? In organizations that can never keep up with ever expanding IT resources, cloud is a must. Knowing how to manage cloud resources and maintain reliable & resilient cloud operations, one needs proper cloud certification.
๐๐จ๐ฐ ๐๐๐ ๐ก๐๐ฅ๐ฉ ๐ฌ๐ก๐๐ฉ๐ข๐ง๐ ๐ฉ๐ซ๐จ๐ฉ๐๐ซ ๐๐ฅ๐จ๐ฎ๐ ๐ฌ๐๐ซ๐ฏ๐ข๐๐๐ฌ ๐ญ๐ก๐ซ๐จ๐ฎ๐ ๐ก ๐๐๐๐ ๐๐ง๐ ๐๐๐
for free. You
can too.