Duration:

4 days

Course Synopsis:

ISC2 developed the Certified Cloud Security Professional (CCSP) credential to ensure that cloud security professionals have the required knowledge, skills, and abilities in cloud security design, implementation, architecture, operations, controls, and compliance with regulatory frameworks. A CCSP applies information security expertise to a cloud computing environment and demonstrates competence in cloud security architecture, design, operations, and service orchestration. This professional competence is measured against a globally recognized body of knowledge.

Course Objectives:

At the end of this course, participants would be able to:

Identify and explain the Cloud Computing concepts and definitions based on the ISO/IEC 17788 and NIST standards.
Identify and explain the Cloud Security Alliance’s Notorious Nine, Treacherous Twelve and Egregious Eleven.
Understand, and be able to differentiate between, the various service delivery models, frameworks and hypervisor threats that are incorporated into the cloud computing reference architecture.
Demonstrate the application of appropriate security strategies and be able to recommend appropriate controls for protecting data at rest, data in use and data in motion.
Discuss strategies for data ownership, data sovereignty, data classification and implementing appropriate measures for assurance for ensuring privacy, compliance with regulatory agencies and working with authorities during legal investigations.
Understand the challenges for data centre design, forensic analysis and cloud environment deployments and recommend appropriate risk mitigation strategies.
Understand and apply Business Continuity Planning and Disaster Recovery procedures for disaster situations.
Design appropriate identity and access management solutions.
Comprehend and apply appropriate processes and frameworks including the Software Development Life-Cycle (SDLC) process and secure operations.

Course Prerequisites:

Candidates must have a minimum of five years cumulative paid work experience in information technology, of which three years must be in information security and one year in one or more of the six domains of the CCSP CBK. Earning CSA’s CCSK certificate can be substituted for one year of experience in one or more of the six domains of the CCSP CBK. Earning the CISSP credential can be substituted for the entire CCSP experience requirement.

Who Should Attend:

The CCSP is ideal for IT and information security leaders responsible for applying best practices to cloud security architecture, design, operations and service orchestration, including those in the following positions:

Cloud Architect
Cloud Engineer
Cloud Consultant
Cloud Administrator
Cloud Security Analyst
Cloud Specialist
Auditor of Cloud Computing Services
Professional Cloud Developer

Domain 1. Cloud Concepts, Architecture and Design

Understand Cloud Computing Concepts
Describe Cloud Reference Architecture
Understand Security Concepts Relevant to Cloud Computing
Understand Design Principles of Secure Cloud Computing
Evaluate Cloud Service Providers

Domain 2. Cloud Data Security

Describe Cloud Data Lifecycle
Design and Implement Cloud Data Storage Architectures
Design and Apply Data Security Technologies Strategies
Implement Data Discovery
Plan and implement data classification
Design and Implement Information Rights Management (IRM)
Plan and Implement Data Retention, Deletion, and Archiving Policies
Design and Implement Auditability, Traceability, and Accountability of Data Events

Domain 3. Cloud Platform & Infrastructure Security

Comprehend Cloud Infrastructure and Platform Components
Design a Secure Data Center
Analyze Risks Associated with Cloud Infrastructure and Platforms
Plan and Implementation of Security Controls
Plan business continuity (BC) and disaster recovery (DR)

Domain 4. Cloud Application Security

Advocate Training and Awareness for Application Security
Describe the Secure Software Development Life Cycle (SDLC) process
Apply the Software Development Life-Cycle (SDLC)
Apply Cloud Software Assurance and Validation
Use verified secure software
Comprehend The Specifics of Cloud Application Architecture
Design appropriate identity and access management (IAM) solutions

Domain 5. Cloud Security Operations

Build and Implement Physical and Logical Infrastructure for Cloud Environment
Operate and Maintain Physical and Logical Infrastructure for Cloud Environment
Implement Operational Controls and Standards (E.G., Information Technology Infrastructure Library (ITIL), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 20000-1)
Support Digital Forensics
Manage Communication with Relevant Parties
Manage Security Operations

Domain 6. Legal, Risk and Compliance

Articulate Legal Requirements and Unique Risks within the Cloud Environment
Understand Privacy Issues
Understand Audit Process, Methodologies, and Required Adaptions for a Cloud Environment
Understand Implications of Cloud to Enterprise Risk Management
Understand Outsourcing and Cloud Contract Design

Length of exam

4 hours

Number of questions

Question format

Multiple choice

Passing grade

700 out of 1000 points

Exam availability

English, Chinese, German, Japanese, Korean, Spanish

Testing center

ISC2 Authorized PPC and PVTC Select Pearson VUE Testing Centers

Examination Information

Programme scope, delivery arrangements and suitability are confirmed during enquiry.