Let's take a look at the important points we've covered in this
first course of the CCSP, Cloud Concepts,
Architecture, and Design.
By going through this,
we can review what are the things we could expect to
see on the examination as well.
The exam content is divided into five major areas,
understanding cloud computing concepts, describing
the cloud reference architecture,
understand security concepts relevant to cloud computing,
understand design principles of secure cloud computing,
and to evaluate cloud service providers.
All of these cover a lot of sub‑topics as well.
It's important we understand these topics,
we know how to apply them,
but most of all we must remember this is a cloud security course,
not just a cloud architecture course.
Some of the key points we must remember as we approach the exam is
that the use of the cloud is a supporting technology,
but it's there in order to ensure the business can operate, so
therefore we are looking at cloud security,
not just cloud principles.
There are many different ways to deploy the cloud, and the important
function for us is to ensure that information security has been
incorporated into cloud deployments, therefore,
our security program is also aligned with what's important for the business.
The goals of this information security program in the cloud is to
ensure that we have cost‑effective risk management.
We know that the cloud represents a significant supply
chain risk for most organizations.
They depend on the cloud, and if the cloud was to fail or
it was unable to protect their data,
the very business itself could be at risk of failure. But we need
to understand what are the cloud‑specific risks,
the risks that come when we move into a multi‑tenant environment,
for example. One of the things that's very important to remember
is that the responsibility for risk is that of the senior
management of the organization.
They are the owners of the risk and the owners of the data,
so even if we use a cloud deployment as a subcontractor
from a cloud service provider,
we still have prime responsibility for risk and for the protection of our data,
even though it's on somebody else's system.
Some of the important cloud concepts we looked at include the various
cloud service categories such as Software, Infrastructure, and Platform as
a Service; various types of deployment models,
public, private, community, and hybrid; the various
elements that make up the cloud,
the building blocks, things like virtualization and containers; and
some of the key cloud computing characteristics.
We saw these defined by NIST as things like broad network
access, measured service, and the ability to adjust our
deployment according to our unique needs.
One of the things we must be aware of are what are the cloud‑specific
threats, and therefore the cloud security elements.
There are many different common threats to the cloud, everything
from failure of networks and equipment and personnel, and it's
important we practice good security hygiene.
That means we clean things up, we make sure that our data is
properly protected, and we also should ensure that the cloud service
providers we work with are following good security practices through
some type of evaluation criteria.
Three of the key points we wanted to stress throughout this
course are the need for proper access control,
data protection, and business continuity.
These are things that we must deploy in a cloud‑based environment to ensure
the business can run and we minimize our risk and liability.
The next steps, now that you've done this first foundational course,
do the self‑assessment questions, and when you do them,
it's always good to review them and say,
okay,
why is this answer better than another, would this answer have
been better for a different question, and look at ways to explain
to somebody why you chose your answer.
It's good to review the references provided and be familiar with the
terminology and even exam essentials that are provided in the Study Guide. And
then, proceed to the next course, Cloud Data Security.