So let's take a moment to review the key elements of the
Cloud Security Operations for CCSP course,
the fifth in the line of six domains for the CCSP exam.
Recall that the exam outline contains these testable items,
build and implement physical and logical infrastructure for cloud environment,
operate and maintain physical and logical infrastructure for cloud environment,
implement operational controls and standards,
support digital forensics, manage communication with relevant parties,
and manage security operations.
All of these are learning objectives that are included in the
exam outline that you should be familiar with.
Let these points surface to your mind as key.
The key points that should still resonate with you is that
most of the operations related to physical controls in the
cloud are wholly on the provider.
In fact, that's the motive for using the cloud,
so that the customer doesn't have to be concerned about the cost and
the management of resources at a physical level.
But, the separation in logical controls is not as simple to assume.
Here,
you should remember that the shared‑responsibility model is
what will dictate how much responsibility you have and how much
is on the cloud service provider.
Always recall,
you should begin with administrative controls before you
delve into physical and logical controls,
otherwise,
you may not be able to capture the full breadth of the
concern in your security environment.
Components of physical and logical security you should
recall are hardware security modules, the type‑one hypervisors,
the Trusted Platform Module, firewalls and security groups,
along with data encryption keys.
Each of these have an element of protective measures that should be taken.
For the hardware security module and the Trusted Platform Module,
they actually use encryption, or encryption is something that they're protecting.
The hypervisor needs to go through hardening by the cloud service provider,
but some cloud service providers are allowing you
to actually launch hypervisors.
Think also from the standpoint of systems and physical and
logical security along with those systems,
like the VXLAN that doubles the ID of the native VLAN and has
the ability to create 16 million networks.
Think also of DNSSEC and the other security parameters
that we need to configure with DNS, including DMARK,
SPF, and DKIM.
Think also about IPSEC,
and TLS VPNs and how these are still heavily used in order to
access read sources from our cloud carrier.
Also recall how infrastructure as code simplify security,
automates it,
and makes it so that you can stand up a whole security
environment in an automated fashion.
Administrative controls all should center around change management.
Recall that change management is the umbrella for
all other management activities.
Change management is a nontechnical resource for the
organization serving the business need, and therefore,
the language should also be nontechnical in a change management meeting.
All other management capabilities report into change management,
including configuration, deployment, release,
and patch management, even incident and problem management,
along with service level, availability, and continuity management.
Service‑level management needs to focus on the
availability of resources and less on uptime,
as we think less about physical resources and more about services.
The monitoring of security controls includes vulnerability,
log capture and analysis, and the security operations center.
Modern‑day cloud service providers give you a rich access to resources via APIs.
Here, you can monitor all of what's going on in your management console.
Next up on the list,
be sure to take the self‑assessment questions that you
will find inside of the study guide.
Think about, as you go through the questions, how one
answer should be better than another.
Think of the context, both in time and what the answer is focusing on.
Be sure to grab your study guide so that you're able to
look at your assessment questions.
And then, go into the last course in the tranche of six for the CCSP exam,
Legal, Risk, and Compliance.