Schweitzer Fachinformationen
Wenn es um professionelles Wissen geht, ist Schweitzer Fachinformationen wegweisend. Kunden aus Recht und Beratung sowie Unternehmen, öffentliche Verwaltungen und Bibliotheken erhalten komplette Lösungen zum Beschaffen, Verwalten und Nutzen von digitalen und gedruckten Medien.
The only official study guide for the new CCSP exam objectives effective from 2022-2025
(ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, 3rd Edition is your ultimate resource for the CCSP exam. As the only official study guide reviewed and endorsed by (ISC)2, this guide helps you prepare faster and smarter with the Sybex study tools that include pre-test assessments that show you what you know, and areas you need further review. In this completely rewritten 3rd Edition, experienced cloud security professionals Mike Chapple and David Seidl use their extensive training and hands on skills to help you prepare for the CCSP exam. Objective maps, exercises, and chapter review questions help you gauge your progress along the way, and the Sybex interactive online learning environment includes access to a PDF glossary, hundreds of flashcards, and two complete practice exams. Covering all CCSP domains, this book walks you through Cloud Concepts, Architecture and Design, Cloud Data Security, Cloud Platform and Infrastructure Security, Cloud Application Security, Cloud Security Operations, and Legal, Risk, and Compliance with real-world scenarios to help you apply your skills along the way.
The CCSP credential from (ISC)2 and the Cloud Security Alliance is designed to show employers that you have what it takes to keep their organization safe in the cloud. Learn the skills you need to be confident on exam day and beyond.
As organizations become increasingly reliant on cloud-based IT, the threat to data security looms larger. Employers are seeking qualified professionals with a proven cloud security skillset, and the CCSP credential brings your resume to the top of the pile. (ISC)2 CCSP Certified Cloud Security Professional Official Study Guide gives you the tools and information you need to earn that certification and apply your skills in a real-world setting.
About the Authors
Mike Chapple, PhD, CCSP, CISSP, is a bestselling author and Teaching Professor of Information Technology, Analytics, and Operations at Notre Dame's Mendoza College of Business. He is also the Academic Director of the University's Master of Science in Business Analytics program and holds multiple technical certifications, including the CIPP/US, CySA+, CISM, PenTest+, and Security+.
David Seidl, CISSP, is Vice President for Information Technology and Chief Information Officer at Miami University. He holds multiple technical certifications including GPEN, GCIH, PenTest+, and CySA+ and has written books on security certification and cyberwarfare.
Introduction xxiii
Assessment Test xxxii
Chapter 1 Architectural Concepts 1
Cloud Characteristics 3
Business Requirements 5
Understanding the Existing State 6
Cost/Benefit Analysis 7
Intended Impact 10
Cloud Computing Service Categories 11
Software as a Service 11
Infrastructure as a Service 12
Platform as a Service 12
Cloud Deployment Models 13
Private Cloud 13
Public Cloud 13
Hybrid Cloud 13
Multi- Cloud 13
Community Cloud 13
Multitenancy 14
Cloud Computing Roles and Responsibilities 15
Cloud Computing Reference Architecture 16
Virtualization 18
Hypervisors 18
Virtualization Security 19
Cloud Shared Considerations 20
Security and Privacy Considerations 20
Operational Considerations 21
Emerging Technologies 22
Machine Learning and Artificial Intelligence 22
Blockchain 23
Internet of Things 24
Containers 24
Quantum Computing 25
Edge and Fog Computing 26
Confidential Computing 26
DevOps and DevSecOps 27
Summary 28
Exam Essentials 28
Review Questions 30
Chapter 2 Data Classification 35
Data Inventory and Discovery 37
Data Ownership 37
Data Flows 42
Data Discovery Methods 43
Information Rights Management 46
Certificates and IRM 47
IRM in the Cloud 47
IRM Tool Traits 47
Data Control 49
Data Retention 50
Data Audit and Audit Mechanisms 53
Data Destruction/Disposal 55
Summary 57
Exam Essentials 57
Review Questions 59
Chapter 3 Cloud Data Security 63
Cloud Data Lifecycle 65
Create 66
Store 66
Use 67
Share 67
Archive 69
Destroy 70
Cloud Storage Architectures 71
Storage Types 71
Volume Storage: File- Based Storage and Block Storage 72
Object- Based Storage 72
Databases 73
Threats to Cloud Storage 73
Designing and Applying Security Strategies for Storage 74
Encryption 74
Certificate Management 77
Hashing 77
Masking, Obfuscation, Anonymization, and Tokenization 78
Data Loss Prevention 81
Log Capture and Analysis 82
Summary 85
Exam Essentials 85
Review Questions 86
Chapter 4 Security in the Cloud 91
Chapter 5 Shared Cloud Platform Risks and Responsibilities 92
Cloud Computing Risks by Deployment Model 94
Private Cloud 95
Community Cloud 95
Public Cloud 97
Hybrid Cloud 101
Cloud Computing Risks by Service Model 102
Infrastructure as a Service (IaaS) 102
Platform as a Service (PaaS) 102
Software as a Service (SaaS) 103
Virtualization 103
Threats 105
Risk Mitigation Strategies 107
Disaster Recovery (DR) and Business Continuity (BC) 110
Cloud- Specific BIA Concerns 110
Customer/Provider Shared BC/DR Responsibilities 111
Cloud Design Patterns 114
Summary 115
Exam Essentials 115
Review Questions 116
Cloud Platform, Infrastructure, and Operational Security 121
Foundations of Managed Services 123
Cloud Provider Responsibilities 124
Shared Responsibilities by Service Type 125
IaaS 125
PaaS 126
SaaS 126
Securing Communications and Infrastructure 126
Firewalls 127
Intrusion Detection/Intrusion Prevention Systems 128
Honeypots 128
Vulnerability Assessment Tools 128
Bastion Hosts 129
Identity Assurance in Cloud and Virtual Environments 130
Securing Hardware and Compute 130
Securing Software 132
Third- Party Software Management 133
Validating Open- Source Software 134
OS Hardening, Monitoring, and Remediation 134
Managing Virtual Systems 135
Assessing Vulnerabilities 137
Securing the Management Plane 138
Auditing Your Environment and Provider 141
Adapting Processes for the Cloud 142
Planning for Cloud Audits 143
Summary 144
Exam Essentials 145
Review Questions 147
Chapter 6 Cloud Application Security 151
Developing Software for the Cloud 154
Common Cloud Application Deployment Pitfalls 155
Cloud Application Architecture 157
Cryptography 157
Sandboxing 158
Application Virtualization and Orchestration 158
Application Programming Interfaces 159
Multitenancy 162
Supplemental Security Components 162
Cloud- Secure Software Development Lifecycle (SDLC) 164
Software Development Phases 165
Software Development Models 166
Cloud Application Assurance and Validation 172
Threat Modeling 172
Common Threats to Applications 174
Quality Assurance and Testing Techniques 175
Supply Chain Management and Licensing 177
Identity and Access Management 177
Cloud Identity and Access Control 178
Single Sign- On 179
Identity Providers 180
Federated Identity Management 180
Multifactor Authentication 181
Secrets Management 182
Common Threats to Identity and Access Management in the Cloud 183
Zero Trust 183
Summary 183
Exam Essentials 184
Review Questions 186
Chapter 7 Operations Elements 191
Designing a Secure Data Center 193
Build vs. Buy 193
Location 194
Facilities and Redundancy 196
Data Center Tiers 200
Logical Design 201
Virtualization Operations 202
Storage Operations 205
Managing Security Operations 207
Security Operations Center (SOC) 208
Continuous Monitoring 208
Incident Management 209
Summary 209
Exam Essentials 210
Review Questions 211
Chapter 8 Operations Management 215
Monitoring, Capacity, and Maintenance 217
Monitoring 217
Physical and Environmental Protection 218
Maintenance 219
Change and Configuration Management 224
Baselines 224
Roles and Process 226
Release and Deployment Management 228
Problem and Incident Management 229
IT Service Management and Continual Service Improvement 229
Business Continuity and Disaster Recovery 231
Prioritizing Safety 231
Continuity of Operations 232
BC/DR Planning 232
The BC/DR Toolkit 234
Relocation 235
Power 237
Testing 238
Summary 239
Exam Essentials 239
Review Questions 241
Chapter 9 Legal and Compliance Issues 245
Legal Requirements and Unique Risks in the Cloud Environment 247
Constitutional Law 247
Legislation 249
Administrative Law 249
Case Law 250
Common Law 250
Contract Law 250
Analyzing a Law 251
Determining Jurisdiction 251
Scope and Application 252
Legal Liability 253
Torts and Negligence 254
U.S. Privacy and Security Laws 255
Health Insurance Portability and Accountability Act 255
The Health Information Technology for Economic and Clinical Health Act 258
Gramm-Leach-Bliley Act 259
Sarbanes-Oxley Act 261
State Data Breach Notification Laws 261
International Laws 263
European Union General Data Protection Regulation 263
Adequacy Decisions 267
U.S.- EU Safe Harbor and Privacy Shield 267
Laws, Regulations, and Standards 269
Payment Card Industry Data Security Standard 270
Critical Infrastructure Protection Program 270
Conflicting International Legislation 270
Information Security Management Systems 272
Iso/iec 27017:2015 272
Privacy in the Cloud 273
Generally Accepted Privacy Principles 273
Iso 27018 279
Direct and Indirect Identifiers 279
Privacy Impact Assessments 280
Cloud Forensics 281
Forensic Requirements 281
Cloud Forensic Challenges 281
Collection and Acquisition 282
Evidence Preservation and Management 283
e-discovery 283
Audit Processes, Methodologies, and Cloud Adaptations 284
Virtualization 284
Scope 284
Gap Analysis 285
Restrictions of Audit Scope Statements 285
Policies 286
Audit Reports 286
Summary 288
Exam Essentials 288
Review Questions 290
Chapter 10 Cloud Vendor Management 295
The Impact of Diverse Geographical Locations and Legal Jurisdictions 297
Security Policy Framework 298
Policies 298
Standards 300
Procedures 302
Guidelines 303
Exceptions and Compensating Controls 304
Developing Policies 305
Enterprise Risk Management 306
Risk Identification 308
Risk Calculation 308
Risk Assessment 309
Risk Treatment and Response 313
Risk Mitigation 313
Risk Avoidance 314
Risk Transference 314
Risk Acceptance 315
Risk Analysis 316
Risk Reporting 316
Enterprise Risk Management 318
Assessing Provider Risk Management Practices 318
Risk Management Frameworks 319
Cloud Contract Design 320
Business Requirements 321
Vendor Management 321
Data Protection 323
Negotiating Contracts 324
Common Contract Provisions 324
Contracting Documents 326
Government Cloud Standards 327
Common Criteria 327
FedRAMP 327
Fips 140- 2 327
Manage Communication with Relevant Parties 328
Summary 328
Exam Essentials 329
Review Questions 330
Appendix Answers to the Review Questions 335
Chapter 1: Architectural Concepts 336
Chapter 2: Data Classification 337
Chapter 3: Cloud Data Security 339
Chapter 4: Security in the Cloud 341
Chapter 5: Cloud Platform, Infrastructure, and Operational Security 343
Chapter 6: Cloud Application Security 345
Chapter 7: Operations Elements 347
Chapter 8: Operations Management 349
Chapter 9: Legal and Compliance Issues 350
Chapter 10: Cloud Vendor Management 352
Index 355
The Certified Cloud Security Professional (CCSP) certification satisfies the growing demand for trained and qualified cloud security professionals. It is not easy to earn this credential; the exam is extremely difficult, and the endorsement process is lengthy and detailed.
The CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide offers the cloud professional a solid foundation for taking and passing the Certified Cloud Security Professional (CCSP) exam.
The more information you have at your disposal and the more hands-on experience you gain, the better off you'll be when attempting the exam. This study guide was written with that in mind. The goal was to provide enough information to prepare you for the test, but not so much that you'll be overloaded with information that's outside the scope of the exam.
This book presents the material at an intermediate technical level. Experience with and knowledge of security concepts, operating systems, and application systems will help you get a full understanding of the challenges that you'll face as a security professional.
We've included review questions at the end of each chapter to give you a taste of what it's like to take the exam. If you're already working in the security field, we recommend that you check out these questions first to gauge your level of expertise. You can then use the book mainly to fill in the gaps in your current knowledge. This study guide will help you round out your knowledge base before tackling the exam.
If you can answer 90 percent or more of the review questions correctly for a given chapter, you can feel safe moving on to the next chapter. If you're unable to answer that many correctly, reread the chapter and try the questions again. Your score should improve.
Don't just study the questions and answers! The questions on the actual exam will be different from the practice questions included in this book. The exam is designed to test your knowledge of a concept or objective, so use this book to learn the objectives behind the questions.
The CCSP certification is offered by the International Information System Security Certification Consortium, or (ISC)2, a global nonprofit organization. The mission of (ISC)2 is to support and provide members and constituents with credentials, resources, and leadership to address cybersecurity as well as information, software, and infrastructure security to deliver value to society. (ISC)2 achieves this mission by delivering the world's leading information security certification program. The CCSP is the cloud-focused credential in this series and is accompanied by several other (ISC)2 programs:
The CCSP certification covers six domains of cloud security knowledge. These domains are meant to serve as the broad knowledge foundation required to succeed in cloud security roles:
The CCSP domains are periodically updated by (ISC)2. The most recent revision in August 2022 slightly modified the weighting for Cloud Data Security from 19 to 20 percent while changing the focus on Cloud Security Operations from 17 to 16 percent. It also added or expanded coverage of emerging topics in cloud security.
Complete details on the CCSP Common Body of Knowledge (CBK) are contained in the Exam Outline (Candidate Information Bulletin). It includes a full outline of exam topics and can be found on the (ISC)2 website at www.isc2.org.
www.isc2.org
The CCSP exam is administered in English, Chinese, German, Japanese, Korean, and Spanish using a computer-based testing format. Your exam will contain 150 questions and have a four-hour time limit. You will not have the opportunity to skip back and forth as you take the exam: you only have one chance to answer each question correctly, so be careful!
Passing the CCSP exam requires achieving a score of at least 700 out of 1,000 points. It's important to understand that this is a scaled score, meaning that not every question is worth the same number of points. Questions of differing difficulty may factor into your score more or less heavily, and adaptive exams adjust to the test taker.
That said, as you work through the practice exams included in this book, you might want to use 70 percent as a goal to help you get a sense of whether you're ready to sit for the actual exam. When you're ready, you can schedule an exam at a location near you through the (ISC)2 website.
Questions on the CCSP exam use a standard multiple-choice format where you are presented with a question and four possible answer choices, one of which is correct. Remember to read the full question and all of the answer options very carefully. Some of those questions can get tricky!
The CCSP exam is administered in a computer-based testing (CBT) format. You'll register for the exam through the Pearson Vue website and may take the exam in the language of your choice.
You'll take the exam in a computer-based testing center located near your home or office. The centers administer many different exams, so you may find yourself sitting in the same room as a student taking a school entrance examination and a healthcare professional earning a medical certification. If you'd like to become more familiar with the testing environment, the Pearson Vue website offers a virtual tour of a testing center:
https://home.pearsonvue.com/test-taker/Pearson-Professional-Center-Tour.aspx
When you take the exam, you'll be seated at a computer that has the exam software already loaded and running. It's a pretty straightforward interface that allows you to navigate through the exam. You can download a practice exam and tutorial from the Pearson Vue website:
www.vue.com/athena/athena.asp
Exam policies can change from time to time. We highly recommend that you check both the (ISC)2 and Pearson VUE sites for the most up-to-date information when you begin your preparing, when you register, and again a few days before your scheduled exam date.
If you don't pass the CCSP exam, you shouldn't panic. Many individuals don't reach the bar on their first attempt but gain valuable experience that helps them succeed the second time around. When you retake the exam, you'll have the benefit of familiarity with the CBT environment and the CCSP exam format. You'll also have time to study the areas where you felt less confident.
After your first exam attempt, you must wait 30 days before retaking the computer-based exam. If you're not successful on that attempt, you must then wait 60 days before your third attempt and 90 days before your fourth attempt. You may not take the exam more than four times in any 12-month period.
Candidates who want to earn the CCSP credential must not only pass the exam but also demonstrate that they have at least five years of work experience in the information technology field. Your work experience must include three years of information security experience and one year of experience in one or more of the six CCSP domains.
Candidates who hold the CISSP certification may substitute that certification for the entire CCSP experience requirement. Candidates with the Certificate of Cloud Security Knowledge (CCSK) from the Cloud Security Alliance (CSA) may substitute that certification for one year of experience in the CCSP domains.
If you haven't yet completed your work experience requirement, you may still attempt the CCSP exam. An individual who passes the exam is a designated Associate of (ISC)2 and has six years to complete the work experience requirement.
Once you've earned your CCSP credential, you'll need to maintain your certification by paying maintenance fees and participating in continuing professional education (CPE). As long as you maintain your certification in good standing, you will not need to retake the CCSP exam.
Currently, the annual maintenance fees for the CCSP credential are $125 per year. This fee covers the renewal for all (ISC)2 certifications held by an individual.
The CCSP CPE requirement mandates earning at least 90 CPE credits during each three-year renewal cycle. Associates of (ISC)2 must earn at least 15 CPE credits each year. (ISC)2 provides an online portal where certificate holders may submit CPE completion for review and approval. The portal also tracks annual maintenance fee payments and progress toward recertification.
This book covers everything you need to know to pass the CCSP exam:
Dateiformat: ePUBKopierschutz: Adobe-DRM (Digital Rights Management)
Systemvoraussetzungen:
Das Dateiformat ePUB ist sehr gut für Romane und Sachbücher geeignet – also für „fließenden” Text ohne komplexes Layout. Bei E-Readern oder Smartphones passt sich der Zeilen- und Seitenumbruch automatisch den kleinen Displays an. Mit Adobe-DRM wird hier ein „harter” Kopierschutz verwendet. Wenn die notwendigen Voraussetzungen nicht vorliegen, können Sie das E-Book leider nicht öffnen. Daher müssen Sie bereits vor dem Download Ihre Lese-Hardware vorbereiten.Bitte beachten Sie: Wir empfehlen Ihnen unbedingt nach Installation der Lese-Software diese mit Ihrer persönlichen Adobe-ID zu autorisieren!
Weitere Informationen finden Sie in unserer E-Book Hilfe.
