The Official (ISC)2 CCSP CBK Reference

Accountability of Data Events 81Definition of Event Sources and Requirement of Identity Attribution 81Logging, Storage, and Analysis of Data Events 82Chain of Custody and Nonrepudiation 84Summary 85Domain 3: Cloud Platform and Infrastructure Security 87Comprehend Cloud Infrastructure Components 88Physical Environment 88Network and Communications 89Compute 90Virtualization 91Storage 93Management Plane 93Design a Secure Data Center 95Logical Design 95Physical Design 97Environmental Design 98Analyze Risks Associated with Cloud Infrastructure 99Risk Assessment and Analysis 100Cloud Vulnerabilities, Threats, and Attacks 101Virtualization Risks 101Countermeasure Strategies 102Design and Plan Security Controls 102Physical and Environmental Protection 103System and Communication Protection 103Virtualization Systems Protection 104Identification, Authentication, and Authorization in Cloud Infrastructure 105Audit Mechanisms 106Plan Disaster Recovery and Business Continuity 107Risks Related to the Cloud Environment 108Business Requirements 109Business Continuity/Disaster Recovery Strategy 111Creation, Implementation, and Testing of Plan 112Summary 116Domain 4: Cloud Application Security 117Advocate Training and Awareness for Application Security 117Cloud Development Basics 118Common Pitfalls 118Common Cloud Vulnerabilities 119Describe the Secure Software Development Lifecycle Process 120NIST Secure Software Development Framework 120OWASP Software Assurance Security Model 121Business Requirements 121Phases and Methodologies 122Apply the Secure Software Development Lifecycle 123Avoid Common Vulnerabilities During Development 123Cloud-Specific Risks 124Quality Assurance 127Threat Modeling 127Software Configuration Management and Versioning 128Apply Cloud Software Assurance and Validation 129Functional Testing 130Security Testing Methodologies 131Use Verified Secure Software 132Approved Application Programming Interfaces 132Supply-Chain Management 133Third-Party Software Management 134Validated Open Source Software 134Comprehend the Specifics of Cloud Application Architecture 135Supplemental Security Components 136Cryptography 138Sandboxing 139Application Virtualization and Orchestration 139Design Appropriate Identity and Access Management Solutions 140Federated Identity 140Identity Providers 141Single Sign-On 141Multifactor Authentication 142Cloud Access Security Broker 142Summary 143Domain 5: Cloud Security Operations 145Implement and Build Physical and Logical Infrastructure for Cloud Environment 145Hardware-Specific Security Configuration Requirements 146Installation and Configuration of Virtualization Management Tools 149Virtual Hardware-Specific Security Configuration Requirements 150Installation of Guest Operating System Virtualization Toolsets 152Operate Physical and Logical Infrastructure for Cloud Environment 152Configure Access Control for Local and Remote Access 153Secure Network Configuration 155Operating System Hardening through the Application of Baselines 160Availability of Stand-Alone Hosts 162Availability of Clustered Hosts 162Availability of Guest Operating Systems 165Manage Physical and Logical Infrastructure for Cloud Environment 166Access Controls for Remote Access 166Operating System Baseline Compliance Monitoring and Remediation 168Patch Management 169Performance and Capacity Monitoring 172Hardware Monitoring 173Configuration of Host and Guest Operating System Backupand Restore Functions 174Network Security Controls 175Management Plane 179Implement Operational Controls and Standards 180Change Management 180Continuity Management 182Information Security Management 184Continual Service Improvement Management 185Incident Management 186Problem Management 189Release Management 190Deployment Management 191Configuration Management 192Service Level Management 194Availability Management 195Capacity Management 196Support Digital Forensics 197Forensic Data Collection Methodologies 197Evidence Management 200Collect, Acquire, and Preserve Digital Evidence 201Manage Communication with Relevant Parties 204Vendors 205Customers 206Shared Responsibility Model 206Partners 208Regulators 208Other Stakeholders 209Manage Security Operations 210Security Operations Center 210Monitoring of Security Controls 215Log Capture and Analysis 217Incident Management 220Summary 226Domain 6: Legal, Risk, and Compliance 227Articulating Legal Requirements and Unique Risks Within the Cloud Environment 227Conflicting International Legislation 228Evaluation of Legal Risks Specific to Cloud Computing 229Legal Frameworks and Guidelines That Affect Cloud Computing 229Forensics and eDiscovery in the Cloud 236Understanding Privacy Issues 238Difference between Contractual and Regulated Private Data 239Country-Specific Legislation Related to Private Data 242Jurisdictional Differences in Data Privacy 247Standard Privacy Requirements 248Understanding Audit Process, Methodologies, and Required Adaptations for a Cloud Environment 250Internal and External Audit Controls 251Impact of Audit Requirements 251Identity Assurance Challenges of Virtualization and Cloud 252Types of Audit Reports 252Restrictions of Audit Scope Statements 255Gap Analysis 256Audit Planning 257Internal Information Security Management Systems 258Internal Information Security Controls System 259Policies 260Identification and Involvement of Relevant Stakeholders 262Specialized Compliance Requirements for Highly Regulated Industries 264Impact of Distributed Information Technology Models 264Understand Implications of Cloud to Enterprise Risk Management 266Assess Providers Risk Management Programs 266Differences Between Data Owner/Controller vs. Data Custodian/Processor 268Regulatory Transparency Requirements 269Risk Treatment 270Risk Frameworks 270Metrics for Risk Management 272Assessment of Risk Environment 273Understanding Outsourcing and Cloud Contract Design 276Business Requirements 277Vendor Management 278Contract Management 279Supply Chain Management 281Summary 282Index 283