Table of Contents:
“...Introduction xxi -- Assessment
Test xxviii -- Chapter 1 Architectural Concepts 1 -- Cloud Characteristics 2 -- Business Requirements 4 -- Existing State 5 -- Quantifying Benefits and Opportunity Cost 6 -- Intended Impact 8 -- Cloud Evolution, Vernacular, and Models 9 -- New Technology, New Options 9 -- Cloud
Computing Service Models 10 -- Cloud Deployment Models 12 -- Cloud
Computing Roles and Responsibilities 13 -- Cloud
Computing Definitions 14 -- Foundational Concepts of Cloud
Computing 16 -- Sensitive
Data 16 -- Virtualization 16 -- Encryption 16 -- Auditing and Compliance 17 -- Cloud Service Provider Contracts 17 -- Related and Emerging Technologies 18 -- Summary 19 -- Exam Essentials 19 -- Written Labs 20 -- Review Questions 21 -- Chapter 2 Design Requirements 25 -- Business Requirements Analysis 26 -- Inventory of Assets 26 -- Valuation of Assets 27 -- Determination of Criticality 27 -- Risk Appetite 29 -- Security Considerations for Different Cloud Categories 31 -- IaaS Considerations 32 -- PaaS Considerations 32 -- SaaS Considerations 32 -- General Considerations 33 -- Design Principles for Protecting Sensitive
Data 33 -- Hardening Devices 33 -- Encryption 35 -- Layered Defenses 35 -- Summary 36 -- Exam Essentials 37 -- Written Labs 37 -- Review Questions 38 -- Chapter 3
Data Classification 43 --
Data Inventory and Discovery 45 --
Data Ownership 45 -- The
Data Lifecycle 46 --
Data Discovery Methods 50 -- Jurisdictional Requirements 51 -- Information Rights Management (IRM) 53 -- Intellectual Property Protections 53 -- IRM Tool Traits 57 --
Data Control 59 --
Data Retention 60 --
Data Audit 61 --
Data Destruction/Disposal 63 -- Summary 65 -- Exam Essentials 65 -- Written Labs 66 -- Review Questions 67 -- Chapter 4 Cloud
Data Security 71 -- Cloud
Data Lifecycle 73 -- Create 74 -- Store 75 -- Use 75 -- Share 75 -- Archive 76 -- Destroy 77 -- Cloud Storage Architectures 78 -- Volume Storage: File-Based Storage and Block Storage 78 -- Object-Based Storage 78 -- Databases 79 -- Content Delivery Network (CDN) 79 -- Cloud
Data Security Foundational Strategies 79 -- Encryption 79 -- Masking, Obfuscation, Anonymization, and Tokenization 81 -- Security Information and Event Management 84 -- Egress Monitoring (DLP) 85 -- Summary 86 -- Exam Essentials 86 -- Written Labs 87 -- Review Questions 88 -- Chapter 5 Security in the Cloud 93 -- Shared Cloud Platform Risks and Responsibilities 95 -- Cloud
Computing Risks by Deployment Model 97 -- Private Cloud 98 -- Community Cloud 98 -- Public Cloud 100 -- Hybrid Cloud 104 -- Cloud
Computing Risks by Service Model 104 -- Infrastructure as a Service (IaaS) 104 -- Platform as a Service (PaaS) 105 -- Software as a Service (SaaS) 106 -- Virtualization 106 -- Threats 107 -- Countermeasure Methodology 109 -- Disaster Recovery (DR) and Business Continuity (BC) 112 -- Cloud-Specific BIA Concerns 112 -- Customer/Provider Shared BC/DR Responsibilities 113 -- Summary 116 -- Exam Essentials 116 -- Written Labs 117 -- Review Questions 118 -- Chapter 6 Responsibilities in the Cloud 123 -- Foundations of Managed Services 126 -- Business Requirements 127 -- Business Requirements: The Cloud Provider Perspective 127 -- Shared Responsibilities by Service Type 133 -- IaaS 133 -- PaaS 133 -- SaaS 133 -- Shared Administration of OS, Middleware, or Applications 134 -- Operating System Baseline Configuration and Management 134 -- Shared Responsibilities:
Data Access 136 -- Customer Directly Administers Access 137 -- Provider Administers Access on Behalf of the Customer 137 -- Third-Party (CASB) Administers Access on Behalf of the Customer 137 -- Lack of Physical Access 137 -- Audits 138 -- Shared Policy 142 -- Shared Monitoring and
Testing 142 -- Summary 143 -- Exam Essentials 143 -- Written Labs 144 -- Review Questions 145 -- Chapter 7 Cloud Application Security 149 -- Training and Awareness 151 -- Common Cloud Application Deployment Pitfalls 154 -- Cloud-Secure Software Development Lifecycle (SDLC) 156 -- Configuration Management for the SDLC 157 -- ISO/IEC 27034-1 Standards for Secure Application Development 158 -- Identity and Access Management (IAM) 159 -- Identity Repositories and Directory Services 160 -- Single Sign-On (SSO) 161 -- Federated Identity Management 161 -- Federation Standards 162 -- Multifactor Authentication 162 -- Supplemental Security Components 163 -- Cloud Application Architecture 164 -- Application
Programming Interfaces 164 -- Tenancy Separation 165 -- Cryptography 165 -- Sandboxing 166 -- Application Virtualization 167 -- Cloud Application Assurance and Validation 167 -- Threat Modeling 167 -- Quality of Service 169 -- Software Security
Testing 170 -- Approved APIs 172 -- Software Supply Chain (API) Management 172 -- Securing Open-Source Software 172 -- Application Orchestration 173 -- The Secure Network Environment 174 -- Summary 175 -- Exam Essentials 175 -- Written Labs 176 -- Review Questions 177 -- Chapter 8 Operations Elements 181 -- Physical/Logical Operations 183 -- Facilities and Redundancy 184 -- Virtualization Operations 194 -- Storage Operations 196 -- Physical and Logical Isolation 199 -- Application
Testing Methods 200 -- Security Operations Center 201 -- Continuous Monitoring 201 -- Incident Management 202 -- Summary 203 -- Exam Essentials 204 -- Written Labs 204 -- Review Questions 205 -- Chapter 9 Operations Management 209 -- Monitoring, Capacity, and Maintenance 211 -- Monitoring 211 -- Maintenance 213 -- Change and Configuration Management (CM) 217 -- Baselines 218 -- Deviations and Exceptions 218 -- Roles and
Process 219 -- Release Management 221 -- IT Service Management and Continual Service Improvement 222 -- Business Continuity and Disaster Recovery (BC/DR) 223 -- Primary Focus 224 -- Continuity of Operations 225 -- The BC/DR Plan 225 -- The BC/DR Kit 227 -- Relocation 228 -- Power 229 --
Testing 230 -- Summary 231 -- Exam Essentials 231 -- Written Labs 232 -- Review Questions 233 -- Chapter 10 Legal and Compliance Part 1 237 -- Legal Requirements and Unique Risks in the Cloud Environment 239 -- Legal Concepts 239 -- US Laws 242 -- International Laws 246 -- Laws, Frameworks, and Standards Around the World 246 -- Information Security Management Systems (ISMSs) 252 -- The Difference between Laws, Regulations, and Standards 254 -- Potential Personal and
Data Privacy Issues in the Cloud Environment 254 -- eDiscovery 255 -- Forensic Requirements 256 -- Conflicting International Legislation 256 -- Cloud Forensic Challenges 257 -- Direct and Indirect Identifiers 258 -- Forensic
Data Collection Methodologies 258 -- Audit
Processes, Methodologies, and Cloud Adaptations 259 -- Virtualization 259 -- Scope 259 -- Gap Analysis 260 -- Restrictions of Audit Scope Statements 260 -- Policies 261 -- Different Types of Audit Reports 261 -- Auditor Independence 262 -- AICPA Reports and Standards 262 -- Summary 263 -- Exam Essentials 264 -- Written Labs 264 -- Review Questions 265 -- Chapter 11 Legal and Compliance Part 2 269 -- The Impact of Diverse Geographical Locations and Legal Jurisdictions 271 -- Policies 272 -- Implications of the Cloud for Enterprise Risk Management 276 -- Choices Involved in Managing Risk 276 -- Risk Management Frameworks 279 -- Risk Management Metrics 281 -- Contracts and Service-Level Agreements (SLAs) 281 -- Business Requirements 284 -- Cloud Contract Design and Management for Outsourcing 284 -- Identifying Appropriate Supply Chain and Vendor Management
Processes 285 -- Common Criteria Assurance Framework (ISO/IEC 15408-1:2009) 285 -- CSA Security, Trust, and Assurance Registry (STAR) 286 -- Supply Chain Risk 287 -- Manage Communication with Relevant Parties 288 -- Summary 289 -- Exam Essentials 289 -- Written Labs 289 -- Review Questions 290 -- Appendix A Answers to Written Labs 295 -- Chapter 1: Architectural Concepts 296 -- Chapter 2: Design Requirements 296 -- Chapter 3:
Data Classification 297 -- Chapter 4: Cloud
Data Security 298 -- Chapter 5: Security in the Cloud 299 -- Chapter 6: Responsibilities in the Cloud 299 -- Chapter 7: Cloud Application Security 300 -- Chapter 8: Operations Elements 300 -- Chapter 9: Operations Management 301 -- Chapter 10: Legal and Compliance Part 1 302 -- Chapter 11: Legal and Compliance Part 2 302 -- Appendix B Answers to Review Questions 303 -- Chapter 1: Architectural Concepts 304 -- Chapter 2: Design Requirements 305 -- Chapter 3:
Data Classification 307 -- Chapter 4: Cloud
Data Security 308 -- Chapter 5: Security...
”
Call Number:
Loading...
Located:
Loading...
Connect to the full text of this electronic book
eBook