Pluralsight CCSP Domain 1 Flashcards
Cloud Characterstics
BRROM
- Broad Network Access - ability to access cloud anywhere
- Rapid Elasticity - ability to scale up or down quickly (i.e. Cloud bursting (private cloud onto public cloud))
- Resource Pooling - pool of resources available for customers to use (multi-tenant model); this includes equipment, staff, network, memory
- On-Demand Self-Service - ability to get services with little interaction with CSP
- Measured Service - pay for only what you use
Benefits of Cloud Computing
- Capital Cost Control
- Flexibility
- Access to Skilled Staff
- Environmental Impact - i.e. 15 companies moved to cloud and removed back up batteries, diesel
Service Orchestration
1. Define
2. What are the 3 layers
Cloud Roles -
* Cloud Carrier
* Cloud Broker
* Reseller
* Cloud Access Security Broker
* Cloud Architect
A cloud carrier provides:
* Network Access
* Redundancy (Diverse Routing)
* Bandwidth
A Cloud broker:
* manages relationships between cloud customers and CSP (negotiate contracts, may represent several CSPs)
Reseller - Resells services of a CSP
CASB:
* Monitors cloud access and cloud sevices that are being used
* May manage relationship between cloud customers and CSP
* May manage access controls
Cloud Architect
* Designs cloud implementations and ensures that business requiremetns are met
Cloud Deployment Models
1. Private
2. Public
3. Community Cloud
4. Hybrid
-
Private
* One organization, no multi-tenancy
* On or Off Premise
* May be owned by organization, 3rd party, or both -
Public
* Use by public, multi-tenancy
* On premise -
Community Cloud
* i.e. Universities, Hospitals, Government
* Provisioned for exclusive use by specific community that have shared concerns
* On or Off premise
* may be managed by one member of community or by 3rd party -
Hybrid
* i.e. Business continuity/Disaster Recovery (i.e. normal operations on public cloud and backup is in private cloud)
* two or more distincy cloud infrastructure that operate as seperate entities but are bound together by technology
* Enables data portability (cloud bursting) (ability to easily move processing to another facility)
*
Cloud Service Models (Image) IPS
Cloud Service Model
IaaS and the roles and responsibilities of CSP and cloud customer. What control does CSP and cloud customer have in regards to:
1. Application (i.e. Mail)
2. Middleware (i.e. Java)
3. Guest OS
4. Hypervisor
5. Hardware
CIA Triad in the Cloud
- Confidentiality - protection of information from unauthorized disclosure; more complex in cloud due to dependency on CSP
- Integrity - protection of information from unauthorized modification; assurance of correct processing, storage, and use of information; the cloud introduces more layers and therefore more attack surfaces (i.e. APIs, infrastructure, hypervisor)
- Availability - ensure system and data are accessible when needed; in the cloud, customer highly depends on CSP and therefore this is critical;
- Ephemeral computing
- Serverless Technology
- VM Sprawl
- Ephemeral computing - the practice of creating a virtual computing environment as a need arises and then destroying that environment when the need is met, and the resources are no longer in demand. You pay only for what’s used when it’s used.
- Serverless Technology - CSP handles the server, customer trusts the CSP to provide resources and security of server
- VM Sprawl - when the number of virtual machines (VMs) on a network reaches a point where administrators can no longer manage them effectively
- Data Lifecycle
- IAAA
- Seperation of duties
Data Lifecycle
1. Create
2. Store
3. Use
4. Share
5. Archive
6. Delete
IAAA
* Identification - identifying who has access
* Authentication - prove their identity
* Authorization - determine and grant access based on privileges
* Accounting / Audtiing - records
Seperation of Duties - no one person controls a sensitive transaction from start to finish to prevent mistakes or fraud
- CSA Star
- SSAE 20
- ISO/IEC 27001
- UpTime Institute
- FISMA
- PCI-DSS
- ISO/IEC 15408
- FIPS 140-2
-
CSA Star - Security Trust Assurance and Risk; framework that evaluates cloud providers; based on Cloud control matrix (CCM) and GDPR (privacy) (3 levels)
Level 1 - Self-assessment- consensus assessments initiative questionaire (CAIQ); updates every 30 days for level 1
Level 2 - 3rd party audit
-Attestation - collaboration between AICPA and CSA to use CCM and SOC 2
-Certification - technology neutral certification; 3rd party audit; collab between CCM and ISO 27001
-C-STAR Assessment - 3rd party assessment for the greater china market;
Level 3 continuous auditing 3rd party
-
SSAE-20 (previously SAS-70, SSAE-18, SSAE-20) [Statement on Standards for Attestation Engagements created by American Institute of Certified Public Accountants (AICPA) - with each implementation, there is improvement with lessons learned from each document
1. Main component is SOC (System and organizational controls) report - generated once SSAE evaluation has been completed; - SSAE-20 SOC 1 - financial reporting of organization; this ensures financial report is accurate and organization will not bankrupt soon
- SSAE-20 SOC 2 - detailed report primarily for internal use. evaluation of CSP based on WebTrust and SysTrust relevant to (security, privacy, process integrity, confidentiality, availability)
- SSAE-20 SOC 3 - most organizations will share this report; summary of SOC 2 without the details (used for marketing)
- Type 1 assessment - conducted at a point in time
- Type 2 assessment - conducted over a period of time (~6 months, but may be continuous)
- ISO/IEC 27001 - defines standards for information security management system (ISMS) or organization
- UpTime Institute - looks at data center design (back-up power), construction, and on-going operations (ensures high availability of data center if that’s what the organiztion needs)
- FISMA
- PCI-DSS
- ISO/IEC 15408 - aka common criteria. evaluation for IT products
- FIPS 140-2 - evaluation of crypto devices
Due Care vs Due Diligence
Define non-repudiation
Define Chain of Custody
Due Care - focuses on whether someone is doing what they’re supposed to be doing (in your policies procedures etc); the actions taken by a reasonable person to protect others from unreasonable harm
Due Diligence - focuses on if someone did what other reasonable people would do; the enforcement of the actions of due care
Non-Repudiation - the ability to link actions to an individual entity
Chain of custody - documented record of all actions related to evidence thrgouhout evidence lifecycle
CSP vs MSP
CSP sets governance whereas for MSP, the organization sets governance
MSP is a third party that executes organizations tech and operational procedures
- Compliance as a Service
- Networking as a Service
- Data Science as a Service
- Which cloud model is a proper segmentation of resources an issue?
- Security issue with SaaS
- Which cloud model encourages shared access and needs robust IAM?
- What is XaaS?
- Which technology has had the impact of making the cloud intelligent?
- Quantum Computing
- Containers
- IoT
- SLA
- MOU
- LOI
- Contract
Interoperability vs Portability
- ECC
- AES
- DES
- Triple DES
Application Orchestration
- SQL Injection
- DoS
- XSS
- CSRF
- Cloud Working Group (CWG)
- NIST
- FIPS
- CSA Trusted Cloud Initiative (TCI)
TLS and IPsec
OSI Layers (People don’t need to see paula abdul)
