Skip to main content

CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide



CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide

Brian T. O'Hara, Ben Malisow

ISBN: 978-1-119-27743-9 April 2017 384 Pages

Download Product Flyer

Download Product Flyer

Download Product Flyer is to download PDF in new tab. This is a dummy description. Download Product Flyer is to download PDF in new tab. This is a dummy description. Download Product Flyer is to download PDF in new tab. This is a dummy description. Download Product Flyer is to download PDF in new tab. This is a dummy description.


The only official study guide for the new CCSP exam

CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide is your ultimate resource for the CCSP exam. As the only official study guide reviewed and endorsed by (ISC)2, this guide helps you prepare faster and smarter with the Sybex study tools that include pre-test assessments that show you what you know, and areas you need further review. Objective maps, exercises, and chapter review questions help you gauge your progress along the way, and the Sybex interactive online learning environment includes access to a PDF glossary, hundreds of flashcards, and two complete practice exams. Covering all CCSP domains, this book walks you through Architectural Concepts and Design Requirements, Cloud Data Security, Cloud Platform and Infrastructure Security, Cloud Application Security, Operations, and Legal and Compliance with real-world scenarios to help you apply your skills along the way.

The CCSP is the latest credential from (ISC)2 and the Cloud Security Alliance, designed to show employers that you have what it takes to keep their organization safe in the cloud. Learn the skills you need to be confident on exam day and beyond.

  • Review 100% of all CCSP exam objectives
  • Practice applying essential concepts and skills
  • Access the industry-leading online study tool set
  • Test your knowledge with bonus practice exams and more

As organizations become increasingly reliant on cloud-based IT, the threat to data security looms larger. Employers are seeking qualified professionals with a proven cloud security skillset, and the CCSP credential brings your resume to the top of the pile. CCSP (ISC)2 Certified Cloud Security Professional Official Study Guide gives you the tools and information you need to earn that certification, and apply your skills in a real-world setting.

Related Resources

Introduction xv

Assessment Test xxiii

Chapter 1 Architectural Concepts 1

Business Requirements 4

Existing State 4

Quantifying Benefits and Opportunity Cost 5

Intended Impact 8

Cloud Evolution, Vernacular, and Definitions 8

New Technology, New Options 8

Cloud Computing Service Models 10

Cloud Deployment Models 11

Cloud Computing Roles and Responsibilities 13

Cloud Computing Definitions 13

Foundational Concepts of Cloud Computing 16

Sensitive Data 17

Virtualization 17

Encryption 17

Auditing and Compliance 18

Cloud Service Provider Contracts 18

Summary 19

Exam Essentials 19

Written Labs 19

Review Questions 20

Chapter 2 Design Requirements 25

Business Requirements Analysis 26

Inventory of Assets 26

Valuation of Assets 27

Determination of Criticality 27

Risk Appetite 29

Boundaries of Cloud Models 31

IaaS Boundaries 31

PaaS Boundaries 32

SaaS Boundaries 32

Design Principles for Protecting Sensitive Data 34

Hardening Devices 34

Encryption 35

Layered Defenses 36

Summary 37

Exam Essentials 37

Written Labs 37

Review Questions 38

Chapter 3 Data Classification 43

Data Inventory and Discovery 45

Data Ownership 45

The Data Life Cycle 46

Data Discovery Methods 49

Jurisdictional Requirements 50

Data Rights Management 51

Intellectual Property Protections 51

DRM Tool Traits 55

Data Control 57

Data Retention 58

Data Audit 59

Data Destruction/Disposal 61

Summary 62

Exam Essentials 63

Written Labs 63

Review Questions 64

Chapter 4 Cloud Data Security 67

Cloud Data Life Cycle 69

Create 70

Store 70

Use 71

Share 71

Archive 72

Destroy 74

Cloud Storage Architectures 74

Volume Storage: File-Based Storage and Block Storage 74

Object-Based Storage 74

Databases 75

Content Delivery Network (CDN) 75

Cloud Data Security Foundational Strategies 75

Encryption 75

Masking, Obfuscation, Anonymization, and Tokenization 77

Security Information and Event Management 80

Egress Monitoring (DLP) 81

Summary 82

Exam Essentials 82

Written Labs 83

Review Questions 84

Chapter 5 Security in the Cloud 87

Shared Cloud Platform Risks and Responsibilities 88

Cloud Computing Risks by Deployment and Service Model 90

Private Cloud 91

Community Cloud 91

Public Cloud 92

Hybrid Cloud 97

IaaS (Infrastructure as a Service) 97

PaaS (Platform as a Service) 97

SaaS (Software as a Service) 98

Virtualization 98

Cloud Attack Surface 99

Threats by Deployment Model 100

Countermeasure Methodology 102

Disaster Recovery (DR) and Business Continuity Management (BCM) 105

Cloud-Specific BIA Concerns 105

Customer/Provider Shared BC/DR Responsibilities 106

Summary 108

Exam Essentials 109

Written Labs 109

Review Questions 110

Chapter 6 Responsibilities in the Cloud 115

Foundations of Managed Services 118

Business Requirements 119

Business Requirements: The Cloud Provider Perspective 119

Shared Responsibilities by Service Type 125

IaaS 125

PaaS 125

SaaS 125

Shared Administration of OS, Middleware, or Applications 126

Operating System Baseline Configuration and Management 126

Share Responsibilities: Data Access 128

Customer Directly Administers Access 128

Provider Administers Access on Behalf of the Customer 129

Third-Party (CASB) Administers Access on Behalf of the Customer 129

Lack of Physical Access 131

Audits 131

Shared Policy 134

Shared Monitoring and Testing 134

Summary 135

Exam Essentials 135

Written Labs 136

Review Questions 137

Chapter 7 Cloud Application Security 141

Training and Awareness 143

Common Cloud Application Deployment Pitfalls 146

Cloud-Secure Software Development Life Cycle (SDLC) 148

ISO/IEC 27034-1 Standards for Secure Application Development 150

Identity and Access Management (IAM) 151

Identity Repositories and Directory Services 153

Single Sign-On (SSO) 153

Federated Identity Management 153

Federation Standards 154

Multifactor Authentication 155

Supplemental Security Devices 155

Cloud Application Architecture 157

Application Programming Interfaces 157

Tenancy Separation 159

Cryptography 159

Sandboxing 162

Application Virtualization 162

Cloud Application Assurance and Validation 162

Threat Modeling 163

Quality of Service 166

Software Security Testing 166

Approved APIs 171

Software Supply Chain (API) Management 171

Securing Open Source Software 172

Runtime Application Self-Protection (RASP) 173

Secure Code Reviews 173

OWASP Top 9 Coding Flaws 173

Summary 174

Exam Essentials 174

Written Labs 175

Review Questions 176

Chapter 8 Operations Elements 181

Physical/Logical Operations 183

Facilities and Redundancy 184

Virtualization Operations 194

Storage Operations 195

Physical and Logical Isolation 197

Security Training and Awareness 198

Training Program Categories 199

Additional Training Insights 203

Basic Operational Application Security 203

Threat Modeling 204

Application Testing Methods 205

Summary 206

Exam Essentials 206

Written Labs 207

Review Questions 208

Chapter 9 Operations Management 213

Monitoring, Capacity, and Maintenance 215

Monitoring 215

Maintenance 217

Change and Configuration Management (CM) 221

Baselines 221

Deviations and Exceptions 222

Roles and Process 223

Business Continuity and Disaster Recovery (BC/DR) 225

Primary Focus 226

Continuity of Operations 227

The BC/DR Plan 227

The BC/DR Kit 229

Relocation 230

Power 231

Testing 232

Summary 233

Exam Essentials 233

Written Labs 234

Review Questions 235

Chapter 10 Legal and Compliance Part 1 239

Legal Requirements and Unique Risks in the Cloud Environment 241

Legal Concepts 241

U.S. Laws 247

International Laws 252

Laws, Frameworks, and Standards Around the World 252

The Difference Between Laws, Regulations and Standards 261

Potential Personal and Data Privacy Issues in the Cloud Environment 261

eDiscovery 262

Forensic Requirements 263

International Conflict Resolution 263

Cloud Forensic Challenges 263

Contractual and Regulated PII 264

Direct and Indirect Identifiers 264

Audit Processes, Methodologies, and Cloud Adaptations 265

Virtualization 265

Scope 266

Gap Analysis 266

Information Security Management Systems (ISMSs) 266

The Right to Audit in Managed Services 267

Audit Scope Statements 267

Policies 268

Different Types of Audit Reports 268

Auditor Independence 269

AICPA Reports and Standards 270

Summary 271

Exam Essentials 272

Written Labs 273

Review Questions 274

Chapter 11 Legal and Compliance Part 2 279

The Impact of Diverse Geographical Locations and Legal Jurisdictions 281

Policies 282

Implications of the Cloud for Enterprise Risk Management 287

Choices Involved in Managing Risk 288

Risk Management Frameworks 291

Risk Management Metrics 293

Contracts and Service-Level Agreements (SLAs) 294

Business Requirements 297

Cloud Contract Design and Management for Outsourcing 297

Identifying Appropriate Supply Chain and Vendor Management Processes 298

Common Criteria Assurance Framework (ISO/IEC 15408-1:2009) 299

Cloud Computing Certification 299

CSA Security, Trust, and Assurance Registry (STAR) 300

Supply Chain Risk 302

Summary 303

Exam Essentials 303

Written Labs 304

Review Questions 305

Appendix A Answers to the Review Questions 309

Chapter 1: Architectural Concepts 310

Chapter 2: Design Requirements 311

Chapter 3: Data Classification 312

Chapter 4: Cloud Data Security 314

Chapter 5: Security in the Cloud 316

Chapter 6: Responsibilities in the Cloud 317

Chapter 7: Cloud Application Security 319

Chapter 8: Operations Elements 320

Chapter 9: Operations Management 321

Chapter 10: Legal and Compliance Part 1 323

Chapter 11: Legal and Compliance Part 2 325

Appendix B Answers to the Written Labs 327

Chapter 1 328

Chapter 2 328

Chapter 3 329

Chapter 4 330

Chapter 5 331

Chapter 6 331

Chapter 7 332

Chapter 8 332

Chapter 9 333

Chapter 10 333

Chapter 11 334

Index 335

ChapterPageDetailsDatePrint Run
IntroductionxxiErrata in Text
Introduction, page xxi (2 places)
should be

xxiiiErrata in Text
assessment test, question 5:
Choice C should be 'Public-private'

xxiiiErrata in Text
assessment test, question 6:
Choice B
Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Social Engineering Elasticity
Should be
Spoofing, Tampering, Refutation, Information Disclosure, Denial of Service, and Social Engineering Elasticity

xxxiErrata in Text
answers to assessment test, question 27 should read:
B. Both SOC 1 and SOC 2 are based on the SSAE 16 standard, which replaced the SAS 70 standard. While SOC 1 reports on controls for financial reporting, SOC 2 (Types 1 and 2) reports on controls associated with security or privacy.

FMxxiiiErrata in text
Question 2, the question should read:

When using an Infrastructure as a Service (IaaS) solution, which of the
following is not an essential benefit for the customer?

FMxxixErrata in text
Answer to question 2:

B. Scalability, Energy and cooling efficiencies, and Transfer of

ownership cost are all essential benefits of IaaS.

364Errata in text
Question 2
Option D -
"Data of scheduled destruction"
should be
"Date of scheduled destruction"

469Errata in Text
Page 69 has the Data Life Cycle...
That should read

469Errata in text
Graphic 4.1 is incorrect - order of items
should be
Create - Store - Use - Share - Archive - Delete

485Errata in Text
Chapter 4,review questions, page 85, and answers Appendix A page 315
Question 11:
Correct answer on page 315 should be A. remainder of explanation of answer is correct as is.
Question 12:
Correct answer on page 315 should be B. remainder of explanation of answer is correct as is.

6125Errata in text
Admittedly, this will be to a lesser extent for the cloud customer
because the cloud customer will be installing the OS

Admittedly, this will be to a lesser extent for the cloud provider
because the cloud customer will be installing the OS

7179Errata in text
Chapter 7/Appendix A
Page 179/320
Question 20/answer to question 20
Answer on page 320
Correct answer is A, not B. Remainder of explanation is correct as is.