Introduction:

This course starts out with a detailed introduction to the various delivery models of cloud computing, ranging from Software as a Service (SaaS) to Infrastructure as a Service (IaaS) and everything in between. Each of these delivery models represent an entirely separate set of security conditions to consider, especially when coupled with various cloud types, including public, private and hybrid. An overview of security issues within each of these models will be covered with an in-depth discussion of the risks involved. This cloud security training course will go in-depth on architecture and infrastructure fundamentals for private, public and hybrid clouds, including a wide range of topics such as patch and configuration management, virtualization security, application security and change management. Policy, risk assessment and governance within cloud environments will also be covered, with recommendations for both internal policies and contract provisions. This path leads to a discussion of compliance and legal concerns. The first day will wrap up with disaster recovery and business continuity planning using cloud models and architecture. Essential security topics covered in this management track include: network fundamentals and applications, power, cooling and safety, architectural approaches to defense in depth, cyber-attacks, vulnerability assessment and management, security policies, contingency and continuity planning, awareness management, risk management analysis, incident handling, Web application security, offensive and defensive information warfare, culminating with our management practicum. The course will address:

• What is information security management (ISM)
• Why ISM is important to an organization
• What are the benefits of ISM
• What is the background of ISM
• What are the key concepts and principles in ISO/IEC 27001:2013
• The terms and definitions used
• The main requirements of ISO/IEC 27001:2013

Course Objectives:

By the end of this course, delegates will be able to:

• Build a risk-based assessment program for cloud providers’ controls
• Understand the key areas to focus on in cloud contracts
• Evaluate the various layers of cloud infrastructure
• Develop a cloud disaster recovery and business continuity plan
• Perform vulnerability assessments in a cloud environment
• Integrate encryption and identity management services in a cloud environment
• Improve your incident response and monitoring capabilities in the cloud

Who Should Attend?

IT Engineers, IT Professionals, IT Directors, Engineers, IT Project Managers, IT Auditors, IT Compliance Managers, IT Coordinators, IT Support Managers, IT Officers, IT Support Specialists, IT System Administration, Technical Support Professionals, Chief Information Officers, Chief Risk Officers, Information Assurance Officers, Program Managers, Network Systems Analysts, Government Program Managers, R&D Project Managers, Software and System Developers, Chief Security Officers, Security Specialists, Chief Information Security Officers, Directors of Security, Security Architects, Security Operation Center Managers, Security Consultants, Security Managers, Security Auditors, Security Directors, Systems Administrators, Incident Response Analysts, Business Owners, Security Analysts, Security Systems Engineer, Network Architect, Operations Managers, Risk Management Professionals, Network Administration Professionals, Application Developers, Application Support Analysts, Application Engineers, Associate Developers, Technology Officers, Information Officers, Help Desk Specialist, Help Desk Technician, Database Administrators, Network Architects, Network Engineers, Network System Administrators, System Analysts, System Architects, System Designers

Course Outline:

 Information Security Governance

• Key information security concepts and components
• Defining governance
• Outcomes, objectives, & goals
• Basic concepts
• Key drivers affecting the enterprise and the impact they have on security
• Implementation metrics
• Information security strategy development
• Relevant information security policies, standards, frameworks, & issuing bodies

Risk, Audit and Assessment for the Cloud

• Risk management
• Auditing the cloud
• Remote
• Onsite

Information Risk Management

• Risk management concepts and frameworks
• Threat & vulnerability identification
• Risk assessment analysis, methodologies, & risk treatment options
• Systematic & structured information risk assessment processes
• Information security controls & countermeasures
• Risk, threat, & vulnerability identification & management life cycle

Data Security in the Cloud

• Encryption types and availability
• Key management and encryption architectures
• Data/information lifecycle
• Retention
• Disposal
• Classification

Identity and Access Management (IAM)

• IAM architecture and relevance to the cloud
• Authentication and authorization standards
• Account management and provisioning
• Federation

Intrusion Detection and Incident Response

• Incident detection for different cloud models
• Managing intrusion detection system/intrusion prevention system (IDS/IPS) and alerting
• The event management feedback loop

Security Testing

• Cloud Audit A6
• Assessments for the cloud
• Penetration testing the cloud
• Internal assessments

COURSE LOCATIONS