Introduction

The Certified Cloud Security Professional certification, or CCSP, is a certification hosted by the joint effort of (ISC)2 and the Cloud Security Alliance (CSA). This exciting credential is designed for cloud-based information security professionals and ensures that the certification holder has acquired the requisite skills, knowledge and abilities in cloud implementation, security design, controls, operations and compliance with applicable regulations.

The CCSP certification exam comprises six domains: Architectural Concepts and Design Requirements, Cloud Data Security, Cloud Platform and Infrastructure Security, Operations, Cloud Application Security and Legal and Compliance. This article will detail the Operations domain of the CCSP exam and what candidates preparing for the CCSP certification can expect on the exam.

The Operations domain of CCSP currently accounts for 15% of the material covered by the CCSP certification exam.

5.1 Support the Planning Process for the Data Center Design

Logical Design

Tenant Partitioning

The nature of cloud computing deployments requires sensitive data and application segregation. To accomplish this, there must be a logical design to the data center that segregates customer and client data. An approach that satisfies the needs of cloud computing is multitenant networks. The benefits of the multitenant network approach to data centers are:

  • Smaller networks
  • Isolated networks
  • Segregation of customer and client data

Access Control

Logical design requires that design decisions are enforceable and monitored. A great example is access control, proper implementation of which would involve an auditable identity and access management system.

Logical Design Levels

Logical design with regard to data separation is required to be incorporated at all of the levels listed below:

  • Management plane
  • Compute nodes
  • Storage nodes
  • Control plane
  • Network

Physical Design

Physical design of the data center is another important component to cloud computing.

Considerations

  • Does the physical design of the data center protect against relevant environmental threats including floods, earthquakes and storms?
  • Does the physical design of the data center provide disaster-time access to resources to ensure data center employees can safely continue to operate?
  • Does the physical design contain security features that limit access to only authorized personnel?

Building or Buying

Whether you should build or buy depends on many factors and is best determined on a case-by-case basis. These factors can be boiled down to the following considerations:

  • Building gives organizations the most control over data center design and security, but it comes at a significant investment
  • Buying a data center may be cheaper, but there will be design input limitations. When buying is the approach taken, all security requirements must be included in the leasing organization’s contract and RFP
  • If you opt for a shared data center, physical separation of client/customer servers and equipment needs to be included in the data center design

Environmental Design

  • Temperature and humidity controls
  • HVAC
  • Multi-vendor pathway connectivity

5.2 Implement and Build Physical Infrastructure for Cloud Environment

Secure Configuration of Hardware Specific Requirements

Actual configuration depends on factors such as which OS or virtualization platform is used.

Best Practices for Servers Within Cloud Environments

  • Secure build (based upon OS vendor guidelines)
  • Secure initial configuration

The following are common best-practice techniques:

  • Host hardening
  • Host patching
  • Host lockdown

Best Practices for Storage Containers

  • Initiator: Typically a server with a host bus adapter that initiates connections over the fabric to one or more target ports on your storage system
  • Target: The storage system ports that deliver storage volumes to initiators
  • Layer 2 VLANs should be used to segregate ISCI traffic from general traffic
  • Oversubscription should not be used for ISCI

Network Controllers Best Practices

  • Explain physical versus virtual switches (major differences between the two)
  • When a physical switch is used, when a dedicated switch port or network cable goes bad, only one server is affected
  • When virtualization is used, one network cable could offer connectivity to multiple VMs, meaning that connectivity loss of one network cable could impact multiple VMs
  • The heightened bandwidth requirements of connecting multiple VMs require the use of a virtual switch

Best Practices for Virtual Switches

  • Achieve redundancy by assigning multiple physical NICs to a virtual switch with each of the aforementioned NICs being connected to different physical switches
  • Network isolation
  • Networks used to move live virtual machines to other hosts should do so in clear text
  • When working with external and internal traffic, always create separate, isolated switches with unique physical network interface cards which never mix external and internal traffic on your virtual switch
  • Use lockdown access with your virtual switches
  • Use security applications that are specifically designed to be used in virtual infrastructure
  • Use proper authentication if you use network-based storage

Installation and Configuration of Virtualization Management Tools for the Host

Leading practices include:

  • Defense in depth
  • Access control
  • Auditing and monitoring
  • Maintenance

5.3 Run Physical Infrastructure for Cloud Environment

  • Configuration of access control (local access): Including Secure KVM and console-based access mechanisms
  • OS hardening through application of baseline: Examples being Windows, Linux and VMware
  • Secure network configuration: Covering TLS, VLANs, DNS, DHCP, IPSEC
  • Availability of clustered hosts
  • Stand-alone host availability

5.4 Manage Physical Infrastructure for Cloud Environment

  • Configuration of access controls for remote access: Examples being secure terminal access and RDP
  • Patch management
  • Compliance monitoring and remediation of OS baseline
  • Performance monitoring
  • Hardware monitoring
  • Log capturing and analysis: Examples being SIEM and Log and Event Manager
  • Host configuration backup and restore
  • Network security controls implementation
  • Management plane: Organization, scheduling, maintenance

5.5 Build Logical Infrastructure for Cloud Environment

  • Specific requirements for secure configuration of virtual hardware, including storage, network, memory and CPU requirements
  • Guest OS Virtualization toolsets installation

5.6 Run Logical Infrastructure for Cloud Environment

  • Secure network configuration – including TLS, VLANs, DNS, DHCP, IPSEC
  • OS hardening through the application of a baseline, such as Windows, Linux, and VMware
  • Guest OS availability

5.7 Manage Logical Infrastructure for Cloud Environment

  • Remote access control, such as RDP
  • Compliance monitoring and remediating of OS baseline
  • Performance monitoring, including disk, network, CPU and memory
  • Patch management
  • Guest OS configuration backup and restore, including SnapShots, agent-based and agentless
  • Network security controls implementation, including firewalls, IDS, IPS, vulnerability assessments and honeypots
  • Log capture and analysis
  • Management plane

5.8 Ensure Compliance with Regulations and Controls ( e.g., ITIL, ISO/IEC 20000-1)

  • Continuity management
  • Change management
  • Information security management
  • Incident management
  • Continual service improvement management
  • Problem management
  • Deployment management
  • Release management
  • Configuration management
  • Availability management
  • Service level management
  • Capacity management

5.9 Conduct Risk Assessment to Logical and Physical Infrastructure

Risk

  • Threats to organizations
  • Internal and external vulnerabilities of organizations
  • Harm given the likelihood of threats exploiting vulnerabilities
  • Likelihood of harm occurring

Conducting Risk Assessments

  • Quantitative risk assessment
  • Qualitative risk assessment
  • Identifying threats
  • Identifying vulnerabilities
  • Selection of risk assessment tools and techniques
  • Likelihood determination
  • Determination of risk
  • Determination of impact

5.10 Understand the Collection, Acquisition and Preservation of Digital Evidence

  • Proper forensic collection of data methodologies
  • Evidence management

5.11 Manage Communication with Relevant Parties

  • Vendors
  • Partners
  • Customers
  • Regulators
  • Other Stakeholders

Conclusion

CCSP is a great certification to earn for information security professionals that want to focus their career on cloud computing security. To pass this certification exam, you will have to master the six domains of CCSP. Despite its verbosity, Domain 5 can be mastered relatively easily and if you solidify your understanding of the subsections set out above you should have no problem mastering this domain of the CCSP certification exam.

 

Sources

CCSP Certification Exam Outline, (ISC)2

CCSP, MindMeister

Adam Gordon, “The Official (ISC)2 Guide to the CCSP CBK,” John Wiley & Sons, 2016

Be Safe

Section Guide

Greg
Belding

View more articles from Greg

Earn your CCSP the first time with InfoSec Institute and pass your exam, GUARANTEED!

Section Guide

Greg
Belding

View more articles from Greg
[Free Guide]
[Free Guide]