Certificate of Cloud Security Knowledge (CCSK) Plus (CSA authorized) Training Course

Module 1. Cloud Architecture

This module establishes the foundational principles of cloud computing, detailing definitions, architectural components, and the role of virtualization. It examines essential service and delivery models, core characteristics, and introduces the Shared Responsibilities Model as a framework for establishing robust cloud security postures suitable for government operations.

Topics Covered:

• Unit 1 - Introduction to Cloud Computing
• Unit 2- Introduction & Cloud Architecture
• Unit 3 - Cloud Essential Characteristics
• Unit 4 - Cloud Service Models
• Unit 5 - Cloud Deployment Models
• Unit 6 - Shared Responsibilities

Module 2. Infrastructure Security for Cloud

This section provides an in-depth analysis of securing core cloud infrastructure, including components, networks, management interfaces, and administrator credentials. It addresses virtual networking and workload security, encompassing container and serverless fundamentals, to ensure secure operations for government entities.

Topics Covered:

• Unit 1 - Module Intro
• Unit 2 - Intro to Infrastructure Security for Cloud Computing
• Unit 3 - Software Defined Networks
• Unit 4 - Cloud Network Security
• Unit 5 - Securing Compute Workloads
• Unit 6 - Management Plane Security
• Unit 7 - BCDR

Module 3. Managing Cloud Security and Risk

Focuses on strategic considerations for governing cloud security, beginning with risk assessment and moving into legal and compliance frameworks, including data discovery requirements. It also details Cloud Security Alliance (CSA) risk management tools, such as the CAIQ, CCM, and STAR registry, to support accountability in public sector contexts.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Governance
• Unit 3 - Managing Cloud Security Risk
• Unit 4 - Legal
• Unit 5 - Legal Issues In Cloud
• Unit 6 - Compliance
• Unit 7 - Audit
• Unit 8 - CSA Tools

Module 4. Data Security for Cloud Computing

Examines information lifecycle management within the cloud, emphasizing the application of security controls in public cloud environments. Topics include the Data Security Lifecycle, storage models, delivery-specific security challenges, and encryption management, including Bring Your Own Key (BYOK) practices for government data protection.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Cloud Data Storage
• Unit 3 - Securing Data In The Cloud
• Unit 4 - Encryption For IaaS
• Unit 5 - Encryption For PaaS & SaaS
• Unit 6 - Encryption Key Management
• Unit 7 - Other Data Security Options
• Unit 8 - Data Security Lifecycle

Module 5. Application Security and Identity Management for Cloud Computing

Addresses identity management and application security within cloud deployments. It covers federated identity, Identity and Access Management (IAM) applications, secure development practices, and the oversight of application security for government systems.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Secure Software Development Life Cycle (SSDLC)
• Unit 3 - Testing & Assessment
• Unit 4 - DevOps
• Unit 5 - Secure Operations
• Unit 6 - Identity & Access Management Definitions
• Unit 7 - IAM Standards
• Unit 8 - IAM In Practice

Module 6. Cloud Security Operations

Outlines critical factors for evaluating, selecting, and managing cloud service providers. It discusses the role of Security as a Service (SECaaS) providers and the specific implications of cloud environments on incident response protocols for government agencies.

Topics Covered:

• Unit 1 - Module Introduction
• Unit 2 - Selecting A Cloud Provider
• Unit 3 - SECaaS Fundamentals
• Unit 4 - SECaaS Categories
• Unit 5 - Incident Response
• Unit 6 - Domain 14 Considerations
• Unit 7 - CCSK Exam Preparation

Additional material

Core Account Security

Participants configure initial security controls within the first five minutes of establishing a new cloud account, enabling Multi-Factor Authentication (MFA), basic monitoring, and IAM policies to secure government accounts.

IAM and Monitoring In-Depth

Participants advance their configuration by implementing complex identity management and monitoring frameworks. This includes Attribute Based Access Controls, security alerting, and structuring enterprise-scale IAM for government infrastructure.

Network and Instance Security

Participants create a virtual private cloud (VPC) and establish baseline security configurations. They also secure virtual machine selection and launch, conduct cloud vulnerability assessments, and manage secure connections to instances for government workloads.

Encryption and Storage Security

Participants enhance deployments by adding encrypted storage volumes using customer-managed keys. They also learn to secure snapshots and other data assets in accordance with government standards.

Application Security and Federation

Participants complete technical exercises by constructing a two-tier application and implementing federated identity via OpenID, ensuring secure access for government users.

Risk and Provider Assessment

Participants utilize the CSA Cloud Controls Matrix and STAR registry to evaluate risk and select cloud providers that meet government requirements.