Overview

The course starts with an introduction to the cloud, including terminology, taxonomy, and basic technical premises. We also examine guidance available from the Cloud Security Alliance, including the Cloud Controls Matrix, the 14 major themes of cloud security, and other research available.

For most of the day we will examine the main technical considerations for Software-as-a-Service (SaaS) and Platform-as-a-Service (PaaS). We'll start by breaking down SaaS and some of the main types of security controls available, with examples of well-known SaaS provider options. A specialized type of Security-as-a-Service (SecaaS) known as Cloud Access Security Brokers will also be explained, with examples of what to look for in such a service. We'll touch on additional brokering services like Secure Access Service Edge and architecture and control concepts for this. We'll then shift to Platform-as-a-Service (PaaS) controls and architecture, with an emphasis on containers, orchestration, and serverless. We'll evaluate security controls for all of these in the major cloud providers and outline some suggested security architecture principles and practices to better secure and monitor these environments.

Finally, we'll discuss Infrastructure-as-a-Service (IaaS) security, which will set the stage for the rest of the course. The course day wraps up with an introduction to virtualization security, which all IaaS environments significantly rely upon.

Exercises

• VM Setup and Exploring Amazon Web Services
• SecaaS with CloudPassage
• Docker and Container Security Basics
• Virtualization Security

Topics

• Introduction to the Cloud and Cloud Security Basics
• Cloud Security Alliance Guidance
• SaaS Security Controls and Examples
• Cloud Access Security Brokers
• Secure Access Service Edge
• Intro to PaaS Security Controls
• Container Security Controls and Architecture
• Orchestration Tools and Security Controls
• Serverless Security Controls and Architecture
• Introduction to IaaS Security Controls
• Virtualization Security

Overview

On day 2 we begin our journey into the realm of cloud security architecture and operational design. We'll start by breaking down a number of core architecture principles that can help all organizations use best practices in any project or cloud deployment scenario. Then we'll analyze suggested architecture best practices from the three leading cloud providers. Amazon, Microsoft, and Google all have recommendations that we can dissect and apply to any security design for the cloud.

After we cover core security architecture, we'll focus on two of the biggest topic areas: network security and identity and access management (IAM). We'll start by breaking down cloud-native network security controls in all of the major providers, then comparing traditional on-premise network controls to the cloud. Then we'll look at network security architecture models, comparing and contrasting which may work best for different organizations regardless of the cloud provider.

Once we finish up with network security, we'll spend a good amount of time discussing IAM core principles, as well as the service options available in each cloud provider. Then we'll start to assemble design structures for identity that include federation, roles, asset profiles, and the use of IAM as an isolation and segmentation tactic. We'll finish up with some discussion on the use of larger-scale network and identity designs that employ multiple virtual private clouds (VPCs) and cloud accounts.

Exercises

• VPC and Network Controls
• Bastion Host Deployment
• Introduction to IAM
• Instance Profiles and asset-oriented IAM

Topics

• Introduction to Cloud Security Architecture Principles
• Amazon Web Services Frameworks: Well Architected and Cloud Adoption (more depth)
• Azure Cloud Adoption Framework and Cloud + Assessments (Azure Architecture Review, Cloud Journey Tracker, Governance Benchmark)
• Google 5 Principles for Cloud Native Architecture
• Network Security Controls and Design
• Network Security Architecture Models and Design
• Identity and Access Management Core Controls and Policies
• IAM Advanced Controls: Federation, Roles, Instance Profiles, Identity "Isolation"
• Multi-VPC and Multi-Account Architecture and Strategies

Overview

The third day of SEC545 continues our breakdown of controls and architecture considerations, starting with cloud workload security and operations management. We'll then look at architecture and design for data security, touching on encryption technologies, key management, and what the different options are today. We'll also cover another crucial topic: availability. Redundant and available design is as important as ever, but we need to use cloud provider tools and geography to our advantage. At the same time, we need to make sure we evaluate the cloud provider's DR and continuity, and so this is covered as well.

Additional topics will include cloud control plane assessment and architecture (touching on cloud security posture management), application security, as well as a discussion of multi-cloud security architecture and controls.

Exercises

• Cloud Workload Security and Management
• Secrets Management in a PaaS infrastructure
• Cloud Configuration
• Outbound Proxy Architecture

Topics

• Cloud Workload Security and Operations Architecture
• Data Security Controls and Architecture
• Availability Design and Architecture
• DR+BCP Considerations
• Cloud Control Plane Security (Cloud Security Posture Management)
• Application Security
• Multi-cloud Security Architecture

Overview

There are many threats to our cloud assets, so the fourth day of the course begins with an in-depth breakdown of the types of threats out there. We'll look at numerous examples. We'll also show you how to design a proper threat model focused on the cloud by using several well-known methods such as STRIDE and attack trees and libraries.

On the defensive side, we start with network-based and host-based intrusion detection, and how to monitor and automate our processes to better carry out this detection. This is an area that has definitely changed from what we're used to in-house, so security professionals need to know what their best options are and how to get this done. We then cover incident response and forensics (also topics that have changed significantly in the cloud). The tools and processes are different, so we need to focus on automation and event-driven defenses more than ever.

Scanning and pen testing the cloud used to be challenging due to restrictions put in place by the cloud providers themselves. But today we are seeing significant progress, with most mature solutions well adapted to cloud provider environments. There are some important points to consider when planning a vulnerability management strategy in the cloud, and we'll touch on how to best scan your cloud assets and which tools are available to get the job done. Pen testing naturally follows this discussion, so we'll talk about how to work with the cloud providers to coordinate tests as well as how to perform testing yourself.

Exercises

• Cloud Threat Modeling
• Cloud Defensive Guardrails
• Logging and Event Monitoring in the Cloud
• Scanning with AWS Inspector
• Cloud Penetration Testing
• Guardrail Analysis and Validation
• Optional: Cloud Capture-the-Flag Challenge

Topics

• Cloud Threats and Threat Modeling
• Building Cloud Defensive Guardrails
• Cloud Forensics and Incident Response
• Cloud Vulnerability Assessment
• Cloud Pen Testing + Red Team Operations

Overview

On our final day we'll focus explicitly on how to automate security in the cloud, both with and without scripting techniques. We will use tools like the AWS CLI and AWS Lambda to illustrate the premises of automation, then turn our attention to DevSecOps principles. We begin by explaining what that really means, and how security teams can best integrate into DevOps and cloud development and deployment practices. We'll cover automation and orchestration tools like Ansible and Chef, as well as how to develop better and more efficient workflows with AWS CloudFormation and other tools.

Continuing some of the topics from day four, we will look at event-driven detection and event management, as well as response and defense strategies that work. While we won't automate everything, some actions and scenarios really lend themselves to monitoring tools like CloudWatch, tagging assets for identification in security processes, and initiating automated response and remediation to varying degrees. We wrap up the class day covering a few more tools and tactics, followed by a sampling of real-world use cases.

Exercises

• AWS CLI Automation
• Infrastructure-as-Code
• Cloud Configuration Management and Orchestration
• Automating Cloud Defenses

Topics

• Introduction to Automation and the AWS CLI
• DevOps + DevSecOps Introduction (Pipeline Security)
• Infrastructure-as-Code
• Systems Management and Orchestration
• Automating Detection and Response
• Final Tools and Considerations