Major Update

SEC549: Cloud Security Architecture

  • In Person (5 days)
  • Online
30 CPEs

Organizations are migrating infrastructure and applications to the cloud at a rapid pace. As migrations take place, security architects are struggling to design hybrid and cloud-native solutions to meet their organization's security requirements. Shifting to the cloud requires a deep understanding of the threats introduced by a cloud migration, and how each provider mitigates those threats using their well-architected framework. SEC549 teaches security professionals how to design an enterprise-ready, scalable cloud organization. With nearly 20 hands-on labs, students will learn to design cloud solutions for their organization at any stage of the cloud journey, whether planning for the first workload, managing complex legacy environments, or operating in an advanced cloud-native ecosystem.

What You Will Learn

Design It Right from the Start.

SEC549 teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers' well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.

SEC549 takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.

"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP

What Is Cloud Security Architecture?

Cloud security architecture requires us to understand business requirements and existing cloud services and capabilities in order to design access control patterns, network controls, and secure processes to support a business outcome that can be implemented and maintained within required cloud operating environments. This requires architects to understand and design secure cloud solutions for workloads deployed on Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) service models. Understanding hybrid architecture patterns is also important as cloud workloads integrate with on-premises systems. The cloud security architect's goal is to identify security design flaws and inefficiencies when information systems interconnect and mitigate these flaws in the early stages of development using available cloud-capable security controls.

Business Takeaways

  • Mitigate the risks introduced by cloud technologies and their rapid adoption
  • Decrease the risk of cloud migrations by planning a phased approach
  • Prevent identity sprawl and technical debt through centralization
  • Enable business growth by creating high-level guardrails
  • Prevent costly anti-patterns from sprawling throughout a cloud organization
  • Apply learned access patterns to help move your organization towards zero-trust
  • Design effective conditional access policies and learn how to place guardrails around business-driven policy exceptions

"The problems we talk about are some that I face in my job every day or know I will face shortly. Getting definitive answers for many of these issues is very helpful for me. Getting years of experience from the instructors and what they have worked on is invaluable." - Patrick Haughney, Paylocity

Skills Learned

  • Enable business through secure enterprise cloud security architectural designs
  • Connect the dots between cloud architecture designs and real-life solutions
  • Build a secure, scalable identity foundation in the cloud
  • Centralize your organization's workforce identity to prevent sprawl
  • Build micro-segmented networks using hub and spoke patterns
  • Configure centralized network firewalls for inspecting north-south and east-west traffic
  • Learn how to incorporate both network-based and identity-based controls
  • Create data perimeters for cloud-hosted data repositories
  • Centralize and share Key Management Service (KMS) resources across an organization
  • Enable security operations and incident response in the cloud
  • Understand the telemetry and logging available across service models (IaaS, PaaS, and SaaS)
  • Design push and pull logging architectures for centralized log aggregation
  • Plan for cloud recovery processes using multiple tiers of break-glass accounts

Hands-On Cloud Security Architect Training

The hands-on portion of SEC549 is unique and especially suited to students who want to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The completed version of each diagram is implemented as live infrastructure in AWS, Azure, or Google (depending on the topic) and made available for students to explore. In this course, students have access to an enterprise-scale AWS, Azure, and Google Cloud organization and can observe all details discussed in the labs and throughout the course.

"I've done a lot of labs over the years. These are likely one of the best ways to present them I've ever used." - Daniel Russell, BCBSLA

"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - Tyler Piller, British Columbia Lottery Corporation

"Based on my experience, the labs in 549 are very much aligned with what an Architect could encounter in their day to day work." - Macie J Bak, Standard Chartered

Syllabus Summary

Each section discusses security design considerations for all three major clouds, however, there is a stronger emphasis on the AWS cloud. Each lab below indicates which cloud provider(s) is used to see the real-world implementation:

Section 1:

A foundational section covering IAM in the cloud, the higher-level resource containers in each of the three major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.

  • Threat Modeling the Cloud (cloud agnostic)
  • Centralizing User Account Provisioning (AWS / Azure)
  • Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
  • Designing an Identity Bastion Account (AWS / Google)

Section 2:

A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.

  • Threat Modeling Zero-Trust Access (cloud agnostic)
  • Integrating Modern Authentication into Legacy Applications (AWS)
  • Scaling Cross-Cloud Authentication (AWS)
  • Balancing Security and Usability with Conditional Access (Azure)

Section 3:

Managing cloud network resources at-scale requires an architect to understand the cloud provider's network security capabilities. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.

  • Centralizing Network Security Controls (AWS)
  • Building a Hub and Spoke Network (AWS / Azure)
  • Centralized Traffic Inspection (AWS / Azure)
  • VPC Private Network Access (AWS)

Section 4:

Protecting data in the cloud requires security teams to examine cloud provider data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.

  • Data Discovery and Classification (Google)
  • Access Control for Shared Data Sets (AWS)
  • Access Control for BigQuery (Google)
  • Key Management Architecture (AWS / Google)

Section 5:

In this section we focus on logging and detection patterns that help the Security Operations Center (SOC), adapt traditional methodologies to cloud-hosted environments, and ensure robust detection and response continues as their organization shifts workloads to the cloud.

  • Centralizing Intra-cloud Log Events (AWS / Azure / Google)
  • Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
  • Architecting Quarantine Patterns (AWS)

Additional Free Resources

What You Will Receive

  • Printed and electronic courseware
  • Draw.io architectural diagrams representing secure patterns you can use as reference architecture
  • Access to the SEC549 Cloud lab environment

What Comes Next?

Syllabus (30 CPEs)

Download PDF
  • Overview

    Section 1 starts by defining concepts used throughout the course such as threat modeling the cloud, what makes a secure design, and how security changes in the cloud. Students then start designing cloud identity for the Delos organization by learning the foundational concepts of cloud identity: users, groups, roles, and machine identities. With those concepts in mind, we enable identity federation and provisioning from Microsoft Entra ID to both AWS and Google Cloud using Entra ID enterprise applications. With identity federation in place, students design a foundational cloud resource hierarchy for the organization to host resources with policy guardrails for organization units and accounts. The final module covers the cloud provider permission models and how to centralize legacy and external users and provide a single entry and management point for each cloud environment.

    Exercises
    • Threat Modeling the Cloud (cloud agnostic)
    • Centralizing User Account Provisioning (AWS / Azure)
    • Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
    • Designing an Identity Bastion Account (AWS / Google)
    Topics
    • Security Architecture in the Cloud
      • Threat modeling the cloud
      • Cloud-native security models
    • Federated Access / Single Sign-On
      • Managing users at scale with Microsoft Entra ID, AWS Single Sign-On, and Google Cloud Identity
      • Provisioning users with the System for Cross-domain Identity Management (SCIM) specification
    • Creating Hierarchical Cloud Structures
      • Designing organizational hierarchy with AWS Organizations, Azure Management Groups, and Google Cloud
      • Creating policy guardrails in the hierarchy to help silo job roles and prevent IAM mistakes
    • Implementing an Identity Foundation
      • Understanding how permissions are granted and patterns of IAM in the cloud
      • Centralizing legacy users and machine identities into an identity bastion account
      • Granting secure external access to vendors and contractors
  • Overview

    Section 2 starts with an in-depth look at the zero-trust movement, its history and how zero-trust in the cloud can be leveraged to uplift legacy access patterns. We not only discuss permission granting architectures but also how to build identity guardrails into your cloud estates, ensuring constraints are placed for security or compliance purposes. Students will learn how to authenticate end users and machine identities across multiple public cloud environments. The section wraps up by implementing policies that restrict access between an organization's resources and trusted third parties. A key take-away from this section is how to implement policies that restrict access between an organization's resources and trusted third parties.

    Wrapping up this section, students focus on Azure AD Conditional Access and how policies are crafted to define the guardrails for resource access. Taking a strong practical lens to Conditional Access, students will learn how to narrowly and safely carve out business-driven exceptions to multi-factor authentication (MFA) enforcement.

    Exercises
    • Threat Modeling Zero-Trust Access (cloud agnostic)
    • Integrating Modern Authentication into Legacy Applications (AWS)
    • Scaling Cross-Cloud Authentication (AWS)
    • Balancing Security and Usability with Conditional Access (Azure)
    Topics
    • Implementing Zero-Trust Architecture
      • History of Zero-Trust
      • Using cloud services to implement zero-trust architecture
    • Customer Identity and Access Management (CIAM)
      • Identity federation with Microsoft Entra External ID and AWS Cognito
    • Architecting Cross-Cloud Authentication
      • Killing long-lived credentials in AWS, Azure, and Google Cloud
      • Designing workload identity federation across cloud providers
      • Using certificates to authenticate on-premises workloads to cloud provider APIs
    • Conditional Access Policies
      • Designing effective Conditional Access policies
      • Understanding Conditional Access using Google BeyondCorp, AWS Verified Access, AWS Service Control Policy (SCP), and Entra ID Conditional Access
  • Overview

    With a solid identity foundation, students shift focus to cloud architecture patterns for their organization. Building an enterprise cloud network requires a fundamental understanding of how things change moving from an on-premise network. Section 3 starts with the key resources required to build public, private, and hybrid cloud networks. From there, students learn to centrally manage the configuration of these resources across their organization. Next, we explore cloud micro-segmentation, hub and spoke networks, and routing traffic between micro-networks. Our focus then shifts to centralizing traffic flow through ingress and egress networks, as well as inspecting east-west traffic with third-party security appliances. Finally, students learn how to share network services by adding additional spoke networks and sharing DNS configurations across the organization.

    Exercises
    • Centralizing Network Security Controls (AWS)
    • Building a Hub and Spoke Network (AWS / Azure)
    • Centralized Traffic Inspection (AWS / Azure)
    • VPC Private Network Access (AWS)
    Topics
    • On-Premises Versus Cloud Networks
      • Cloud architecture challenges
      • CISA Zero Trust Model: Network & Environment
    • Managing Cloud-Hosted Networks at Scale
      • Cloud network building blocks (virtual networks, subnets, internet gateways, firewall rules, network interfaces, and private service endpoints)
      • Hosting network resources centrally in a cloud organization
      • Sharing VPC networks across projects / accounts
      • Managing firewall rules using AWS Firewall Manager, Azure Firewall Manager, and Google Cloud Hierarchical Firewall Policies
    • Cloud Network Micro-Segmentation
      • Connecting micro networks using VPC peering and hub and spoke services
      • Creating hybrid networks with site-to-site VPN tunnels and dedicated connections
    • Network Firewalls and Traffic Inspection
      • Centralizing ingress and egress traffic network controls using AWS Transit Gateway and Azure Virtual WAN
      • Inspecting east-west traffic with third-party security appliances, Kubernetes network policy, and AWS VPC Lattice
      • Load balancing traffic and symmetric routing to third-party security appliances
    • Centralized Shared Network Services
      • Hosting private link / private access services in a centralized spoke
      • Designing least privilege private link policies for data perimeters
      • Sharing private DNS hosted zones with spoke networks
  • Overview

    Section 4 focuses on cloud-native data protection patterns. Starting with common organization-wide storage service controls, students will establish foundational data perimeter policies. From there, we learn to segment data lake access through views and access points. Next, students explore how attribute-based access control, tagging, and data masking can enable cloud-native data loss prevention controls. Finally, the section wraps up with key management and backup architecture patterns.

    Exercises
    • Data Discovery and Classification (Google)
    • Access Control for Shared Data Sets (AWS)
    • Access Control for BigQuery (Google)
    • Key Management Architecture (AWS / Google)
    Topics
    • Data Security & Privacy Playbook
      • Defining, dissecting, and defending data
      • Data classification patterns
      • Resource naming and tagging
      • Cloud data discovery and classification services
    • Cloud Storage Service Security
      • Managing access to cloud storage services
      • Establishing network perimeters in the cloud for data access
      • Designing data backup, replication, and business continuity plans in the cloud
    • Data Lake Security
      • Designing centralized data warehouses with data mart access points
      • Access control and governance with S3 access points
      • Access control and governance with BigQuery views, row-level, and column-level policies
      • Big Query identity and data exfiltration controls
      • Data pipelines for tagging for attribute-based access control, masking, and data loss prevention
    • Key Management Architecture
      • Creating centralized key management stores for the organization
      • Patterns for isolating key administrators from data being protected
      • Sharing keys across cloud accounts
      • Regulatory requirements that may require customer-managed or cloud hardware security module (HSM) managed keys
  • Overview

    This section covers how to enable your SOC to operate (investigate incidents, log events, hunt for threats) in the new cloud-based world. Covered in this section is a deep dive on cloud data sources, aggregating logs and cloud-native events within the CSP while positioning them for export to the central SIEM. This section teaches students how to build effective architecture which empowers defenders to respond, contain and ultimately recover from cloud-based incidents.

    Exercises
    • Centralizing Intra-cloud Log Events (AWS / Azure / Google)
    • Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
    • Architecting Quarantine Patterns (AWS)
    Topics
    • Security Operations in a Cloud-Centric World
      • On-premises versus cloud security operations
      • Cloud service provider incident coordination
      • Managing security contacts in AWS, Azure, and Google cloud
    • Intra-cloud Logging and Aggregation
      • Understanding the logging journey for events in the cloud
      • Cloud event log types and data elements
      • Designing an intra-cloud security data lake for in-depth analysis
    • Centralized Log Export Patterns
      • Comparing SIEM solutions and platforms
      • Ingesting cloud events using push and pull architecture patterns
      • Exporting AWS log events using Kinesis, S3, and SQS
      • Exporting Azure log events using Event Hub
      • Exporting Google Cloud log events using Pub/Sub
      • Data processing and transformation using Cribl
      • Ingesting cross-cloud log event data using Microsoft Sentinel
    • Secure Incident Response Design
      • Managing read only access for incident responders
      • Enabling response in the cloud with network-layer and identity-layer quarantine zones
      • Designing break-glass accounts for cloud account recovery

Prerequisites

The following experience is a prerequisite for SEC549:

  • Familiarity with AWS, Azure, and Google Management Consoles
Preparing For SEC549

Students taking SEC549 will have the opportunity to learn many different architecture patterns across the AWS, Azure, and Google clouds. Basic familiarity with cloud concepts like IAM, role-based access control, identity federation, VPC networks, and storage services management is helpful, but not required.

Additionally, students will delve into cloud-native tools for securing deployments at the network layer. Having a basic understanding of network concepts such as firewalls, network access control lists and IP addressing is helpful, but not mandatory.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory SEC549 System Hardware Requirements

  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory SEC549 Host Configuration And Software Requirements

  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

SANS will be providing access to the following cloud environments: AWS, Azure, and Google Cloud. Unfortunately due to some cloud security controls we cannot control, sometimes the login you receive requires verification with a valid phone number where you can receive text messages (virtual numbers will not work). Please ensure you have and are willing to provide your phone number to the cloud provider should this situation occur.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses ranges.io for delivering the lab documents and challenges. A second monitor and/or a tablet device can be useful for keeping the class materials visible while you are working on your labs.

If you have additional questions about the laptop specifications, please contact customer service.

Author Statement

"Distributing our workloads and data to the public cloud increases our perimeter, which is often protected only by identity-based security controls. With the network perimeter being lifted, the margin for error is slim. Even with this grim reality, we can still be optimistic. Migrating to the cloud enables our most innovative technologies and presents an opportunity for the security sector to evolve and mature.

If armed with the correct foundational design principles, we can build a more secure future, with greater availability and confidentiality than ever possible on-premises. Transitioning to the new cloud-native, zero-trust world may be bumpy, but we are here to help shepherd you along the journey."

- Eric Johnson, David Hazar

"Eric was an excellent instructor. He was open to questions and very good with making the content interactive. It was also nice to discuss potential pitfalls he's seen in real life implementations." - Derek Dorman, Wright-Patt Credit Union

"David is a great instructor and was well versed with the content. He was able to answer all my questions, and even elaborate further on some knock on effects. I would definitely highly recommend him to other people looking to take a SANS course." - Jamie Swingler, RLI Corp

Reviews

The labs are the most life like simulation of a security architect’s day that I have seen. For people aspiring to become architects, it gives them a great example of what day to day architecture can be like.
Maciej Bak
Standard Chartered
The content is excellent, provides a lens and framework to look at enterprise problems from an architectural lens and will provide actionable information that can be used Day 1 after this course.
Tyler Piller
British Columbia Lottery Corporation
Current information and lots of it.
Michael Martin
Banner Health

    Register for SEC549

    Learn about Group Pricing

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.

    Loading...