SEC549: Enterprise Cloud Security Architecture

Design it right from the start.

SEC549 takes an architectural lens to enterprise-scale, cloud infrastructure challenges. It addresses the security considerations architects need to tackle when tasked with business expansion into the cloud in order to both maximize the speed of cloud adoption and modernization of the organization. From the centralization of workforce identity and network security controls, to the secure usage of shared cloud-hosted data, and the design of effective logging strategies, students take away from this course a clear mental model of the cloud and the controls available to them. This allows students to shift their threat models to this new, vastly different world with distributed perimeters and unfamiliar trust boundaries.

It's inevitable that even the most mature organizations will have their security posture challenged, therefore in this course we dive deep into architectures which enable Security Operation Centers to monitor, detect, respond and recover from incidents in the cloud. In this enterprise cloud security architecture course, students learn how to effectively support business goals with robust logging of cloud telemetry and centralization of events and insights gathered at the edge. This course empowers the Architect to ensure adequate logging is configured in cloud environments and develop recovery strategies emphasizing the need to design for availability.

The SEC549 is constructed around the cloud migration journey of a fictional company and the challenges they encounter along the way. Aspiring cloud security architect students are tasked with phasing in a centralized identity plan, and designing secure patterns for enabling cloud-hosted applications. Both network-layer and identity-layer controls are covered in-depth as complementary mechanisms for securing access to distributed resources.

"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP

What is Enterprise Cloud Security Architecture?

The practice of Enterprise Security Architecture is the consumption of requirements in order to design access control patterns, network controls or secure processes in support of a business outcome.  Enterprise Cloud Security Architecture is this business-centric practice but operating in the Cloud. A Cloud Security Architect designs secure patterns for workloads deployed on Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service service models as well as hybrid architecture patterns which may tightly integrate to on-premises systems. The cloud security architect's goal is to tease out security flaws when information systems interconnect, and complexity naturally forms.  The development of secure architecture patterns gives us the ability to preemptively manage complexity, ideally before a system is put into use. Mitigating design flaws in the early stages of development with proactive Cloud Security Architecture saves time and is crucial considering the high cost associated with fixing flaws after deployment.

BUSINESS TAKEAWAYS

• Mitigate the risk posed by nascent cloud technologies and their rapid adoption
• Decrease the risk of cloud migrations by planning a phased approach
• Help your organization prevent identity sprawl and tech debt through centralization
• Enable business growth by creating high-level guardrails
• Prevent costly anti-patterns from becoming entrenched
• Move your organization towards a Zero-Trust posture through the uplifting of existing access patterns
• Design effective Conditional Access Policies and learn how to place guardrails around business-driven policy exceptions

"The problems we talk about are some that I face in my job every day or know I will face shortly. Getting definitive answers for many of these issues is very helpful for me. Getting years of experience from the instructors and what they have worked on is invaluable." - Patrick Haughney, Paylocity

SKILLS LEARNED

• Enable business through secure enterprise cloud security architectural patterns
• Connect the dots between architectural patterns and real-life infrastructure
• Build a secure, scalable identity foundation in the cloud
• Centralize your organization's workforce identity to prevent sprawl
• Build micro-segmented networks using hub and spoke patterns
• Configure centralized network firewalls for inspecting north-south and east-west traffic
• Learn how to incorporate both network-based and identity-based controls
• Ability to create data perimeters for cloud-hosted data repositories
• Centralize and share Key Management Service (KMS) resources across an organization
• Enable Security Operations to respond in the Cloud
• Understand the telemetry and logging available across service models (IaaS, PaaS and SaaS)
• Design recovery processes leveraging break-glass accounts
• Strategically approach a phased cloud migration
• Implement Conditional Access Policies in order to guardrail resource access and strength your identity boundary

HANDS-ON CLOUD SECURITY ARCHITECT TRAINING

The hands-on portion of SEC549 is unique and especially suited to the student who wants to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The 'correct' version of each diagram is implemented as live infrastructure in AWS and made available to the student to explore the configurations. In this course, the students have access to an enterprise-scale AWS Organization and can observe all details discussed in the labs and throughout the course.

Each of the sections of the course discusses security design considerations for all three major clouds, however there is an emphasis on working with AWS and labs are structured around concepts in AWS.

Section 1:

• Threat Modeling the Cloud
• Centralizing User Account Provisioning
• Structuring Accounts to Create Effective Hierarchies
• Transitioning Access from IAM Users to Roles

Section 2:

• Threat Modeling Zero-Trust Access
• Integrating Modern Authentication into Legacy Applications
• Scaling Cross-Cloud Authentication
• Access Control for Shared Data Sets
• Conditional Access Policy Design

Section 3:

• Centralizing Network Security Controls
• Building a Transit Gateway
• Network Firewall Policies
• VPC Private Network Access

Section 4:

• Managing Access to Cloud-Native Storage
• Data-Lake Access Controls and Governance
• Architecting for Big Data Governance
• Data Resiliency: Key Management and Backup Strategies

Section 5:

• Centralizing Cloud-Native Events
• Exporting Cloud Telemetry to an External SIEM
• Architecting Network-layer Quarantine

"I've done a lot of labs over the years, These are likely one of the best ways to present them I've ever used." -Daniel Russell  BCBSLA

"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - Tyler Piller, British Columbia Lottery Corporation

"All three of today's labs were helpful in cementing the concepts. The "See It In Action" portions were particularly useful." - Oritse Uku

"I really liked that architecture diagrams were incorporated in each."- Greg Lewis, SAP

SYLLABUS SUMMARY

• Section 1: A foundational section covering IAM in the cloud, the higher-level resource containers in each of the 3 major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
• Section 2: A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
• Section 3: Managing cloud network resources at-scale requires an architect to understand cloud-native network controls. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
• Section 4: Protecting data in the cloud requires security teams to examine cloud-native data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
• Section 5: In this section we focus on how to uplift a SOCs capabilities, adapt traditional methodologies to cloud-hosted environments, ensuring robust detection and response continues as an organization shifts their workloads to the cloud.

ADDITIONAL FREE RESOURCES

• Privilege Escalation in GCP - A Transitive Path, webcast
• It's Like Chipotle - Demystifying GCP PaaS Services, video
• Breaking the Cloud Kill Chain, webcast
• Lessons Learned Deploying Modern Cloud Systems in Highly Regulated Environments, webcast
• Fix Security Issues Left of Prod, cheatsheet
• Detecting and Locking Down Malware in Azure, by Brandon Evans
• Top 5 Considerations for Multicloud Security, by Brandon Evans

WHAT YOU WILL RECEIVE

• Printed and electronic courseware
• Draw.io architectural diagrams representing secure patterns you can use as reference architecture
• Access to the SEC549 Cloud lab environment

WHAT COMES NEXT

Depending on your current role or future plans, one of these courses is a great next step in your cloud security journey:

• Cloud Security Architect:
  • SEC510: Public Cloud Security: AWS, Azure and GCP
  • SEC540: Cloud Security and DevSecOps Automation
• Cloud Security Engineer:
  • SEC540: Cloud Security and DevSecOps Automation
  • SEC510: Public Cloud Security: AWS, Azure and GCP
• Cloud Security Manager:
  • MGT520: Leading Cloud Security Design and Implementation
  • MGT516: BuildingandLeadingVulnerabilityManagementPrograms