New

SEC549: Enterprise Cloud Security Architecture

  • In Person (5 days)
  • Online
30 CPEs

The age of cloud computing has arrived as organizations have seen the advantages of migrating their applications from traditional on-premises networks. However, the rapid adoption of cloud has left architects scrambling to design on this new medium. A shift to the cloud requires cybersecurity professionals to reorient their security goals around a new threat model to enable business requirements while improving their organization's security posture. SEC549 is here to help enable this shift. The course takes an architectural lens to enterprise-scale, cloud infrastructure challenges. We address the security considerations architects need to address when tasked with business expansion into the cloud, from the centralization of workforce identity and network security controls, to the secure usage of shared cloud-hosted data, and the design of effective logging strategies. 15 Hands-on Labs.

What You Will Learn

FREE! Hands-On Workshop Now Open for Registration

Join course author, Kat Traxler, on Wednesday, March 15th at 10:00 am ET | 14:00 pm UTC for a 2-hour workshop to introduce the course content and lab environment.

Register here: www.sans.org/webcasts/designing-access-shared-datasets-cloud/

DESIGN IT RIGHT FROM THE START

Without a mental model for threats in the cloud, architects attempt to strong-arm design patterns intended for the on-premise world onto cloud systems, hindering the speed of cloud adoption and modernization. Worse yet, failure to identify trust boundaries in the cloud results in missing security controls at the identity or network-planes and poor security outcomes. SEC549 introduces students to security architecture as it applies to the cloud. Students take away from this course a clear mental model of the cloud and the controls available to them, allowing students to shift their threat models to this new, vastly different world with distributed perimeters and unfamiliar trust boundaries.

It's inevitable that even the most mature organizations will have their security posture challenged, therefore in this course we dive deep into architectures which enable Security Operation Centers to monitor, detect, respond and recover from incidents in the cloud. Students learn how to effectively support business goals with robust logging of cloud telemetry and centralization of events and insights gathered at the edge. This course empowers the Architect to ensure adequate logging is configured in cloud environments and develop recovery strategies emphasizing the need to design for availability.

SEC549 is constructed around the cloud migration journey of a fictional company and the challenges they encounter along the way. Students are tasked with phasing in a centralized identity plan, building large scale micro-networks, and designing big data services for cloud-hosted applications. Both network-layer and identity-layer controls are covered in-depth as complementary mechanisms for securing access to distributed resources. The importance of centralizing identity is a core take-away of this course as showcased through the discussion of fragmented identity and its perils, especially with the rise of the Cloud and the adoption of multiple cloud service providers. Students are taught the foundational concepts used when designing for phased identity consolidation so they can confidently tackle similar challenges on the job.

"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP

BUSINESS TAKEAWAYS:

  • Mitigate the risk posed by nascent cloud technologies and their rapid adoption
  • Decrease the risk of cloud migrations by planning a phased approach
  • Help your organization prevent identity sprawl and tech debt through centralization
  • Enable business growth by creating high-level guardrails
  • Prevent costly anti-patterns from becoming entrenched
  • Move your organization towards a Zero-Trust posture through the uplifting of existing access patterns

SKILLS LEARNED:

  • Enable business through secure cloud architectural patterns
  • Connect the dots between architectural patterns and real-life infrastructure
  • Build a secure, scalable identity foundation in the cloud
  • Centralize your organization's workforce identity to prevent sprawl
  • Build micro-segmented networks using hub and spoke patterns
  • Configure centralized network firewalls for inspecting north-south and east-west traffic
  • Learn how to incorporate both network-based and identity-based controls
  • Ability to create data perimeters for cloud-hosted data repositories
  • Centralize and share Key Management Service (KMS) resources across an organization
  • Enable Security Operations to respond in the Cloud
  • Understand the telemetry and logging available across service models (IaaS, PaaS and SaaS)
  • Design recovery processes leveraging break-glass accounts
  • Strategically approach a phased cloud migration

HANDS-ON TRAINING:

The hands-on portion of the course is unique and especially suited to the student who wants to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The "correct" version of each diagram is implemented as live infrastructure in AWS and made available to the student to explore the configurations. In this course, the students have access to an enterprise-scale AWS Organization and can observe all details discussed in the labs and throughout the course.

Each of the sections of the course discusses security design considerations for all three major clouds, however there is an emphasis on working with AWS and labs are structured around concepts in AWS.

Section 1:

  • Threat Modeling the Cloud
  • Centralizing User Account Provisioning
  • Structuring Accounts to Create Effective Hierarchies
  • Transitioning Access from IAM Users to Roles

Section 2:

  • Threat Modeling Zero-Trust Access
  • Integrating Modern Authentication into Legacy Applications
  • Scaling Cross-Cloud Authentication
  • Access Control for Shared Data Sets

Section 3:

  • Centralizing Network Security Controls
  • Building a Transit Gateway
  • Network Firewall Policies
  • VPC Private Network Access

Section 4:

  • Managing Access to Cloud-Native Storage
  • Data-Lake Access Controls and Governance
  • Architecting for Big Data Governance
  • Data Resiliency: Key Management and Backup Strategies

Section 5:

  • Centralizing Cloud-Native Events
  • Exporting Cloud Telemetry to an External SIEM
  • Architecting Network-layer Quarantine

"All three of today's labs were helpful in cementing the concepts. The "See It In Action" portions were particularly useful." - Oritse Uku

"The book, material, labs allow for a very interactive learning experience regarding building and understanding cloud architecture." - Nevan Beal, Raymond James

"I really liked that architecture diagrams were incorporated in each." - Greg Lewis, SAP

"Exercises provoke thought and instill good discussions." - Soe San Win, Robert Bosch, LLC

SYLLABUS SUMMARY:

  • Section 1: A foundational section covering IAM in the cloud, the higher-level resource containers in each of the 3 major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
  • Section 2: A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
  • Section 3: Managing cloud network resources at-scale requires an architect to understand cloud-native network controls. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
  • Section 4: Protecting data in the cloud requires security teams to examine cloud-native data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
  • Section 5: In this section we focus on how to uplift a SOCs capabilities, adapt traditional methodologies to cloud-hosted environments, ensuring robust detection and response continues as an organization shifts their workloads to the cloud.

ADDITIONAL FREE RESOURCES:

WHAT YOU WILL RECEIVE:

  • Printed and electronic courseware
  • Draw.io architectural diagrams representing secure patterns you can use as reference architecture
  • Access to the SEC549 Cloud lab environment
  • MP3 audio files of the complete course lecture

WHAT COMES NEXT:

Depending on your current role or future plans, one of these courses is a great next step in your cloud security journey:

Syllabus (30 CPEs)

Download PDF
  • Overview

    SEC549 kicks off by defining concepts used throughout the course such as threat modeling the cloud, what makes a secure pattern and how our mental models need to adapt for the cloud.

    This section dedicates a portion of time to foundational concepts of identity in the cloud from users, groups, roles, and machine identities and how those concepts subtly differ across the 3 major cloud providers. Managing identity in the cloud is an overarching theme of this section. This course teaches students the core concepts of identity federation, single sign-on, and the protocols used in these technologies. Using AWS SSO as an example, students are taught how to enable identity federation in support of a centralized workforce identity, automatically provision users to the cloud and centrally maintain attributes governing access control.

    Exercises
    • Threat Modeling the Cloud
    • Centralizing User Account Provisioning
    • Structuring Accounts to Create Effective Hierarchies
    • Transitioning Access from IAM Users to Roles
    Topics
    • Security Architecture in the cloud with an emphasis on threat modeling cloud-native services
    • Using the large-scale building blocks offered in three CSP to create effective hierarchical designs
    • Implementing an identity foundation - understanding how permissions are granted and patterns of IAM in the cloud
    • Federated access and single sign-on - managing users at scale with the federation of identity
  • Overview

    Identity and access control forms the basis of the concepts of this section. Section 2 starts with an in-depth look at the zero-trust movement, its history and how zero-trust in the cloud can be leveraged to uplift legacy access patterns. We not only discuss permission granting architectures but also how to build identity guardrails into your cloud estates, ensuring constraints are placed for security or compliance purposes. Students will learn how to authenticate end users and machine identities acorss multiple public cloud environments. The section wraps up by implementing policies that restrict access between an organization's resources and trusted third parties.

    Exercises
    • Threat Modeling Zero-Trust Access
    • Integrating Modern Authentication into Legacy Applications
    • Scaling Cross-Cloud Authentication
    • Enforcing Cross-Cloud Identity Boundaries
    Topics
    • Cloud Migrations - considerations and business drivers
    • Zero-Trust Concepts - using cloud services to implement zero-trust patterns in a phased approach
    • Implementing the Identity Pillar into Cloud-hosted applications using AWS Cognito
    • Authenticating users and workloads across cloud providers (AWS, Azure, and Google Cloud) with workload identity federation
    • Enforcing identity boundaries with guardrails across clouds
  • Overview

    With a solid identity foundation, students shift focus to cloud architecture patterns for their organization. Building an enterprise cloud network requires a fundamental understanding of how things change moving from an on-premise network. Section 3 starts with the key resources required to build public, private, and hybrid cloud networks. From there, students learn to centrally manage the configuration of these resources across their organization. Next, we explore cloud micro-segmentation, hub and spoke networks, and routing traffic between micro-networks. Our focus then shifts to centralizing traffic flow through ingress and egress networks, as well as inspecting east-west traffic with third-party security appliances. Finally, students learn how to share network services by adding additional spoke networks and sharing DNS configurations across the organization.

    Exercises
    • Centralizing Network Security Controls
    • Building a Transit Gateway
    • Network Firewall Policies
    • VPC Private Network Access
    Topics
    • Comparing on-premise and cloud-hosted virtual networks
    • Managing cloud-hosted networks at scale with VPC sharing and the firewall manager
    • Building micro-segmentation and hybrid networks with hub and spoke architecture
    • Centralizing ingress and egress traffic network controls
    • Inspecting east-west traffic with third-party security appliances
    • Sharing network services and private DNS resources

  • Overview

    Section 4 focuses on cloud-native data protection patterns. Starting with common organization-wide storage service controls, students will establish foundational data perimeter policies. From there, we learn to segment data lake access through views and access points. Next, students explore how attribute-based access control, tagging, and data masking can enable cloud-native data loss prevention controls. Finally, the section wraps up with key management and backup architecture patterns.

    Exercises
    • Public Data Storage Organization Policies
    • Access Control for Shared Data Sets
    • Big Query Data Governance and Data Loss Prevention
    • Centralizing Key Management (KMS) Resources
    Topics
    • Managing access to Cloud-Native Storage services
    • Establishing perimeters in the Cloud for application access
    • Data-Lake access control and governance with access points and views
    • Big Query (BQ) identity and data exfiltration controls
    • Data tagging for attribute-based access control, masking, and data loss prevention
    • Centralizing key management and data backup resources
  • Overview

    This section covers how to enable your SOC to operate (investigate incidents, log events, hunt for threats) in the new cloud-based world. Covered in this section is a deep dive on cloud data sources, aggregating logs and cloud-native events within the CSP while positioning them for export to the central SIEM. This section teaches students how to build effective architecture which empowers defenders to respond, contain and ultimately recover from cloud-based incidents.

    Exercises
    • Centralizing Cloud-Native Events
    • Exporting Cloud Telemetry to an External SIEM
    • Architecting Network-layer Quarantine
    Topics
    • Security Operations in a Cloud-Centric World
    • In-depth look at data sources logging and aggregation to ensure sufficient logging coverage given various service models (IaaS, PaaS, SaaS)
    • Enabling response in the cloud with network-layer and identity-layer quarantine zones
    • Designing break-glass accounts for cloud account recovery with availability in mind

Prerequisites

The following are courses or equivalent experiences that are prerequisites for SEC549:

Preparing for SEC549

Students taking SEC549 will have the opportunity to learn identity access management (IAM) patterns in the cloud. A basic familiarity with IAM concepts like role-based access control, attribute-based access control and permission management is helpful but not required.

Additionally, students will delve into cloud-native tools for securing deployments at the network layer. Having a basic understanding of network concepts such as firewalls, network access control lists and IP addressing is helpful but not mandatory.

Laptop Requirements

Prior to class, ensure that the following software is installed on the operating system:

  • Current Web Browser with internet access (i.e. Chrome, Safari, Edge, or Firefox)

In this environment, we have found that a second monitor and/or a tablet device can be useful for keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

Author Statement

"The cloud has turned our perimeter increasingly distributed and is often solely enforced with identity-based controls. In the cloud, safeguards have been lifted and the room for error is slim. Even with this grim reality, I am still optimistic. The migration to the cloud has enabled our most innovative technologies and presents an opportunity for the security sector to evolve and mature.

If armed with the correct foundational principles, we can as an industry build a more secure future, with greater availability and confidentiality than ever possible on-premises. If history has taught us anything, transitioning to the new cloud-native, zero-trust world will be bumpy but I am so pleased to help shepherd you along the journey."

- Kat Traxler & Eric Johnson

"The instructor knows the subject very well." - Ahmed Bouzamondo

Reviews

The content for day 2 was very solid and organized.
The labs were great! I enjoyed every second of this course and look forward to future SEC549 courses.
Nevan Beal
Raymond James
What was covered in the first day flowed well and seemed well organized. Concepts are explained clearly and concisely.
Nicholas Dray

    Register for SEC549

    Loading...