Formation de préparation à l examen de

Transcription

1 Formation de préparation à l examen de Certification CCSK en sécurité de l infonuagique La certification CCSK est la plus reconnue en sécurité de l infonuagique. Elle repose sur les meilleures pratiques de la sécurité des technologies de l information dans ce domaine. La formation s adresse à toute personne œuvrant en architecture de réseau, en réseautique, architecture IT et en sécurité de l information. Intelligent Security IT vous offre une formation préparatoire à l examen CCSK à Tunis, une formation pour se préparer à l examen d obtention de la certification Certificate of Cloud Security Knowledge (CCSK) en infonuagique de la Cloud Security Alliance (CSA). Cette formation sera offerte pour la première fois en Tunisie. La session de préparation clé en main inclut le coût et le jeton pour passer ensuite l examen en ligne, au moment qui conviendra au participant. 1. Objectifs de la formation Comment peut-on assurer la sécurité des informations dispersées dans "le nuage"? Ce séminaire dresse un panorama complet de ce problème majeur du Cloud. A l'issue, les participants auront acquis les connaissances essentielles permettant de se présenter au passage de la certification CCSK de la Cloud Security Alliance. L'objectif de la session de formation aussi est de réussir l'examen de certification. Il faut absorber le mode de pensée du CSA afin d'être en mesure de comprendre les questions.

2 2. Programme de formation: Day 1 : Introduction to Cloud Computing Infrastructure Security for Cloud Introduction and Risk Analysis (practical exercise) Create and Secure a Public Cloud Instance (practical exercise) Evaluation, Q&A Day 2 : Managing Cloud Security and Risk Encrypt an EBS Volume (practical exercise) Data Security for Cloud Create and Secure a Cloud Application (practical exercise) Securing Cloud Users and Applications Evaluation, Q&A Day 3 : Identity and Access Management (practical exercise) Selecting Cloud Services Deploy and Secure a Private Cloud (practical exercise) Review, Evaluation and Test Preparation What you will receive : 3 days of training. All handouts Practical workbook After the course support Quizzes and sample questions 3. Durée de la formation : 3 jours 4. Langue de la formation: Anglais/Français (le support de cours est en Anglais) 5. Type de la formation : Inter Entreprise 6. Lieu de la formation : dans un hôtel 4* a Tunis 7. Formateur : Dr. Peter van Eijk Dr. Peter HJ van Eijk is one of the world s most experienced independent cloud trainers. He is certified by the CSA to deliver CCSK training, and by the Cloud Credential Council to deliver CompTIA Cloud Essentials and Virtualization Essentials. He was the single author of the ITpreneurs Cloud Essentials course, and a contributor to the Virtualization Essentials course. He has delivered these courses dozens of times to hundreds of attendants around the world, including the US, Europe, Middle East, India, and Asia. Peter has more than 30 years of IT experience as a consultant, coach, project leader, researcher and practitioner in the field of cloud computing and other digital infrastructures.

3 8. Key exam areas and concepts: From the CSA Guidance For Critical Areas of Focus in Cloud Computing V3.0 English : Domain 1: Architecture NIST Definition of Cloud Computing (Essential Characteristics, Cloud Service Models, Cloud Deployment Models) Multi-Tenancy CSA Cloud Reference Model Jericho Cloud Cube Model Cloud Security Reference Model Cloud Service Brokers Domain 2: Governance and Enterprise Risk Management Contractual Security Requirements Enterprise and Information Risk Management Third Party Management Recommendations supply chain examination use of cost savings for cloud Domain 3: Legal issues: Contracts and Electronic Discovery Consideration of cloud-related issues in three dimensions ediscovery considerations Jurisdictions and data locations Liability for activities of subcontractors Due diligence responsibility Federal Rules of Civil Procedure and electronically stored information Metadata Litigation hold Domain 4: Compliance and Audit Management Definition of Compliance Right to audit Compliance impact on cloud contracts Audit scope and compliance scope Compliance analysis requirements Auditor requirements Domain 5: Information Management and Data Security Six phases of the Data Security Lifecycle and their key elements Volume storage Object storage Logical vs physical locations of data Three valid options for protecting data Data Loss Prevention Detection Data Migration to the Cloud Encryption in IaaS, PaaS & SaaS Database Activity Monitoring and File Activity Monitoring Data Backup Data Dispersion Data Fragmentation Domain 6: Interoperability and Portability Definitions of Portability and Interoperability Virtualization impacts on Portability and Interoperability SAML and WS-Security Size of Data Sets Lock-In considerations by IaaS, PaaS & SaaS delivery models Mitigating hardware compatibility issues Domain 7: Traditional Security, Business Continuity, and Disaster Recovery Four D's of perimeter security Cloud backup and disaster recovery services Customer due diligence related to BCM/DR Business Continuity Management/Disaster Recovery due diligence Restoration Plan Physical location of cloud provider

4 Domain 8: Data Center Operations Relation to Cloud Controls Matrix Queries run by data center operators Technical aspects of a Provider's data center operations customer should understand Logging and report generation in multi-site clouds Domain 9: Incident Response Factor allowing for more efficient and effective containment and recovery in a cloud Main data source for detection and analysis of an incident Investigating and containing an incident in an Infrastructure as a Service environment Reducing the occurrence of application level incidents How often should incident response testing occur Offline analysis of potential incidents Domain 10: Application Security identity, entitlement, and access management (IdEA) SDLC impact and implications Differences in S-P-I models Consideration when performing a remote vulnerability test of a cloudbased application Categories of security monitoring for applications Entitlement matrix Domain 11: Encryption and Key Management Adequate encryption protection of data in the cloud Key management best practices, location of keys, keys per user Relationship to tokenization, masking, anonymization and cloud database controls Domain 12: Identity, Entitlement, and Access Management Relationship between identities and attributes Identity Federation Relationship between Policy Decision Point (PDP) and Policy Enforcement Point (PEP) SAML and WS-Federation Provisioning and authoritative sources Domain 13: Virtualization Security concerns for hypervisor architecture VM guest hardening, blind spots, VM Sprawl, data comingling, instant-on gaps In-Motion VM characteristics that can create a serious complexity for audits How can virtual machine communications bypass network security controls VM attack surfaces Compartmentalization of VMs Domain 14: Security as a Service 10 categories Barriers to developing full confidence in security as a service (SECaaS) When deploying Security as a Service in a highly regulated industry or environment, what should both parties agree on in advance and include in the SLA Logging and reporting implications How can web security as a service be deployed What measures do Security as a Service providers take to earn the trust of their customers ENISA Cloud Computing: Benefits, Risks and Recommendations for Information Security Isolation failure Economic Denial of Service Licensing Risks VM hopping

5 Five key legal issues common across all scenarios Top security risks in ENISA research OVF Underlying vulnerability in Loss of Governance User provisioning vulnerability Risk concerns of a cloud provider being acquired Security benefits of cloud Risks R.1 R.35 and underlying vulnerabilities Data controller vs data processor definitions in Infrastructure as a Service (IaaS), who is responsible for guest systems monitoring 9. Passage de l Exam The CCSK examination is a timed, multiple choice examination you take online at The examination consists of 60 multiple choice questions selected randomly from question pool, and must be completed within 90 minutes. A participant must correctly answer 80% of the questions to receive a passing score. Because the exam is online, it is open book. For candidates that fail the test, there is one retry included in the offer. Test participants will receive two opportunities to pass the test. While you may take your second attempt as soon as you wish, we highly recommend studying the source material again prior to taking the test. Because of question randomization, you may see a very different exam with mostly different questions.

6 PREPARATION A LA CERTIFICATION CCSK 09, 10 et 11 Novembre 2015 FICHE INSCRIPTION Merci de photocopier, remplir et renvoyer ce bulletin par fax ou par . Nom et prénom :.... Fonction : Entreprise :.... Adresse : Téléphone :.. Fax :.... TARIF Formation CCSK: DT HT (TVA 12%) Frais d examen : DT HT (Les frais d inscription à l examen sont optionnels) Total HT:.. Tunis le, Signature et cachet Conditions générales d inscription Votre inscription sera définitive après réception d une confirmation écrite de votre part, par Bon de Commande (télécopie ou courrier), 15 jours avant le début de la session, où devront figurer le nom des stagiaires, le montant de la commande, les caractéristiques du stage et les adresses de correspondance et de facturation. Elle sera prise en compte dans la limite des places disponibles. Une convocation écrite sera adressée personnellement au stagiaire dès la réception de son inscription. Lieu de la session de Formation: Hôtel 4* à Tunis. Numéro d enregistrement : Tunis : MFPE : Calcul des coûts: Les prix incluent : La participation à la formation. Les supports de cours. Les Déjeunes et pauses cafés. Annulation de session: Intelligent Security IT se réserve le droit d annuler une session lorsque le nombre de participants est insuffisant. Annulation d inscription: Tout désistement devra être notifié à Intelligent Security IT au moins deux semaine avant le début de la session. Au delà de ce délai, le montant prévu pour la session vous sera intégralement facturé.