Cloud Service Security Assessment & related stuff

Some courses and studies about this daily topic

Areas and topics covered: Security Management, Personnel Security, Physical Security, Network Security, Information System Security, Data Security, Access Security, High Availability, Portability and Compatiblity and Change and System management. Security Clearance. Complete System Security and Confiuguration Management, Operational Security and End User Access Security.

Secure management of secret and classified information, GDPR. Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS).

Documentation, Monitoring, Reporting, Incident Responce Procedures and Protocols.

Ref: BSI Cloud Certification (BSI), Cloud Security Alliance (CSA), EuroCloud, TÜV Trust IT, ISO27001 and ISO27017

Responsibility charts: Facility, Networking, Storage, Servers, Virtualization, Operating system, Middleware, Runtime, Data, Applications. Public cloud, Hybrid cloud, Private cloud, Community cloud.

Just list of related keywords from the course: Cyber Security, Cloud Security, Critical Information Systems, Cloud Service Provider (CSP) Security, European Security Certification Framework (EU-SEC), Cloud Computing Compliance, Cloud Controls Matrix, Information Security Management Systems, Organization Risk Management, Designated Security Authority (DSA), National Communications Security Authority (NCSA), Security Accreditation Authority (SAA), Crypto Approval Authority (CAA), National Security Authority (NSA), National TEMPEST Authority (NTA), Crypto Distribution Authority (CDA), National Distribution Authority (NDA), National Institute of Standards and Technology (NIST), Service Level Agreements (SLA), Sensitive Compartmented Information (SCI), Life-Cycle Assessment (LCA), TL IV, Separation of Duties (SoD), Layered Security, Principle of Least Privilege (PoLP), Perimeter Security, Critical Infrastructure, Disaster Recovery, Business Continuity, Emergency Management, PiTuKri, Data Encryption, Authentication, Man in the Middle (MitM) protection, Brute Force protection, Replay Attack protectoin, Log Management, Security Information and event management (SIEM), Security Information Management (SIM), Security Event Management (SEM), System Hardening, Limiting Attack Surface, Forensic Analysis, Data Integrity, User Authentication, Access Management, Data Segregation, KATAKRI II, Backup Security, Transfer / Transit Security, Tokenization, Anonymization, Redaction, Cryptographic Key Management System (CKMS, KMS), Hardware Security Module (HSM), Malware / Exploit Protection, Zeroday Emergency Response Team (ZERT), Computer Emergency Response Team (CERT), Computer Security Incident Response Team (CSIRT), National Cyber Security Centre (NCSC), Key Distribution, Keys Revoking, Bring Your Own Keys (BYOK), Data remanence, Data Erasure, Clearing / Purging / Destruction, Computer Forencics, Capacity Planning, Recovery Point Objective (RPO), Recovery Time Objective (RTO), Continuous Data Protection (CDP), Off-site Backup, Vulnerability Management, Penetration Testing, Network Scanning, Network Mapping, Evaesdropping, Intrustion Detection System (IDS), Configuration Management Database (CMDB), Two-Factor Authentication (2FA), Multi-Factor Authentication (MFA), Jump Server, Access Control List (ACL), Bastion Host, Documentation, Rollback Process, Best Practice, Version Management, Software Integrity, Open Web Application Security Project (OWASP), Administration and Development Environment Security, Traficom, Finlex, Confidential, Internal, Secret, Public, Legalization, Regulation, Regulations.

2019-06-09