دوره SANS SEC549: Cloud Security Architecture به دانش آموزان می آموزد که چگونه راه حل های زیرساخت ابری در مقیاس سازمانی را برای سازمان خود طراحی کنند. معماران امنیتی با یادگیری چارچوب‌های طراحی شده ارائه‌دهندگان ابر، می‌توانند کنترل‌های امنیتی متمرکزی را برای فضای ابری خود طراحی کنند و در عین حال سرعت پذیرش ابر را برای سازمان به حداکثر برسانند. دانش‌آموزان یاد خواهند گرفت که چگونه مدل‌های تهدید در فضای ابری با محیط‌های جدید و بسیار توزیع شده و مرزهای اعتماد ناآشنا تغییر می‌کنند. با در نظر گرفتن این چالش‌ها، تمرکز ما به طراحی استراتژی‌هایی برای متمرکز کردن و تقویت هویت نیروی کار، دسترسی مشروط، حفاظ‌های خط‌مشی، کنترل‌های امنیتی شبکه، محیط‌های داده و جریان‌های گزارش تغییر می‌کند.
SANS SEC549 دانش‌آموزان را در سفر مهاجرت ابری یک شرکت خیالی و چالش‌هایی که در این راه با آن‌ها مواجه می‌شوند، می‌برد. به عنوان معماران مشتاق امنیت ابر، دانش‌آموزان وظیفه دارند تا در یک طرح هویت متمرکز برای مدیریت ابر نیروی کار و دسترسی برنامه‌های میزبانی ابری همراه با پشتیبانی از اصول طراحی هویت حجم کار برای اعطای دسترسی به سایر سرویس‌های ابری، اقدام کنند. علاوه بر این، حفاظ‌های خط‌مشی برای ایجاد مرزهایی تعبیه شده‌اند که به سازمان کمک می‌کند امنیت و انطباق را حفظ کند و در عین حال انعطاف‌پذیری را برای تیم‌های مهندسی فراهم کند. با وجود مدیریت هویت و دسترسی (IAM)، ما شروع به ارزیابی مزایا و معایب طرح‌های مختلف شبکه و دریاچه داده برای ایجاد یک محیط داده برای سازمان می‌کنیم. ماموریت نهایی نظارت بر دسترسی به شبکه و داده ها با متمرکز کردن داده های گزارش در سراسر سازمان برای دسترسی ایمن به منابع حیاتی است.
Date: 2022
Price: $8,020 USD
Publisher: SANS
By: Kat Traxler, Eric Johnson , David Haza
Format: eBook PDF + Videos + Lab File
Organizations are migrating infrastructure and applications to the cloud at a rapid pace. As migrations take place, security architects are struggling to design hybrid and cloud-native solutions to meet their organization’s security requirements. Shifting to the cloud requires a deep understanding of the threats introduced by a cloud migration, and how each provider mitigates those threats using their well-architected framework. SEC549 teaches security professionals how to design an enterprise-ready, scalable cloud organization. With nearly 20 hands-on labs, students will learn to design cloud solutions for their organization at any stage of the cloud journey, whether planning for the first workload, managing complex legacy environments, or operating in an advanced cloud-native ecosystem.
What You Will Learn
SEC549 teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers’ well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.
SEC549 takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.
“I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general.” – GREG LEWIS, SAP
What Is Cloud Security Architecture?
Cloud security architecture requires us to understand business requirements and existing cloud services and capabilities in order to design access control patterns, network controls, and secure processes to support a business outcome that can be implemented and maintained within required cloud operating environments. This requires architects to understand and design secure cloud solutions for workloads deployed on Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) service models. Understanding hybrid architecture patterns is also important as cloud workloads integrate with on-premises systems. The cloud security architect’s goal is to identify security design flaws and inefficiencies when information systems interconnect and mitigate these flaws in the early stages of development using available cloud-capable security controls.
Business Takeaways
- Mitigate the risks introduced by cloud technologies and their rapid adoption
- Decrease the risk of cloud migrations by planning a phased approach
- Prevent identity sprawl and technical debt through centralization
- Enable business growth by creating high-level guardrails
- Prevent costly anti-patterns from sprawling throughout a cloud organization
- Apply learned access patterns to help move your organization towards zero-trust
- Design effective conditional access policies and learn how to place guardrails around business-driven policy exceptions
“The problems we talk about are some that I face in my job every day or know I will face shortly. Getting definitive answers for many of these issues is very helpful for me. Getting years of experience from the instructors and what they have worked on is invaluable.” – PATRICK HAUGHNEY, PAYLOCITY
Skills Learned
- Enable business through secure enterprise cloud security architectural designs
- Connect the dots between cloud architecture designs and real-life solutions
- Build a secure, scalable identity foundation in the cloud
- Centralize your organization’s workforce identity to prevent sprawl
- Build micro-segmented networks using hub and spoke patterns
- Configure centralized network firewalls for inspecting north-south and east-west traffic
- Learn how to incorporate both network-based and identity-based controls
- Create data perimeters for cloud-hosted data repositories
- Centralize and share Key Management Service (KMS) resources across an organization
- Enable security operations and incident response in the cloud
- Understand the telemetry and logging available across service models (IaaS, PaaS, and SaaS)
- Design push and pull logging architectures for centralized log aggregation
- Plan for cloud recovery processes using multiple tiers of break-glass accounts
Hands-On Cloud Security Architect Training
The hands-on portion of SEC549 is unique and especially suited to students who want to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The completed version of each diagram is implemented as live infrastructure in AWS, Azure, or Google (depending on the topic) and made available for students to explore. In this course, students have access to an enterprise-scale AWS, Azure, and Google Cloud organization and can observe all details discussed in the labs and throughout the course.
Each section discusses security design considerations for all three major clouds, however, there is a stronger emphasis on the AWS cloud. Each lab below indicates which cloud provider(s) is used to see the real-world implementation:
Section 1:
- Threat Modeling the Cloud (cloud agnostic)
- Centralizing User Account Provisioning (AWS / Azure)
- Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
- Designing an Identity Bastion Account (AWS / Google)
Section 2:
- Threat Modeling Zero-Trust Access (cloud agnostic)
- Integrating Modern Authentication into Legacy Applications (AWS)
- Scaling Cross-Cloud Authentication (AWS)
- Balancing Security and Usability with Conditional Access (Azure)
Section 3:
- Centralizing Network Security Controls (AWS)
- Building a Transit Gateway (AWS)
- Network Firewall Policies (AWS)
- VPC Private Network Access (AWS)
Section 4:
- Data Discovery and Classification (Google)
- Access Control for Shared Data Sets (AWS)
- Access Control for BigQuery (Google)
- Key Management Architecture (AWS / Google)
Section 5:
- Centralizing Intra-cloud Log Events (AWS / Azure / Google)
- Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
- Architecting Quarantine Patterns (AWS)
“I’ve done a lot of labs over the years. These are likely one of the best ways to present them I’ve ever used.” – DANIEL RUSSELL, BCBSLA
“The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content.” – TYLER PILLER, BRITISH COLUMBIA LOTTERY CORPORATION
“All three of today’s labs were helpful in cementing the concepts. The “See It in Action” portions were particularly useful.” – ORITSE UKU
“I really liked that architecture diagrams were incorporated in each [lab].” – GREG LEWIS, SAP
Syllabus Summary
- Section 1: A foundational section covering IAM in the cloud, the higher-level resource containers in each of the three major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
- Section 2: A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
- Section 3: Managing cloud network resources at-scale requires an architect to understand the cloud provider’s network security capabilities. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
- Section 4: Protecting data in the cloud requires security teams to examine cloud provider data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
- Section 5: In this section we focus on how to uplift the capabilities of a Security Operations Center (SOC), adapt traditional methodologies to cloud-hosted environments, and ensure robust detection and response continues as their organization shifts workloads to the cloud.
Syllabus (30 CPEs)
Cloud Account Management and Identity Foundations
Implementing an Identity Perimeter in the Cloud
Network Access Perimeters for the Cloud
Data Access Perimeters in the Cloud
Enable the Cloud-Focused SOC
