Cantitate/Preț
Produs
Total produse
Vezi coșul
The Official (ISC)2 CCSP CBK Reference de Aaron Kraus

The Official (ISC)2 CCSP CBK Reference

Autor Aaron Kraus
en Limba Engleză Hardback – 17 noi 2022

Structura progresivă — de la concept la implementare — transformă acest volum în resursa definitivă pentru profesioniștii care vizează certificarea CCSP. Notăm cu interes rigoarea cu care The Official (ISC)2 CCSP CBK Reference abordează cele șase domenii fundamentale ale securității în cloud, oferind o perspectivă neutră față de furnizori (vendor-neutral). Putem afirma că ediția a patra, publicată sub amprenta Sybex, este mai mult decât un ghid de examen; este un manual de referință tehnică ce detaliază peste 150 de obiective specifice.

Merită menționat că volumul este organizat meticulos pentru a ghida cititorul prin complexitatea arhitecturilor cloud. Capitolele încep cu fundamentele — definiții, roluri și responsabilități — și evoluează rapid spre zone critice precum criptografia, gestionarea cheilor, securitatea rețelelor virtualizate și igiena securității. Pe linia practică a titlului (ISC)2 CCSP Certified Cloud Security Professional Official Study Guide, dar cu focus pe corpul comun de cunoștințe (CBK) și pe standardele globale stabilite de (ISC)2, această lucrare pune accent pe implementarea controalelor și pe strategiile de răspuns pe termen lung.

Analizând cuprinsul, observăm o atenție deosebită acordată principiilor de design securizat, inclusiv ciclul de viață al datelor și analiza impactului asupra afacerii (BIA). Față de alte resurse axate pe exerciții, cum este (ISC)2 CCSP Certified Cloud Security Professional Practice Exams, acest titlu semnat de Aaron Kraus se concentrează pe profunzimea teoretică și tehnică necesară pentru a proiecta și gestiona infrastructuri cloud reziliente, fiind un instrument indispensabil pentru arhitecții de securitate și liderii IT.

Citește tot Restrânge

Preț: 38287 lei

Preț vechi: 47859 lei
-20%

Puncte Express: 574

Carte disponibilă

Livrare economică 05-19 mai
Livrare express 18-24 aprilie pentru 5923 lei

 Adaugă în coș

Wish list
Gift list
Am citit!
Adaugă în listă

Specificații

ISBN-13: 9781119909019
ISBN-10: 1119909015
Pagini: 352
Dimensiuni: 241 x 254 x 25 mm
Greutate: 0.65 kg
Ediția:4. Auflage
Editura: Wiley
Colecția Sybex
Locul publicării:Hoboken, United States

De ce să citești această carte

Recomandăm această lucrare profesioniștilor IT care doresc să obțină certificarea CCSP sau să implementeze bune practici de securitate în organizații. Cititorul câștigă acces la singura sursă oficială (ISC)2, beneficiind de explicații tehnice despre securitatea datelor, conformitate și arhitectură cloud. Este un instrument esențial pentru validarea competențelor avansate într-un domeniu în continuă schimbare.

Cuprins

Foreword to the Fourth Edition xix Introduction xxi Chapter 1 Cloud Concepts, Architecture, and Design 1 Understand Cloud Computing Concepts 2 Cloud Computing Definitions 2 Cloud Computing Roles and Responsibilities 3 Key Cloud Computing Characteristics 7 Building Block Technologies 11 Describe Cloud Reference Architecture 14 Cloud Computing Activities 14 Cloud Service Capabilities 15 Cloud Service Categories 17 Cloud Deployment Models 18 Cloud Shared Considerations 21 Impact of Related Technologies 27 Understand Security Concepts Relevant to Cloud Computing 33 Cryptography and Key Management 33 Identity and Access Control 34 Data and Media Sanitization 36 Network Security 37 Virtualization Security 39 Common Threats 41 Security Hygiene 41 Understand Design Principles of Secure Cloud Computing 43 Cloud Secure Data Lifecycle 43 Cloud-Based Business Continuity and Disaster Recovery Plan 44 Business Impact Analysis 45 Functional Security Requirements 46 Security Considerations for Different Cloud Categories 48 Cloud Design Patterns 49 DevOps Security 51 Evaluate Cloud Service Providers 51 Verification against Criteria 52 System/Subsystem Product Certifications 54 Summary 56 Chapter 2 Cloud Data Security 57 Describe Cloud Data Concepts 58 Cloud Data Lifecycle Phases 58 Data Dispersion 61 Data Flows 62 Design and Implement Cloud Data Storage Architectures 63 Storage Types 63 Threats to Storage Types 66 Design and Apply Data Security Technologies and Strategies 67 Encryption and Key Management 67 Hashing 70 Data Obfuscation 71 Tokenization 73 Data Loss Prevention 74 Keys, Secrets, and Certificates Management 77 Implement Data Discovery 78 Structured Data 79 Unstructured Data 80 Semi-structured Data 81 Data Location 82 Implement Data Classification 82 Data Classification Policies 83 Mapping 85 Labeling 86 Design and Implement Information Rights Management 87 Objectives 88 Appropriate Tools 89 Plan and Implement Data Retention, Deletion, and Archiving Policies 89 Data Retention Policies 90 Data Deletion Procedures and Mechanisms 93 Data Archiving Procedures and Mechanisms 94 Legal Hold 95 Design and Implement Auditability, Traceability, and Accountability of Data Events 96 Definition of Event Sources and Requirement of Event Attribution 97 Logging, Storage, and Analysis of Data Events 99 Chain of Custody and Nonrepudiation 100 Summary 101 Chapter 3 Cloud Platform and Infrastructure Security 103 Comprehend Cloud Infrastructure and Platform Components 104 Physical Environment 104 Network and Communications 106 Compute 107 Virtualization 108 Storage 110 Management Plane 111 Design a Secure Data Center 113 Logical Design 114 Physical Design 116 Environmental Design 117 Analyze Risks Associated with Cloud Infrastructure and Platforms 119 Risk Assessment 119 Cloud Vulnerabilities, Threats, and Attacks 122 Risk Mitigation Strategies 123 Plan and Implementation of Security Controls 124 Physical and Environmental Protection 124 System, Storage, and Communication Protection 125 Identification, Authentication, and Authorization in Cloud Environments 127 Audit Mechanisms 128 Plan Disaster Recovery and Business Continuity 131 Business Continuity/Disaster Recovery Strategy 131 Business Requirements 132 Creation, Implementation, and Testing of Plan 134 Summary 138 Chapter 4 Cloud Application Security 139 Advocate Training and Awareness for Application Security 140 Cloud Development Basics 140 Common Pitfalls 141 Common Cloud Vulnerabilities 142 Describe the Secure Software Development Life Cycle Process 144 NIST Secure Software Development Framework 145 OWASP Software Assurance Maturity Model 145 Business Requirements 145 Phases and Methodologies 146 Apply the Secure Software Development Life Cycle 149 Cloud-Specific Risks 149 Threat Modeling 153 Avoid Common Vulnerabilities during Development 156 Secure Coding 156 Software Configuration Management and Versioning 157 Apply Cloud Software Assurance and Validation 158 Functional and Non-functional Testing 159 Security Testing Methodologies 160 Quality Assurance 164 Abuse Case Testing 164 Use Verified Secure Software 165 Securing Application Programming Interfaces 165 Supply-Chain Management 166 Third-Party Software Management 166 Validated Open-Source Software 167 Comprehend the Specifics of Cloud Application Architecture 168 Supplemental Security Components 169 Cryptography 171 Sandboxing 172 Application Virtualization and Orchestration 173 Design Appropriate Identity and Access Management Solutions 174 Federated Identity 175 Identity Providers 175 Single Sign-on 176 Multifactor Authentication 176 Cloud Access Security Broker 178 Summary 179 Chapter 5 Cloud Security Operations 181 Build and Implement Physical and Logical Infrastructure for Cloud Environment 182 Hardware-Specific Security Configuration Requirements 182 Installation and Configuration of Virtualization Management Tools 185 Virtual Hardware-Specific Security Configuration Requirements 186 Installation of Guest Operating System Virtualization Toolsets 188 Operate Physical and Logical Infrastructure for Cloud Environment 188 Configure Access Control for Local and Remote Access 188 Secure Network Configuration 190 Operating System Hardening through the Application of Baselines 195 Availability of Stand-Alone Hosts 196 Availability of Clustered Hosts 197 Availability of Guest Operating Systems 199 Manage Physical and Logical Infrastructure for Cloud Environment 200 Access Controls for Remote Access 201 Operating System Baseline Compliance Monitoring and Remediation 202 Patch Management 203 Performance and Capacity Monitoring 205 Hardware Monitoring 206 Configuration of Host and Guest Operating System Backup and Restore Functions 207 Network Security Controls 208 Management Plane 212 Implement Operational Controls and Standards 212 Change Management 213 Continuity Management 214 Information Security Management 216 Continual Service Improvement Management 217 Incident Management 218 Problem Management 221 Release Management 221 Deployment Management 222 Configuration Management 224 Service Level Management 225 Availability Management 226 Capacity Management 227 Support Digital Forensics 228 Forensic Data Collection Methodologies 228 Evidence Management 230 Collect, Acquire, and Preserve Digital Evidence 231 Manage Communication with Relevant Parties 234 Vendors 235 Customers 236 Partners 238 Regulators 238 Other Stakeholders 239 Manage Security Operations 239 Security Operations Center 240 Monitoring of Security Controls 244 Log Capture and Analysis 245 Incident Management 248 Summary 253 Chapter 6 Legal, Risk, and Compliance 255 Articulating Legal Requirements and Unique Risks within the Cloud Environment 256 Conflicting International Legislation 256 Evaluation of Legal Risks Specific to Cloud Computing 258 Legal Frameworks and Guidelines 258 eDiscovery 265 Forensics Requirements 267 Understand Privacy Issues 267 Difference between Contractual and Regulated Private Data 268 Country-Specific Legislation Related to Private Data 272 Jurisdictional Differences in Data Privacy 277 Standard Privacy Requirements 278 Privacy Impact Assessments 280 Understanding Audit Process, Methodologies, and Required Adaptations for a Cloud Environment 281 Internal and External Audit Controls 282 Impact of Audit Requirements 283 Identify Assurance Challenges of Virtualization and Cloud 284 Types of Audit Reports 285 Restrictions of Audit Scope Statements 288 Gap Analysis 289 Audit Planning 290 Internal Information Security Management System 291 Internal Information Security Controls System 292 Policies 293 Identification and Involvement of Relevant Stakeholders 296 Specialized Compliance Requirements for Highly Regulated Industries 297 Impact of Distributed Information Technology Model 298 Understand Implications of Cloud to Enterprise Risk Management 299 Assess Providers Risk Management Programs 300 Differences between Data Owner/Controller vs. Data Custodian/Processor 301 Regulatory Transparency Requirements 302 Risk Treatment 303 Risk Frameworks 304 Metrics for Risk Management 307 Assessment of Risk Environment 307 Understand Outsourcing and Cloud Contract Design 309 Business Requirements 309 Vendor Management 311 Contract Management 312 Supply Chain Management 314 Summary 316 Index 317

Descriere

The only official body of knowledge for CCSP—the most popular cloud security credential—fully revised and updated. Certified Cloud Security Professional (CCSP) certification validates the advanced technical skills needed to design, manage, and secure data, applications, and infrastructure in the cloud. This highly sought-after global credential has been updated with revised objectives. The new third edition of The Official (ISC)2 Guide to the CCSP CBK is the authoritative, vendor-neutral common body of knowledge for cloud security professionals. This comprehensive resource provides cloud security professionals with an indispensable working reference to each of the six CCSP domains: Cloud Concepts, Architecture and Design; Cloud Data Security; Cloud Platform and Infrastructure Security; Cloud Application Security; Cloud Security Operations; and Legal, Risk and Compliance. Detailed, in-depth chapters contain the accurate information required to prepare for and achieve CCSP certification. Every essential area of cloud security is covered, including implementation, architecture, operations, controls, and immediate and long-term responses. Developed by (ISC)2, the world leader in professional cybersecurity certification and training, this indispensable guide: Covers the six CCSP domains and over 150 detailed objectives Provides guidance on real-world best practices and techniques Includes illustrated examples, tables, and diagrams The Official (ISC)2 Guide to the CCSP CBK is a vital ongoing resource for IT and information security leaders responsible for applying best practices to cloud security architecture, design, operations and service orchestration.