CCSP For Dummies with Online Practice

371 Pages·9.131 MB·English

by  Arthur J. Deane

CCSP® with
Online Practice
by Arthur J. Deane, CISSP, CCSP
CCSP® For Dummies® with Online Practice
Published by: John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030-5774, www.wiley.com
Copyright © 2021 by John Wiley & Sons, Inc., Hoboken, New Jersey
Media and software compilation copyright © 2021 by John Wiley & Sons, Inc. All rights reserved.
Published simultaneously in Canada
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any
means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections
107 or 108 of the 1976 United States Copyright Act, without the prior written permission of the Publisher. Requests to
the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River
Street, Hoboken, NJ 07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.
Trademarks: Wiley, For Dummies, the Dummies Man logo, Dummies.com, Making Everything Easier, and related
trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and may not be used without written
permission. CCSP is a registered trademark of (ISC)2, Inc. All other trademarks are the property of their respective
owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book.
LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: THE PUBLISHER AND THE AUTHOR MAKE NO
REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS
OF THIS WORK AND SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES
OF FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY MAY BE CREATED OR EXTENDED BY SALES OR
PROMOTIONAL MATERIALS. THE ADVICE AND STRATEGIES CONTAINED HEREIN MAY NOT BE SUITABLE FOR
EVERY SITUATION. THIS WORK IS SOLD WITH THE UNDERSTANDING THAT THE PUBLISHER IS NOT ENGAGED
IN RENDERING LEGAL, ACCOUNTING, OR OTHER PROFESSIONAL SERVICES. IF PROFESSIONAL ASSISTANCE IS
REQUIRED, THE SERVICES OF A COMPETENT PROFESSIONAL PERSON SHOULD BE SOUGHT. NEITHER THE
PUBLISHER NOR THE AUTHOR SHALL BE LIABLE FOR DAMAGES ARISING HEREFROM. THE FACT THAT AN
ORGANIZATION OR WEBSITE IS REFERRED TO IN THIS WORK AS A CITATION AND/OR A POTENTIAL SOURCE OF
FURTHER INFORMATION DOES NOT MEAN THAT THE AUTHOR OR THE PUBLISHER ENDORSES THE INFORMATION
THE ORGANIZATION OR WEBSITE MAY PROVIDE OR RECOMMENDATIONS IT MAY MAKE. FURTHER, READERS
SHOULD BE AWARE THAT INTERNET WEBSITES LISTED IN THIS WORK MAY HAVE CHANGED OR DISAPPEARED
BETWEEN WHEN THIS WORK WAS WRITTEN AND WHEN IT IS READ.
For general information on our other products and services, please contact our Customer Care Department within
the US at 877-762-2974, outside the US at 317-572-3993, or fax [phone]. For technical support, please visit
https://hub.wiley.com/community/support/dummies.
Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with
standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to
media such as a CD or DVD that is not included in the version you purchased, you may download this material at
http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Control Number: 2020942663
ISBN 978-1-119-64837-6 (pbk); ISBN 978-1-119-64836-9 (ePDF); ISBN 978-1-119-64838-3 (epub)
Manufactured in the United States of America
10 9 8 7 6 5 4 3 2 1
Contents at a Glance
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Part 1: Starting Your CCSP Journey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
CHAPTER 1: Familiarizing Yourself with (ISC)2 and the CCSP Certification . . . . . . . . . . 9
CHAPTER 2: Identifying Information Security Fundamentals . . . . . . . . . . . . . . . . . . . . 25
Part 2: Exploring the CCSP Certification Domains . . . . . . . . . . 41
CHAPTER 3: Domain 1: Cloud Concepts, Architecture and Design . . . . . . . . . . . . . . . 43
CHAPTER 4: Domain 2: Cloud Data Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91
CHAPTER 5: Domain 3: Cloud Platform and Infrastructure Security . . . . . . . . . . . . . 129
CHAPTER 6: Domain 4: Cloud Application Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
CHAPTER 7: Domain 5: Cloud Security Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
CHAPTER 8: Domain 6: Legal, Risk and Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Part 3: The Part of Tens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
CHAPTER 9: Ten (or So) Tips to Help You Prepare for the CCSP Exam . . . . . . . . . . . 297
CHAPTER 10: Ten Keys to Success on Exam Day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Part 4: Appendixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
APPENDIX A: Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
APPENDIX B: Helpful Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

Table of Contents
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
About this Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Foolish Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Icons Used in This Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Beyond the Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Where to Go from Here . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
PART 1: STARTING YOUR CCSP JOURNEY . . . . . . . . . . . . . . . . . . . . . 7
Familiarizing Yourself with (ISC)2
CHAPTER 1:
and the CCSP Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Appreciating (ISC)2 and the CCSP Certification . . . . . . . . . . . . . . . . . . . . . 9
Knowing Why You Need to Get Certified . . . . . . . . . . . . . . . . . . . . . . . . . 10
Studying the Prerequisites for the CCSP . . . . . . . . . . . . . . . . . . . . . . . . . 11
Understanding the CCSP Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Domain 1: Cloud Concepts, Architecture and Design . . . . . . . . . . . 12
Domain 2: Cloud Data Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Domain 3: Cloud Platform and Infrastructure Security . . . . . . . . . . 14
Domain 4: Cloud Application Security . . . . . . . . . . . . . . . . . . . . . . . . 15
Domain 5: Cloud Security Operations . . . . . . . . . . . . . . . . . . . . . . . . 15
Domain 6: Legal, Risk and Compliance . . . . . . . . . . . . . . . . . . . . . . . 16
Preparing for the Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Studying on your own . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Learning by doing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Getting official (ISC)2 CCSP training . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Attending other training courses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Practice, practice, practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Ensuring you’re ready for the exam . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Registering for the Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Taking the Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Identifying What to Do After the Exam . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Identifying Information Security
CHAPTER 2:
Fundamentals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Exploring the Pillars of Information Security . . . . . . . . . . . . . . . . . . . . . . 26
Confidentiality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Threats, Vulnerabilities, and Risks . . . Oh My! . . . . . . . . . . . . . . . . . . . . . 28
Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Table of Contents vii
Securing Information with Access Control . . . . . . . . . . . . . . . . . . . . . . . . 29
Deciphering Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Encryption and decryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Types of encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Common uses of encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Grasping Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Realizing the Importance of Business Continuity and
Disaster Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Implementing Incident Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Preparing for incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Detecting incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Containing incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Eradicating incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Recovering from incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Conducting a Post-Mortem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Utilizing Defense-in-Depth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
PART 2: EXPLORING THE CCSP
CERTIFICATION DOMAINS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Domain 1: Cloud Concepts,
CHAPTER 3:
Architecture and Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Knowing Cloud Computing Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Defining cloud computing terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Identifying cloud computing roles . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Recognizing key cloud computing characteristics . . . . . . . . . . . . . . 47
Building block technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Describing Cloud Reference Architecture . . . . . . . . . . . . . . . . . . . . . . . . 49
Cloud computing activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Cloud service capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Cloud service categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Cloud deployment models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Cloud shared considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Impact of related technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Identifying Security Concepts Relevant to Cloud Computing . . . . . . . . 64
Cryptography and key management . . . . . . . . . . . . . . . . . . . . . . . . . 65
Access control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Data and media sanitization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Network security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Virtualization security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Common threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Comprehending Design Principles of Secure Cloud Computing . . . . . 76
Cloud Secure Data Lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Cloud based disaster recovery (DR) and business
continuity (BC) planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
viii CCSP For Dummies with Online Practice