Audit and Security for Cloud-Based Services

This course covers the current state of cloud computing, its common architecture, and the major SaaS, PaaS, and IaaS providers in the market today. It covers the security and control deficiencies in cloud-based services and looks at Security as a Service as a way to protect against them. Participants review a risk-based approach to audit and controls for cloud-based services and investigate areas such as cloud-based network models, cloud access security brokers, disaster recovery, and governance in a cloud environment. It reinforces the concepts covered with examples to help participants identify the risks, controls, and gaps in cloud services.

Why you should take this course

For users with an intermediate knowledge of this topic, and are searching for a deeper understanding of its evolving complexities.

Here are the topics we'll cover.

1. Architecture

   • What is in the Cloud?
   • Cloud Architecture and Services
   • Current Market, Pros and Cons
   • Cloud Growth Drivers

2. Service Models

   • Software as a Service (SaaS)
   • Platform as a Service (PaaS)
   • Infrastructure as a Service (IaaS)
   • Cloud Service Brokers (CSBs)
   • Security as a Service
   • Risks

3. Security Standards

   • Security Standards and Technologies
   • NIST
   • Cloud Security Alliance (CSA)
   • The Open Worldwide Application Security Project (OWASP)
   • Identity Management
   • FedRAMP
   • European Network Information Security (enisa)

4. Risk Assessment and Vendor Management

   • Outsourcing Risks
   • Contracts and Right to Audit
   • Certifications: SOC, Subservice Organizations
   • Security Statements by Provider
   • Relationship Monitoring

5. Provider Security Tools

   • Provider Tool Overview
   • Amazon Web Services (AWS)
   • Google Cloud Provider (GCP)
   • Microsoft Cloud