SEC549: OnDemand
Provided by SANS
What You Will Learn
Design It Right from the Start.
SEC549 teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers' well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.
SEC549 takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.
"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP
What Is Cloud Security Architecture?
Cloud security architecture requires us to understand business requirements and existing cloud services and capabilities in order to design access control patterns, network controls, and secure processes to support a business outcome that can be implemented and maintained within required cloud operating environments. This requires architects to understand and design secure cloud solutions for workloads deployed on Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) service models. Understanding hybrid architecture patterns is also important as cloud workloads integrate with on-premises systems. The cloud security architect's goal is to identify security design flaws and inefficiencies when information systems interconnect and mitigate these flaws in the early stages of development using available cloud-capable security controls.
Business Takeaways
Skills Learned
The hands-on portion of SEC549 is unique and especially suited to students who want to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The completed version of each diagram is implemented as live infrastructure in AWS, Azure, or Google (depending on the topic) and made available for students to explore. In this course, students have access to an enterprise-scale AWS, Azure, and Google Cloud organization and can observe all details discussed in the labs and throughout the course.
"I've done a lot of labs over the years. These are likely one of the best ways to present them I've ever used." - Daniel Russell, BCBSLA
"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - Tyler Piller, British Columbia Lottery Corporation
"Based on my experience, the labs in 549 are very much aligned with what an Architect could encounter in their day to day work." - Macie J Bak, Standard Chartered
Syllabus Summary
Each section discusses security design considerations for all three major clouds, however, there is a stronger emphasis on the AWS cloud. Each lab below indicates which cloud provider(s) is used to see the real-world implementation:
Section 1:
A foundational section covering IAM in the cloud, the higher-level resource containers in each of the three major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
Managing cloud network resources at-scale requires an architect to understand the cloud provider's network security capabilities. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
Protecting data in the cloud requires security teams to examine cloud provider data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
In this section we focus on logging and detection patterns that help the Security Operations Center (SOC), adapt traditional methodologies to cloud-hosted environments, and ensure robust detection and response continues as their organization shifts workloads to the cloud.
Design It Right from the Start.
SEC549 teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers' well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.
SEC549 takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.
"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP
What Is Cloud Security Architecture?
Cloud security architecture requires us to understand business requirements and existing cloud services and capabilities in order to design access control patterns, network controls, and secure processes to support a business outcome that can be implemented and maintained within required cloud operating environments. This requires architects to understand and design secure cloud solutions for workloads deployed on Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) service models. Understanding hybrid architecture patterns is also important as cloud workloads integrate with on-premises systems. The cloud security architect's goal is to identify security design flaws and inefficiencies when information systems interconnect and mitigate these flaws in the early stages of development using available cloud-capable security controls.
Business Takeaways
- Mitigate the risks introduced by cloud technologies and their rapid adoption
- Decrease the risk of cloud migrations by planning a phased approach
- Prevent identity sprawl and technical debt through centralization
- Enable business growth by creating high-level guardrails
- Prevent costly anti-patterns from sprawling throughout a cloud organization
- Apply learned access patterns to help move your organization towards zero-trust
- Design effective conditional access policies and learn how to place guardrails around business-driven policy exceptions
Skills Learned
- Enable business through secure enterprise cloud security architectural designs
- Connect the dots between cloud architecture designs and real-life solutions
- Build a secure, scalable identity foundation in the cloud
- Centralize your organization's workforce identity to prevent sprawl
- Build micro-segmented networks using hub and spoke patterns
- Configure centralized network firewalls for inspecting north-south and east-west traffic
- Learn how to incorporate both network-based and identity-based controls
- Create data perimeters for cloud-hosted data repositories
- Centralize and share Key Management Service (KMS) resources across an organization
- Enable security operations and incident response in the cloud
- Understand the telemetry and logging available across service models (IaaS, PaaS, and SaaS)
- Design push and pull logging architectures for centralized log aggregation
- Plan for cloud recovery processes using multiple tiers of break-glass accounts
The hands-on portion of SEC549 is unique and especially suited to students who want to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The completed version of each diagram is implemented as live infrastructure in AWS, Azure, or Google (depending on the topic) and made available for students to explore. In this course, students have access to an enterprise-scale AWS, Azure, and Google Cloud organization and can observe all details discussed in the labs and throughout the course.
"I've done a lot of labs over the years. These are likely one of the best ways to present them I've ever used." - Daniel Russell, BCBSLA
"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - Tyler Piller, British Columbia Lottery Corporation
"Based on my experience, the labs in 549 are very much aligned with what an Architect could encounter in their day to day work." - Macie J Bak, Standard Chartered
Syllabus Summary
Each section discusses security design considerations for all three major clouds, however, there is a stronger emphasis on the AWS cloud. Each lab below indicates which cloud provider(s) is used to see the real-world implementation:
Section 1:
A foundational section covering IAM in the cloud, the higher-level resource containers in each of the three major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
- Threat Modeling the Cloud (cloud agnostic)
- Centralizing User Account Provisioning (AWS / Azure)
- Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
- Designing an Identity Bastion Account (AWS / Google)
A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
- Threat Modeling Zero-Trust Access (cloud agnostic)
- Integrating Modern Authentication into Legacy Applications (AWS)
- Scaling Cross-Cloud Authentication (AWS)
- Balancing Security and Usability with Conditional Access (Azure)
Managing cloud network resources at-scale requires an architect to understand the cloud provider's network security capabilities. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
- Centralizing Network Security Controls (AWS)
- Building a Hub and Spoke Network (AWS / Azure)
- Centralized Traffic Inspection (AWS / Azure)
- VPC Private Network Access (AWS)
Protecting data in the cloud requires security teams to examine cloud provider data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
- Data Discovery and Classification (Google)
- Access Control for Shared Data Sets (AWS)
- Access Control for BigQuery (Google)
- Key Management Architecture (AWS / Google)
In this section we focus on logging and detection patterns that help the Security Operations Center (SOC), adapt traditional methodologies to cloud-hosted environments, and ensure robust detection and response continues as their organization shifts workloads to the cloud.
- Centralizing Intra-cloud Log Events (AWS / Azure / Google)
- Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
- Architecting Quarantine Patterns (AWS)
- Aviata Cloud Chapter 5: Centralizing Cross Cloud Security Events, Workshop
- Centralizing Cloud Logs and Events with Microsoft Sentinel, Webcast
- BigQuery Data Access Identity Architecture, cheat sheet
- Inspection VPC Architecture, cheat sheet
- Azure to AWS Identity Architecture, cheat sheet
- Azure to GCP Identity Architecture, cheat sheet
- Designing Access to Shared Datasets in the Cloud, workshop
- Breaking the Cloud Kill Chain, webcast
- Privilege Escalation in GCP - A Transitive Path, video
- It's Like Chipotle - Demystifying GCP PaaS Services, video
- Lessons Learned Deploying Modern Cloud Systems in Highly Regulated Environments, webcast
- Printed and electronic courseware
- Draw.io architectural diagrams representing secure patterns you can use as reference architecture
- Access to the SEC549 Cloud lab environment
- SEC488: Cloud Security Essentials
- LDR520: Cloud Security for Leaders
Enquire
| Start date | Location / delivery | |
|---|---|---|
| No fixed date | Virtual | Book now |
Related article
Challenge Yourself with CyberLive
At GIAC, we believe that hands-on testing is the future of cybersecurity certification. With five certification exams featuring CyberLive , and thr...