Cloud Security Alliance CCSK - Certificate of Cloud Security Knowledge v5 (CCSKv5.0)

Identifies code vulnerabilities early in the development

Increases the speed of deployment to production

Improves runtime performance of the application

Enhances the user interface of the application

Management plane

Virtualization layers

Physical components

PaaS/SaaS services

Scope of the assessment and the exact included features and services for the assessment

Provider infrastructure information including maintenance windows and contracts

Network or architecture diagrams including all end point security devices in use

Service-level agreements between all parties

Full API access to all required services

Any encryption option that is available for volume storage, object storage, or PaaS

Provider-managed and (sometimes) proxy encryption

Client/application and file/folder encryption

Object encryption Volume storage encryption

The division of security responsibilities between cloud providers and customers

The relationships between IaaS, PaaS, and SaaS providers

The compliance with geographical data residency and sovereignty

The guidance for the cloud compliance framework

Allowing the cloud provider to manage your keys so that they have the ability to access and delete the data from the main and back-up storage.

Maintaining customer managed key management and revoking or deleting keys from the key management system to prevent the data from being accessed again.

Practice Integration of Duties (IOD) so that everyone is able to delete the encrypted data.

Keep the keys stored on the client side so that they are secure and so that the users have the ability to delete their own data.

Both B and D.

The CCM columns are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered ad a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls. This approach will save time.

The CCM domain controls are mapped to HIPAA/HITECH Act and therefore Health4Sure could verify the CCM controls already covered as a result of their compliance with HIPPA/HITECH Act. They could then assess the remaining controls thoroughly. This approach saves time while being able to assess the company’s overall security posture in an efficient manner.

The CCM domains are not mapped to HIPAA/HITECH Act. Therefore Health4Sure should assess the security posture of their cloud service against each and every control in the CCM. This approach will allow a thorough assessment of the security posture.

Adds complexity by requiring separate configurations and integrations.

Ensures better security by offering diverse IAM models.

Reduces costs by leveraging different pricing models.

Simplifies the management by providing standardized IAM protocols.

Performing code reviews of the application source code just prior to release

Relying solely on secure coding practices by the developers without any testing

Waiting until the application is fully developed and performing a single penetration test

Conducting automated and manual security testing throughout the development

Broad Network Access

Measured Service

Third Party Service

Rapid Elasticity

Resource Pooling