SEC549: Cloud Security Architecture
About This Course
SEC549 training teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers’ well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.
SEC549 training takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted
application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.
What You'll Learn
- Design secure, enterprise-ready cloud architectures that support business goals
- Build a scalable identity foundation, centralizing workforce identity with conditional access policies and break glass access
- Learn how the cloud enables zero-trust for workforce, customer, and workload identities with both identity-based and network-based security controls
- Create micro-network segmentation using hub-and-spoke models and centralized inspection firewalls
- Protect cloud data with strong perimeters, data lake, shared Key Management Service (KMS), and disaster recovery designs
- Enable cloud incident response and telemetry using centralized intra-cloud and cross-cloud push and pull logging designs
Entry Requirements
Participants should be proficient in written and spoken English. Please refer to our website for more details on the content taught:
https://www.sans.org/cyber-security-courses/cloud-security-architecture
There are no minimum entry requirements for years of experience in the domain, education level or age group; but participants should possess the relevant prerequisite skills mentioned above.