Auditing Cloud Security

As more organizations move data and infrastructure to the cloud, auditing the security of the cloud is becoming a major priority. Operations and development teams are using the cloud in new ways, and organizations are eager to save money, gain new capabilities and add operational efficiency by using these services. Unfortunately, security is often overlooked and/or misunderstood when it comes to cloud services. Many cloud providers do not provide detailed control information about their internal environments, and quite a few common security controls used internally may not translate directly to the public cloud.

During this course, auditors learn the risk associated with cloud services, and how to audit these critical environments. Fundamental concepts of cloud policy and governance for auditors, will be addressed, as well as the technical security principles and controls for all major cloud types (SaaS, PaaS, and IaaS). Specific examples and configurations are reviewed including those from AWS, Azure and GCP.

Students will explore the Cloud Security Alliance framework for cloud control areas and how it can be utilized to make audits more effective. We will delve into assessing risk for cloud services, looking specifically at technical areas that need to be addressed. Comprehensive discussions will encompass network security (firewalls and network access controls, intrusion detection, and more), as well as all the other layers of the cloud security stack. When looking at development risks, we will also investigate methods of ensuring that security is embedded into cloud life cycle. We will also delve into incident handling, forensics, event management, and application security.