CCSP Cert Prep: 4 Cloud Application Security

Learn the core concepts of cloud application security as you prepare for the fourth domain of the Certified Cloud Security Professional (CCSP) exam.

Introduction

• Securing cloud applications
• What you need To know
• Study resources

1. Secure Software Development Lifecycle

• Development methodologies
• Secure software development life cycle (SDLC)
• Maturity models
• Operation, maintenance, and change management
• DevOps
• SOA and microservices

2. Application Security Vulnerabilities

• Common cloud vulnerabilities
• Application security
• Preventing SQL injection
• Understanding cross-site scripting
• Request forgery
• Directory traversal
• Overflow attacks
• Cookies and attachments
• Session hijacking
• Code execution attacks
• Privilege escalation

3. Secure Coding Practices

• Secure coding guidance
• Input validation
• Parameterized queries
• Authentication and session management issues
• Output encoding
• Error and exception handling
• Code signing
• Database security

4. Software Threat Assessment

• Identifying threats
• Risk analysis and mitigation
• Threat modeling

5. Software Quality Assurance

• Code review
• Software testing
• Code security tests
• Abuse case testing
• Fuzz testing
• Code repositories
• Application management

6. Verified Secure Software

• Third party code
• Acquired software
• Developer training and awareness

7. Cloud Application Architecture

• Building secure cloud solutions
• Web application firewalls
• Database security controls

Conclusion

• Continuing your CCSP certification journey