Migrating to the cloud introduces immense benefits for companies and individuals in terms of efficiency and costs. With respect to security, the effects are quite diverse, but it is a common perception that using cloud services impacts security in a positive manner. Opinions, however, diverge many times even on defining who is responsible for ensuring the security of cloud resources.
Covering IaaS, PaaS and SaaS, first the security of the infrastructure is discussed: hardening and configuration issues as well as various solutions for authentication and authorization alongside identity management that should be at the core of all security architecture. This is followed by some basics regarding legal and contractual issues, namely how trust is established and governed in the cloud.
The focus of the course is on application security issues, dealing both with data security and the security of the applications themselves. From the standpoint of application security, cloud computing security is not substantially different than general software security, and therefore basically all OWASP-enlisted vulnerabilities are relevant in this domain as well. It is the set of threats and risks that makes the difference.
There are no prerequisites for this course.
Developers, architects, testers and cloud applications.
Understand basic concepts of security, IT security and secure coding
Understand major threats and risks in the cloud domain
Learn about elementary cloud security solutions
Understand security concepts of Web services
Learn about XML security
Have a practical understanding of cryptography
Learn Web vulnerabilities beyond OWASP Top Ten and know how to avoid them
Learn about denial of service attacks and protections
Learn typical input validation mistakes
Understand data security challenges in the cloud
Learn about NoSQL security
Learn about MongoDB security
Understand the challenges of auditing and evaluating cloud systems for security
Learn how to secure the cloud environment and infrastructure
Learn how to set up and operate the deployment environment securely
Get sources and further readings on secure coding practices