What’s New in CCSK v5?

The Cloud Security Alliance (CSA) has significantly updated its Certificate of Cloud Security Knowledge (CCSK) to version 5 (v5). This version reflects the latest advancements in cloud security, ensuring cybersecurity professionals comprehensively understand modern cloud components and best practices. Below, we explore the key updates and enhancements in CCSK v5, outlining the changes across the various domains.

Overview

CCSK v5 has introduced substantial updates to keep pace with the evolving cloud security landscape. It provides an in-depth understanding of cloud architecture, workloads, data protection, virtual networking, and DevSecOps. Furthermore, it includes introductory content on Zero Trust, Generative AI, and more. The curriculum emphasizes managing risks, achieving compliance, optimizing cloud security strategies, and clarifying the shared responsibility model between cloud providers and users.

Consolidated Domain Structure

The number of domains has been streamlined from 14 to 12, improving the organization and grouping of related topics for a more coherent learning experience.

CCSK v5 Domains

CCSK v5 Exam Structure

Detailed Domain Additions and Changes

CCSK v5 introduces several new topics that reflect the latest advancements in cloud security.

Domain 1: Cloud Computing Concepts & Architectures

Domain 1, “Cloud Computing Concepts & Architectures,” remains foundational in the CCSK v5 curriculum, ensuring a comprehensive understanding of essential cloud computing principles. While the core content has largely been retained, this domain has been enhanced with the inclusion of the CSA Enterprise Architecture Model.

• CSA Enterprise Architecture Model: Provides a structured framework outlining cloud architecture layers and components to help in designing, implementing, and managing cloud infrastructure.

Domain 2: Cloud Governance

The domain previously known as “Governance and Enterprise Risk Management” has been renamed to “Cloud Governance.” This change reflects a more focused approach to managing governance, specifically within cloud environments.

Key Additions

• The Governance Hierarchy: Introduces the governance hierarchy in cloud environments, covering the distribution of roles and responsibilities to ensure clarity and accountability.
  • Cloud Security Frameworks: Explains the importance of adopting structured frameworks to systematically manage cloud security risks and address security challenges.
  • Policies: Focuses on developing and managing policies for data security, access control, incident response, and regulatory compliance in cloud usage.

Domain 3: Risk, Audit, & Compliance

Formerly known as Domain 4, “Compliance and Audit Management,” this domain has been renamed and updated to Domain 3, “Risk, Audit, & Compliance.” This updated domain includes substantial enhancements to provide a more comprehensive understanding of risk management, auditing processes, and compliance requirements in cloud environments.

Key Additions

• Cloud Risk Management: Introduces methodologies for identifying, assessing, and mitigating risks specific to cloud environments.
• Governance, Risk, and Compliance (GRC) Tools & Technologies: Outlines tools and technologies that support the governance, risk management, and compliance within an organization.

Expanded Coverage Areas

• Compliance & Audit
  • Jurisdictions: Detailed information on various legal jurisdictions and their specific requirements.
  • Cloud-Relevant Laws & Regulations: Overview of laws and regulations pertinent to cloud computing.
  • Compliance Inheritance: Discusses how compliance responsibilities are shared between cloud providers and users.
  • Artifacts of Compliance: Outlines documentation and evidence required for compliance.

Domain 4: Organization Management

Domain 4 is a newly introduced domain that covers essential aspects of organizational structure and security management in cloud environments. It includes the following key areas:

• Organization Hierarchy Models: Describes different models for organizing cloud security within an enterprise.
• Managing Organization-Level Security Within a Provider: Focuses on securing organizational deployments within cloud providers.
• Considerations for Hybrid & Multi-Cloud Deployments: Addresses security considerations for hybrid and multi-cloud environments.

Domain 5: Identity & Access Management

Formerly known as Domain 12, “Identity, Entitlement, and Access Management,” this domain has been renamed and updated to Domain 5, “Identity & Access Management (IAM).” This redefined domain strongly emphasizes the principles and practices of IAM in cloud environments.

Key Focus Areas

• Identity Management: Ensures appropriate access to resources by managing user identities, authentication, and authorization.
• Access Management: Controls user access to resources, ensuring only authorized people can access particular data or systems.
• IAM Between Organizations and Cloud Providers: Ensures secure identity management across different entities.

Domain 6: Security Monitoring

“Security Monitoring” is a new addition in CCSK v5, replacing the previous focus on “Management Plane and Business Continuity”. This domain encompasses the following key topics:

• Cloud Monitoring: Techniques and tools for monitoring cloud environments.
• Beyond Logs – Posture Management: Strategies for managing security posture beyond traditional logging.
• Cloud Telemetry Sources: Identifies sources of telemetry data in cloud environments.
• Collection Architectures: Discusses architectures for collecting and analyzing telemetry data.
• AI for Security Monitoring: Explores the use of AI in enhancing security monitoring.

Domain 7: Infrastructure & Networking

The domain name has changed from “Infrastructure Security” to “Infrastructure & Networking,” reflecting an expanded focus. This domain now includes several new topics and provides increased coverage of key areas.

Key Additions

• Infrastructure as Code (IaC): Manage and provision cloud infrastructure using code and automation for better consistency and scalability.
• Zero Trust for Cloud Infrastructure & Networks: Implement zero trust principles in cloud environments to authenticate, authorize, and encrypt all access requests.
• Secure Access Service Edge (SASE): Integrate network security services with wide-area networking capabilities.

Expanded Coverage Areas

• Cloud Infrastructure Security: Enhanced strategies for protecting cloud infrastructure.
• Cloud Network Fundamentals: Basic principles of cloud networking.
• Cloud Network Security & Secure Architectures: Advanced methods for securing cloud networks.

Domain 8: Cloud Workload Security

The domain has been renamed from “Virtualization and Containers” to “Cloud Workload Security,” reflecting its broader scope.

Key Additions

• Securing Serverless and Function as a Service (FaaS): Focuses on securing serverless architectures and FaaS to protect them from threats and vulnerabilities.
• Securing AI Workloads: Addresses the specific security challenges associated with deploying and managing AI applications.

Expanded Coverage Areas

• Cloud Workload Security: Provides foundational knowledge on securing various workloads in cloud environments.
• Securing Virtual Machines: Discusses best practices for securing virtual machines.
• Securing Containers: Covers security strategies for containerized applications.

Domain 9: Data Security

Previously known as “Data Security and Encryption,” this domain is now called “Data Security” and includes new topics with expanded coverage on existing ones.

Key Additions

• Data Security for Artificial Intelligence: Focuses on techniques and practices to protect data used in AI applications.
• Data Lakes: Addresses security considerations for managing and protecting large-scale data repositories.

Expanded Coverage Areas

• Primer on Cloud Storage: Provides an overview of security practices for various cloud storage options.
• Cloud Data Encryption at Rest: Details methods and best practices for encrypting data stored in the cloud.
• Data Security Tools and Techniques: Discusses a range of tools and techniques used to secure data in cloud environments.

Domain 10: Application Security

This domain has been updated to include new topics and expanded coverage on key areas critical to securing cloud applications.

Renamed Topics

• Secure Development Lifecycle: Focuses on best practices for integrating security throughout the software development process.
• Architecture’s Role in Secure Cloud Applications: Emphasizes the importance of designing secure cloud applications from the ground up.

Key Additions

• DevOps & DevSecOps: Covers the integration of security practices within the DevOps framework.
• CI/CD (Continuous Integration and Continuous Deployment): Explores security considerations and practices for automating the integration and deployment of code changes.

Expanded Coverage Areas

• Identity & Access Management: Expands on secure identity and access management (IAM) within application security, ensuring robust access control.

Domain 11: Incident Response & Resilience

Formerly known as Domain 9, “Incident Response,” this domain has been renamed and updated to Domain 11, “Incident Response & Resilience.” The focus has expanded to include new topics such as:

• Resilience: Strategies and practices to ensure quick recovery and continuous operation during incidents.

Domain 12: Related Technologies & Strategies

Formerly known as Domain 14, “Related Technologies & Strategies,” this domain has been renamed and updated to Domain 12, “Related Technologies.” The focus has shifted from IoT and Mobile Data to more relevant issues in current cloud security, particularly AI and Generative AI.

Key Additions

• Artificial Intelligence (AI): Emphasizes the role of AI in enhancing cloud security.
• Generative AI: Focuses on the use of generative AI in cloud environments.
• Zero Trust: Introduces zero trust principles and strategies for securing cloud infrastructures.

Reduced Coverage and Removed Topics

CCSK v5 has reduced its focus on legal and regulatory specifics, moving away from detailed discussions on laws and regulations. Additionally, Security as a Service (Sec-aaS) has been removed, with cloud security tools now integrated across several domains.

You can also explore our latest article: CCSK v4 vs. CCSK v5

CCSK Training with InfosecTrain

Enroll in InfosecTrain’s CCSK v5 Certification training course to enhance your cloud security expertise and prepare for the CCSK certification exams. Our course offers in-depth knowledge, practical experience, and guidance from expert instructors to help you excel in cloud security roles and secure cloud environments effectively.

AUTHOR
Ruchi Bisht

“ My Name is Ruchi Bisht. I have done my BTech in Computer Science. I like to learn new things and am interested in taking on new challenges. Currently, I am working as a content writer in InfosecTrain. “