Let's do a quick summary of the important parts of cloud application security
for the Certified Cloud Security Professional examination.
The exam content outline includes key topic areas
like application security training, secure software development lifecycle,
cloud software assurance and validation, to use verified secure
software and cloud application architecture.
An important part of having secure cloud implementations
is identity and access management.
We need to seek for identity and access management solutions
that are effective based perhaps on technologies and
approaches such as federated identity,
single sign‑on, multifactor authentication,
a cloud access security broker, and of course, secrets management.
Some of the key points we covered in this domain included
designed secure applications to train our developers and users
in the use of those applications, and of course, to operate our
applications in a secure way.
The goals of application security include to build an application
that has security so that it can operate in the most dangerous of all
environments, a risk‑laden environment.
We can say that that means we have to understand what
are the threats to those applications,
especially those that are common for cloud‑based applications.
We then need to build secure software to meet those threats and, of course,
test thoroughly to make sure that our security actually works.
The concerns with application security include that important
area of access control to make sure that only authorized people
can perform authorized functions.
We have the concerns related to application program
interfaces and third‑party software.
We need to ensure that our applications run efficiently and
effectively so that they support the business requirements.
And of course, and a very important part of all this is that all
of our applications are configured correctly.
We've seen many cases where there were secure
applications deployed in an insecure manner.
When we look at data threats and security,
we looked at some of the models such as STRIDE.
We looked at the good information provided by the Open Web
Application Security Project, and, of course, we know the value
of testing to make sure that all of the known vulnerabilities
don't exist in our applications.
So what are some of the key points to remember?
Remember, software should be built with the expectation it will be attacked.
Security is not something we can just add on later.
Instead, it must be baked into our applications, and we should test thoroughly,
both for normal, as well as abnormal types of operations.
Then, deploy your applications in a secure manner.
The next steps, do the self‑assessment questions and think about
why one answer may be better than another.
Then review the references, important terminology, and exam
essentials provided in the study guide and proceed to the next
course, Cloud Security Operations.