I always encourage a three‑step process as a path to
preparing for any certification in the classroom.
When you study, be sure to develop an understanding of and an ordering of,
first, establishing definitions, second,
the application of those definitions, and finally,
third, the integration of all things.
Making application of an exam item topic means that we know when,
how, where, why, and even who uses that item.
Integrating an exam item topic means that we can now blend topics and
see how they fit into one another like puzzle pieces.
You should be able to take an element from the first domain and see
how it works with an element from the last domain.
First,
let's consider what's meant by establishing definitions
and from where our definitions derived.
Definition lays down the foundation upon which everything else is based.
The definition for the CCSP, like many cyber certs,
are derived from the major cybersecurity standards that
are known and accepted internationally.
Think ISO and NIST.
So it is not helpful from a position of focus and positivity to speak
about the taxonomy in the CCSP in a mocking manner,
like, oh, that's the CCSP term.
The terms used for the CCSP are derived from ISO and NIST.
We often incorporate the standard within our organization,
implementing them to fit our operating environment; therefore,
we end up calling it something very different from the standard and may
call it something that no longer resembles the standard.
We may begin to fight with the description that we see from
ISC2 or some other certification organization.
I've seen this play out live in the classroom where someone will
swear this is not what something is called,
and then you show them in the ISO or the NIST document that it is.
Suppose you are outside of the United States.
In that case,
you may have an allergy to the NIST documentation since its origins
are in the US and the primary purpose of it is to ready the protection
of federal or government systems there.
The matter of fact is that the NIST standard is
consumed from and contributed to globally.
If you use ENISA, it calls out a basis of NIST within it.
The advanced encryption standard is an example of a NIST‑sponsored global
collaboration based upon two Belgian cryptologist's algorithm.
An example of a definition you would want to be familiar with is
found in the five characteristics of cloud computing described in
NIST Special Publication 800‑145, broad network access,
rapid elasticity, resource pooling, on‑demand,
and measured services.
These five characteristics I like to make into an acronym known as BRROM,
B‑R‑R‑O‑M.
If you use the latter definition of ISO 17788,
then you would add another M for multitenancy.
But let's focus on one element in BRROM, namely measured.
Here,
the provider delivers instrumentation so that an organization
only pays for the services they utilize.
Measured allows a nontechnology‑based company to move from being a
prominent owner and manager of sizable physical technology platforms and
the capitalization cost of such and move over to a model that is focused on
paying for the benefits of the platform rather than the ownership and cost
of what produces the benefits.
Now that we have the definition and characteristics of measured,
let's apply the definition.
We want to understand how and when we engage the defined element,
how does it fit in to consuming cloud services,
and when is it useful?
The pay‑as‑you‑go ability of measured first drew major businesses to
consider consuming cloud services in the boardroom.
It was compelling to be presented with the opportunity to
reduce the capitalization of technology,
which is the costliest element of any significant business.
Now that we've covered the definition and the application of measured,
let's consider what this concept could be integrated with.
The integration comes when you can take one discrete exam item and make a
seamless connection to another discrete exam item. For instance, how do we
integrate measured with rapid elasticity in BRROM? The definition of rapid
elasticity is a multidirectional function.
We have the rapid expansion and scaling up of services and the
immediate release of those services when no longer needed.
An application of rapid elasticity is learning how to use the cloud for
high‑velocity work in what is known as immutable workloads.
These workloads are not maintained in how a datacenter server is
maintained with care and feeding the patch management process. When
we no longer need a workload in the cloud,
you can delete it.
You cannot delete a server in the datacenter. So, we have the
application of rapid elasticity now. We want to integrate rapid
elasticity with measured. The rapid release of the services no
longer needed supports the measured attribute of only paying for the
services that you are using.
When you no longer use that service,
you no longer pay for it. Join me in the following clip as we
consider more specific strategies paired with sample questions
to address navigating the exam.