What You Will Learn

Design It Right from the Start.

SEC549 teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers' well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.

SEC549 takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.

"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP

What Is Cloud Security Architecture?

Cloud security architecture requires us to understand business requirements and existing cloud services and capabilities in order to design access control patterns, network controls, and secure processes to support a business outcome that can be implemented and maintained within required cloud operating environments. This requires architects to understand and design secure cloud solutions for workloads deployed on Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) service models. Understanding hybrid architecture patterns is also important as cloud workloads integrate with on-premises systems. The cloud security architect's goal is to identify security design flaws and inefficiencies when information systems interconnect and mitigate these flaws in the early stages of development using available cloud-capable security controls.

Business Takeaways

Mitigate the risks introduced by cloud technologies and their rapid adoption
Decrease the risk of cloud migrations by planning a phased approach
Prevent identity sprawl and technical debt through centralization
Enable business growth by creating high-level guardrails
Prevent costly anti-patterns from sprawling throughout a cloud organization
Apply learned access patterns to help move your organization towards zero-trust
Design effective conditional access policies and learn how to place guardrails around business-driven policy exceptions

"The problems we talk about are some that I face in my job every day or know I will face shortly. Getting definitive answers for many of these issues is very helpful for me. Getting years of experience from the instructors and what they have worked on is invaluable." - Patrick Haughney, Paylocity

Skills Learned

Enable business through secure enterprise cloud security architectural designs
Connect the dots between cloud architecture designs and real-life solutions
Build a secure, scalable identity foundation in the cloud
Centralize your organization's workforce identity to prevent sprawl
Build micro-segmented networks using hub and spoke patterns
Configure centralized network firewalls for inspecting north-south and east-west traffic
Learn how to incorporate both network-based and identity-based controls
Create data perimeters for cloud-hosted data repositories
Centralize and share Key Management Service (KMS) resources across an organization
Enable security operations and incident response in the cloud
Understand the telemetry and logging available across service models (IaaS, PaaS, and SaaS)
Design push and pull logging architectures for centralized log aggregation
Plan for cloud recovery processes using multiple tiers of break-glass accounts

Hands-On Cloud Security Architect Training

The hands-on portion of SEC549 is unique and especially suited to students who want to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The completed version of each diagram is implemented as live infrastructure in AWS, Azure, or Google (depending on the topic) and made available for students to explore. In this course, students have access to an enterprise-scale AWS, Azure, and Google Cloud organization and can observe all details discussed in the labs and throughout the course.

"I've done a lot of labs over the years. These are likely one of the best ways to present them I've ever used." - Daniel Russell, BCBSLA

"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - Tyler Piller, British Columbia Lottery Corporation

"Based on my experience, the labs in 549 are very much aligned with what an Architect could encounter in their day to day work." - Macie J Bak, Standard Chartered

Syllabus Summary

Each section discusses security design considerations for all three major clouds, however, there is a stronger emphasis on the AWS cloud. Each lab below indicates which cloud provider(s) is used to see the real-world implementation:

Section 1:

A foundational section covering IAM in the cloud, the higher-level resource containers in each of the three major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.

Threat Modeling the Cloud (cloud agnostic)
Centralizing User Account Provisioning (AWS / Azure)
Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
Designing an Identity Bastion Account (AWS / Google)

Section 2:

A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.

Threat Modeling Zero-Trust Access (cloud agnostic)
Integrating Modern Authentication into Legacy Applications (AWS)
Scaling Cross-Cloud Authentication (AWS)
Balancing Security and Usability with Conditional Access (Azure)

Section 3:

Managing cloud network resources at-scale requires an architect to understand the cloud provider's network security capabilities. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.

Centralizing Network Security Controls (AWS)
Building a Hub and Spoke Network (AWS / Azure)
Centralized Traffic Inspection (AWS / Azure)
VPC Private Network Access (AWS)

Section 4:

Protecting data in the cloud requires security teams to examine cloud provider data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.

Data Discovery and Classification (Google)
Access Control for Shared Data Sets (AWS)
Access Control for BigQuery (Google)
Key Management Architecture (AWS / Google)

Section 5:

In this section we focus on logging and detection patterns that help the Security Operations Center (SOC), adapt traditional methodologies to cloud-hosted environments, and ensure robust detection and response continues as their organization shifts workloads to the cloud.

Centralizing Intra-cloud Log Events (AWS / Azure / Google)
Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
Architecting Quarantine Patterns (AWS)

Additional Free Resources

Aviata Cloud Chapter 5: Centralizing Cross Cloud Security Events, Workshop
Centralizing Cloud Logs and Events with Microsoft Sentinel, Webcast
BigQuery Data Access Identity Architecture, cheat sheet
Inspection VPC Architecture, cheat sheet
Azure to AWS Identity Architecture, cheat sheet
Azure to GCP Identity Architecture, cheat sheet
Designing Access to Shared Datasets in the Cloud, workshop
Breaking the Cloud Kill Chain, webcast
Privilege Escalation in GCP - A Transitive Path, video
It's Like Chipotle - Demystifying GCP PaaS Services, video
Lessons Learned Deploying Modern Cloud Systems in Highly Regulated Environments, webcast

What You Will Receive

Printed and electronic courseware
Draw.io architectural diagrams representing secure patterns you can use as reference architecture
Access to the SEC549 Cloud lab environment

What Comes Next?

Syllabus (30 CPEs)

Download PDF

Cloud Account Management and Identity Foundations
Overview
Section 1 starts by defining concepts used throughout the course such as threat modeling the cloud, what makes a secure design, and how security changes in the cloud. Students then start designing cloud identity for the Delos organization by learning the foundational concepts of cloud identity: users, groups, roles, and machine identities. With those concepts in mind, we enable identity federation and provisioning from Microsoft Entra ID to both AWS and Google Cloud using Entra ID enterprise applications. With identity federation in place, students design a foundational cloud resource hierarchy for the organization to host resources with policy guardrails for organization units and accounts. The final module covers the cloud provider permission models and how to centralize legacy and external users and provide a single entry and management point for each cloud environment.
Exercises
- Threat Modeling the Cloud (cloud agnostic)
- Centralizing User Account Provisioning (AWS / Azure)
- Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
- Designing an Identity Bastion Account (AWS / Google)
Topics
- Security Architecture in the Cloud
  Threat modeling the cloud
  Cloud-native security models
- Federated Access / Single Sign-On
  Managing users at scale with Microsoft Entra ID, AWS Single Sign-On, and Google Cloud Identity
  Provisioning users with the System for Cross-domain Identity Management (SCIM) specification
- Creating Hierarchical Cloud Structures
  Designing organizational hierarchy with AWS Organizations, Azure Management Groups, and Google Cloud
  Creating policy guardrails in the hierarchy to help silo job roles and prevent IAM mistakes
- Implementing an Identity Foundation
  Understanding how permissions are granted and patterns of IAM in the cloud
  Centralizing legacy users and machine identities into an identity bastion account
  Granting secure external access to vendors and contractors
Implementing an Identity Perimeter in the Cloud
Overview
Section 2 starts with an in-depth look at the zero-trust movement, its history and how zero-trust in the cloud can be leveraged to uplift legacy access patterns. We not only discuss permission granting architectures but also how to build identity guardrails into your cloud estates, ensuring constraints are placed for security or compliance purposes. Students will learn how to authenticate end users and machine identities across multiple public cloud environments. The section wraps up by implementing policies that restrict access between an organization's resources and trusted third parties. A key take-away from this section is how to implement policies that restrict access between an organization's resources and trusted third parties.
Wrapping up this section, students focus on Azure AD Conditional Access and how policies are crafted to define the guardrails for resource access. Taking a strong practical lens to Conditional Access, students will learn how to narrowly and safely carve out business-driven exceptions to multi-factor authentication (MFA) enforcement.
Exercises
- Threat Modeling Zero-Trust Access (cloud agnostic)
- Integrating Modern Authentication into Legacy Applications (AWS)
- Scaling Cross-Cloud Authentication (AWS)
- Balancing Security and Usability with Conditional Access (Azure)
Topics
- Implementing Zero-Trust Architecture
  History of Zero-Trust
  Using cloud services to implement zero-trust architecture
- Customer Identity and Access Management (CIAM)
  Identity federation with Microsoft Entra External ID and AWS Cognito
- Architecting Cross-Cloud Authentication
  Killing long-lived credentials in AWS, Azure, and Google Cloud
  Designing workload identity federation across cloud providers
  Using certificates to authenticate on-premises workloads to cloud provider APIs
- Conditional Access Policies
  Designing effective Conditional Access policies
  Understanding Conditional Access using Google BeyondCorp, AWS Verified Access, AWS Service Control Policy (SCP), and Entra ID Conditional Access
Cloud Native Security Operations
Overview
With a solid identity foundation, students shift focus to cloud architecture patterns for their organization. Building an enterprise cloud network requires a fundamental understanding of how things change moving from an on-premise network. Section 3 starts with the key resources required to build public, private, and hybrid cloud networks. From there, students learn to centrally manage the configuration of these resources across their organization. Next, we explore cloud micro-segmentation, hub and spoke networks, and routing traffic between micro-networks. Our focus then shifts to centralizing traffic flow through ingress and egress networks, as well as inspecting east-west traffic with third-party security appliances. Finally, students learn how to share network services by adding additional spoke networks and sharing DNS configurations across the organization.
Exercises
- Centralizing Network Security Controls (AWS)
- Building a Hub and Spoke Network (AWS / Azure)
- Centralized Traffic Inspection (AWS / Azure)
- VPC Private Network Access (AWS)
Topics
- On-Premises Versus Cloud Networks
  Cloud architecture challenges
  CISA Zero Trust Model: Network & Environment
- Managing Cloud-Hosted Networks at Scale
  Cloud network building blocks (virtual networks, subnets, internet gateways, firewall rules, network interfaces, and private service endpoints)
  Hosting network resources centrally in a cloud organization
  Sharing VPC networks across projects / accounts
  Managing firewall rules using AWS Firewall Manager, Azure Firewall Manager, and Google Cloud Hierarchical Firewall Policies
- Cloud Network Micro-Segmentation
  Connecting micro networks using VPC peering and hub and spoke services
  Creating hybrid networks with site-to-site VPN tunnels and dedicated connections
- Network Firewalls and Traffic Inspection
  Centralizing ingress and egress traffic network controls using AWS Transit Gateway and Azure Virtual WAN
  Inspecting east-west traffic with third-party security appliances, Kubernetes network policy, and AWS VPC Lattice
  Load balancing traffic and symmetric routing to third-party security appliances
- Centralized Shared Network Services
  Hosting private link / private access services in a centralized spoke
  Designing least privilege private link policies for data perimeters
  Sharing private DNS hosted zones with spoke networks
Data Access Perimeters in the Cloud
Overview
Section 4 focuses on cloud-native data protection patterns. Starting with common organization-wide storage service controls, students will establish foundational data perimeter policies. From there, we learn to segment data lake access through views and access points. Next, students explore how attribute-based access control, tagging, and data masking can enable cloud-native data loss prevention controls. Finally, the section wraps up with key management and backup architecture patterns.
Exercises
- Data Discovery and Classification (Google)
- Access Control for Shared Data Sets (AWS)
- Access Control for BigQuery (Google)
- Key Management Architecture (AWS / Google)
Topics
- Data Security & Privacy Playbook
  Defining, dissecting, and defending data
  Data classification patterns
  Resource naming and tagging
  Cloud data discovery and classification services
- Cloud Storage Service Security
  Managing access to cloud storage services
  Establishing network perimeters in the cloud for data access
  Designing data backup, replication, and business continuity plans in the cloud
- Data Lake Security
  Designing centralized data warehouses with data mart access points
  Access control and governance with S3 access points
  Access control and governance with BigQuery views, row-level, and column-level policies
  Big Query identity and data exfiltration controls
  Data pipelines for tagging for attribute-based access control, masking, and data loss prevention
- Key Management Architecture
  Creating centralized key management stores for the organization
  Patterns for isolating key administrators from data being protected
  Sharing keys across cloud accounts
  Regulatory requirements that may require customer-managed or cloud hardware security module (HSM) managed keys
Enable the Cloud-Focused SOC
Overview
This section covers how to enable your SOC to operate (investigate incidents, log events, hunt for threats) in the new cloud-based world. Covered in this section is a deep dive on cloud data sources, aggregating logs and cloud-native events within the CSP while positioning them for export to the central SIEM. This section teaches students how to build effective architecture which empowers defenders to respond, contain and ultimately recover from cloud-based incidents.
Exercises
- Centralizing Intra-cloud Log Events (AWS / Azure / Google)
- Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
- Architecting Quarantine Patterns (AWS)
Topics
- Security Operations in a Cloud-Centric World
  On-premises versus cloud security operations
  Cloud service provider incident coordination
  Managing security contacts in AWS, Azure, and Google cloud
- Intra-cloud Logging and Aggregation
  Understanding the logging journey for events in the cloud
  Cloud event log types and data elements
  Designing an intra-cloud security data lake for in-depth analysis
- Centralized Log Export Patterns
  Comparing SIEM solutions and platforms
  Ingesting cloud events using push and pull architecture patterns
  Exporting AWS log events using Kinesis, S3, and SQS
  Exporting Azure log events using Event Hub
  Exporting Google Cloud log events using Pub/Sub
  Data processing and transformation using Cribl
  Ingesting cross-cloud log event data using Microsoft Sentinel
- Secure Incident Response Design
  Managing read only access for incident responders
  Enabling response in the cloud with network-layer and identity-layer quarantine zones
  Designing break-glass accounts for cloud account recovery

Prerequisites

The following experience is a prerequisite for SEC549:

Familiarity with AWS, Azure, and Google Management Consoles

Preparing For SEC549

Students taking SEC549 will have the opportunity to learn many different architecture patterns across the AWS, Azure, and Google clouds. Basic familiarity with cloud concepts like IAM, role-based access control, identity federation, VPC networks, and storage services management is helpful, but not required.

Additionally, students will delve into cloud-native tools for securing deployments at the network layer. Having a basic understanding of network concepts such as firewalls, network access control lists and IP addressing is helpful, but not mandatory.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory SEC549 System Hardware Requirements

Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory SEC549 Host Configuration And Software Requirements

Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

SANS will be providing access to the following cloud environments: AWS, Azure, and Google Cloud. Unfortunately due to some cloud security controls we cannot control, sometimes the login you receive requires verification with a valid phone number where you can receive text messages (virtual numbers will not work). Please ensure you have and are willing to provide your phone number to the cloud provider should this situation occur.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses ranges.io for delivering the lab documents and challenges. A second monitor and/or a tablet device can be useful for keeping the class materials visible while you are working on your labs.

If you have additional questions about the laptop specifications, please contact customer service.

Author Statement

"Distributing our workloads and data to the public cloud increases our perimeter, which is often protected only by identity-based security controls. With the network perimeter being lifted, the margin for error is slim. Even with this grim reality, we can still be optimistic. Migrating to the cloud enables our most innovative technologies and presents an opportunity for the security sector to evolve and mature.

If armed with the correct foundational design principles, we can build a more secure future, with greater availability and confidentiality than ever possible on-premises. Transitioning to the new cloud-native, zero-trust world may be bumpy, but we are here to help shepherd you along the journey."

- Eric Johnson, David Hazar

"Eric was an excellent instructor. He was open to questions and very good with making the content interactive. It was also nice to discuss potential pitfalls he's seen in real life implementations." - Derek Dorman, Wright-Patt Credit Union

"David is a great instructor and was well versed with the content. He was able to answer all my questions, and even elaborate further on some knock on effects. I would definitely highly recommend him to other people looking to take a SANS course." - Jamie Swingler, RLI Corp

Ways to Learn

OnDemand

Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.

Live Online

The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.

View Available Dates & Time Zones

In Person (5 days)

Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.

View Available Dates & Locations

Who Should Attend SEC549?

Solutions Architects
Security Auditors
Cloud Architects
Security Engineers
Security Architect
Cloud Engineers
DevOps Engineers
System Administrators
Operations
Anyone responsible for:
- Enabling business through secure cloud architecture
- Evaluating and adopting new cloud offerings
- Planning for cloud migrations
- Implementing or managing cloud identity and access management
- Managing a cloud-based virtual network

"It delivered on expectations. Very informative, applicable to my daily job, and would be useful for anyone wanting to grow into a cybersecurity architect role, anyone in the role already, and anyone that works in the cloud on a technical level to understand the mindset of the security teams." - Daniel Russell, BCBSLA

See prerequisites

Need to justify a training request to your manager?

Use this justification letter template to share the key details of this training and certification opportunity with your boss.

Download the Letter

SEC549: Cloud Security Architecture™

Course Authors:

Eric Johnson

David Hazar

What You Will Learn

Design It Right from the Start.

What Is Cloud Security Architecture?

Business Takeaways

Skills Learned

Hands-On Cloud Security Architect Training

Syllabus Summary

Additional Free Resources

What You Will Receive

What Comes Next?

Syllabus (30 CPEs)

Cloud Account Management and Identity Foundations

Overview

Exercises

Topics

Implementing an Identity Perimeter in the Cloud

Overview

Exercises

Topics

Cloud Native Security Operations

Overview

Exercises

Topics

Data Access Perimeters in the Cloud

Overview

Exercises

Topics

Enable the Cloud-Focused SOC

Overview

Exercises

Topics

Prerequisites

Preparing For SEC549

Laptop Requirements

Important! Bring your own system configured according to these instructions.

Mandatory SEC549 System Hardware Requirements

Mandatory SEC549 Host Configuration And Software Requirements

Author Statement

Ways to Learn

Who Should Attend SEC549?

Need to justify a training request to your manager?

Reviews

Filters:

Register for SEC549

Loading...