Introduction |
|
xxvi | |
Chapter 1 Different Types of Cloud Models |
|
1 | (14) |
|
|
2 | (4) |
|
|
3 | (1) |
|
|
4 | (1) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
6 | (3) |
|
Infrastructure as a Service (IaaS) |
|
|
7 | (1) |
|
Platform as a Service (PaaS) |
|
|
8 | (1) |
|
Software as a Service (SaaS) |
|
|
8 | (1) |
|
|
9 | (2) |
|
|
9 | (1) |
|
|
9 | (1) |
|
Machine Learning/Artificial Intelligence (AI) |
|
|
10 | (1) |
|
Cloud Shared Responsibility Model |
|
|
11 | (3) |
|
|
14 | (1) |
Chapter 2 Capacity Planning |
|
15 | (10) |
|
|
16 | (2) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
18 | (2) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
20 | (1) |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
|
22 | (1) |
|
|
22 | (1) |
|
Performance Capacity Planning |
|
|
22 | (2) |
|
|
24 | (1) |
Chapter 3 High Availability and Scaling in Cloud Environments |
|
25 | (16) |
|
|
26 | (2) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
28 | (2) |
|
|
28 | (1) |
|
|
29 | (1) |
|
|
30 | (1) |
|
|
30 | (2) |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (1) |
|
High Availability of Network Functions |
|
|
33 | (3) |
|
|
33 | (1) |
|
|
33 | (1) |
|
|
34 | (1) |
|
|
35 | (1) |
|
Avoid Single Points of Failure |
|
|
36 | (1) |
|
|
36 | (3) |
|
|
36 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
37 | (2) |
|
|
39 | (2) |
Chapter 4 Solution Design in Support of the Business Requirements |
|
41 | (14) |
|
|
42 | (6) |
|
|
42 | (1) |
|
|
43 | (2) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
46 | (1) |
|
Service-Level Agreement (SLA) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
47 | (1) |
|
|
48 | (2) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
49 | (1) |
|
|
50 | (3) |
|
|
50 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
51 | (2) |
|
|
53 | (2) |
Chapter 5 Identity and Access Management |
|
55 | (16) |
|
Identification and Authorization |
|
|
56 | (4) |
|
Privileged Access Management (PAM) |
|
|
57 | (1) |
|
Logical Access Management |
|
|
57 | (1) |
|
Account Lifecycle Management |
|
|
58 | (1) |
|
|
59 | (1) |
|
|
60 | (1) |
|
Lightweight Directory Access Protocol (LDAP) |
|
|
61 | (1) |
|
|
61 | (2) |
|
|
63 | (1) |
|
Multifactor Authentication (MFA) |
|
|
64 | (1) |
|
|
65 | (1) |
|
Security Assertion Markup Language (SAML) |
|
|
66 | (1) |
|
Public Key Infrastructure (PM) |
|
|
66 | (1) |
|
|
67 | (1) |
|
|
67 | (2) |
|
|
69 | (2) |
Chapter 6 Secure a Network in a Cloud Environment |
|
71 | (16) |
|
|
72 | (2) |
|
Virtual LAN (VLAN)/Virtual Extensible LAN (VxLAN)/Generic Network Virtualization Encapsulation (GENEVE) |
|
|
72 | (1) |
|
|
73 | (1) |
|
|
73 | (1) |
|
|
74 | (3) |
|
Domain Name Service (DNS) |
|
|
74 | (1) |
|
Network Time Protocol (NTP) |
|
|
75 | (1) |
|
Network Time Security (NTS) |
|
|
75 | (1) |
|
|
75 | (1) |
|
|
76 | (1) |
|
|
77 | (3) |
|
|
78 | (1) |
|
Web Application Firewall (WAF) |
|
|
78 | (1) |
|
Application Delivery Controller (ADC) |
|
|
79 | (1) |
|
Intrusion Protection System (IPS)/Intrusion Detection System (IDS) |
|
|
79 | (1) |
|
Data Loss Prevention (DLP) |
|
|
79 | (1) |
|
Network Access Control (NAC) |
|
|
79 | (1) |
|
|
80 | (1) |
|
|
80 | (1) |
|
|
80 | (1) |
|
Hardening and Configuration Changes |
|
|
81 | (5) |
|
Disabling Unnecessary Ports and Services |
|
|
81 | (1) |
|
Disabling Weak Protocols and Ciphers |
|
|
81 | (1) |
|
|
82 | (1) |
|
Control Ingress and Egress Traffic |
|
|
82 | (2) |
|
Distributed Denial-of-Service (DDoS) Protection |
|
|
84 | (2) |
|
|
86 | (1) |
Chapter 7 OS and Application Security Controls |
|
87 | (16) |
|
|
88 | (2) |
|
|
88 | (1) |
|
|
89 | (1) |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
90 | (1) |
|
|
90 | (3) |
|
Antivirus/Antimalware/Endpoint Detection and Response (EDR) |
|
|
93 | (1) |
|
Host-Based IDS (HIDS)/Host-Based IPS (HIPS) |
|
|
94 | (1) |
|
|
94 | (2) |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
96 | (1) |
|
|
96 | (1) |
|
|
96 | (2) |
|
|
96 | (1) |
|
|
97 | (1) |
|
|
97 | (1) |
|
|
97 | (1) |
|
Operating System (OS) Upgrades |
|
|
98 | (1) |
|
|
98 | (1) |
|
Application Programming Interface (API) Endpoint |
|
|
98 | (1) |
|
|
98 | (1) |
|
|
98 | (1) |
|
|
98 | (1) |
|
|
99 | (1) |
|
|
99 | (1) |
|
|
100 | (1) |
|
|
101 | (2) |
Chapter 8 Data Security and Compliance Controls in Cloud Environments |
|
103 | (12) |
|
|
104 | (1) |
|
|
105 | (2) |
|
|
105 | (1) |
|
|
106 | (1) |
|
File Integrity Monitoring (FIM) |
|
|
106 | (1) |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
108 | (1) |
|
Impact of Laws and Regulations |
|
|
109 | (1) |
|
|
109 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
|
110 | (1) |
|
Data Loss Prevention (DLP) |
|
|
111 | (1) |
|
Cloud Access Security Broker (CASB) |
|
|
111 | (2) |
|
|
113 | (2) |
Chapter 9 Security Requirements |
|
115 | (8) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
Default and Common Credential Scans |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
Service Availabilities Scans |
|
|
118 | (1) |
|
|
118 | (2) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
119 | (1) |
|
|
120 | (1) |
|
|
120 | (1) |
|
Prioritization of Patch Applications |
|
|
120 | (1) |
|
Deactivate Default Accounts |
|
|
120 | (1) |
|
Impacts of Security Tools on Systems and Services |
|
|
121 | (1) |
|
|
122 | (1) |
Chapter 10 Incident Response Procedures |
|
123 | (12) |
|
|
124 | (6) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
126 | (1) |
|
Documented Incident Types/Categories |
|
|
127 | (1) |
|
Roles and Responsibilities |
|
|
128 | (2) |
|
Incident Response Procedures |
|
|
130 | (4) |
|
|
130 | (1) |
|
Containment, Eradication, and Recovery |
|
|
131 | (1) |
|
Postincident and Lessons Learned |
|
|
132 | (2) |
|
|
134 | (1) |
Chapter 11 Integrate Components into a Cloud Solution |
|
135 | (14) |
|
|
136 | (4) |
|
|
137 | (1) |
|
|
137 | (1) |
|
|
138 | (1) |
|
Virtual Desktop Infrastructure (VDI) |
|
|
138 | (1) |
|
Directory and Identity Services |
|
|
139 | (1) |
|
|
139 | (1) |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
140 | (1) |
|
|
140 | (2) |
|
|
141 | (1) |
|
|
141 | (1) |
|
|
142 | (1) |
|
|
142 | (1) |
|
|
143 | (1) |
|
Deploying Virtual Machines (VMs) and Custom Images |
|
|
143 | (1) |
|
|
143 | (2) |
|
|
143 | (1) |
|
|
144 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
146 | (1) |
|
|
146 | (1) |
|
Postdeployment Validation |
|
|
146 | (2) |
|
|
148 | (1) |
Chapter 12 Storage in Cloud Environments |
|
149 | (16) |
|
|
150 | (2) |
|
|
150 | (1) |
|
|
151 | (1) |
|
|
151 | (1) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
152 | (1) |
|
|
152 | (1) |
|
Input/Output Operations per Second (LOPS) and Read/Write |
|
|
153 | (1) |
|
|
154 | (3) |
|
Network File System (NFS) |
|
|
154 | (1) |
|
Common Internet File System (CIFS) |
|
|
155 | (1) |
|
Internet Small Computer System Interface (iSCSI) |
|
|
155 | (1) |
|
|
156 | (1) |
|
Non-Volatile Memory Express over Fabrics (NVMe-oF) |
|
|
156 | (1) |
|
Redundant Array of Inexpensive Disks (RAID) |
|
|
157 | (2) |
|
|
157 | (1) |
|
|
158 | (1) |
|
|
158 | (1) |
|
|
159 | (1) |
|
|
159 | (1) |
|
|
159 | (2) |
|
|
160 | (1) |
|
|
160 | (1) |
|
|
160 | (1) |
|
|
161 | (1) |
|
|
161 | (1) |
|
|
161 | (1) |
|
|
161 | (1) |
|
Software-Defined Storage (SDS) |
|
|
162 | (1) |
|
|
163 | (2) |
Chapter 13 Cloud Networking Solutions |
|
165 | (16) |
|
|
166 | (4) |
|
Dynamic Host Configuration Protocol (DHCP) |
|
|
166 | (1) |
|
Network Time Protocol (NTP) |
|
|
166 | (1) |
|
Domain Name Service (DNS) |
|
|
167 | (2) |
|
Content Delivery Network (CDN) |
|
|
169 | (1) |
|
IP Address Management (IPAM) |
|
|
170 | (1) |
|
Virtual Private Networks (VPNs) |
|
|
170 | (1) |
|
|
170 | (1) |
|
|
171 | (1) |
|
|
171 | (1) |
|
|
171 | (1) |
|
Multiprotocol Label Switching (MPLS) |
|
|
171 | (1) |
|
|
171 | (5) |
|
Dynamic and Static Routing |
|
|
172 | (1) |
|
Virtual Network Interface Controller (vNIC) |
|
|
172 | (1) |
|
|
172 | (4) |
|
|
176 | (1) |
|
|
176 | (1) |
|
|
177 | (1) |
|
Virtual Private Cloud (VPC) |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
178 | (1) |
|
|
178 | (1) |
|
Single Root Input/Output Virtualization (SR-IOV) |
|
|
179 | (1) |
|
Software-Defined Network (SDN) |
|
|
179 | (1) |
|
|
180 | (1) |
Chapter 14 Compute Sizing for a Deployment |
|
181 | (12) |
|
|
182 | (3) |
|
|
182 | (2) |
|
Simultaneous Multithreading (SMT) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
185 | (1) |
|
Central Processing Unit (CPU)/Virtual CPU (vCPU) |
|
|
185 | (1) |
|
Graphics Processing Unit (GPU) |
|
|
186 | (1) |
|
|
186 | (1) |
|
|
186 | (1) |
|
Clock Speed/Instructions per Cycle (IPC) |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
188 | (3) |
|
|
189 | (1) |
|
|
189 | (2) |
|
|
191 | (2) |
Chapter 15 Cloud Migrations |
|
193 | (12) |
|
Physical to Virtual (P2V) |
|
|
194 | (1) |
|
|
195 | (1) |
|
Cloud-to-Cloud Migrations |
|
|
196 | (2) |
|
|
196 | (1) |
|
|
196 | (2) |
|
|
198 | (2) |
|
|
199 | (1) |
|
|
199 | (1) |
|
|
200 | (1) |
|
|
200 | (3) |
|
|
201 | (1) |
|
|
201 | (2) |
|
|
203 | (2) |
Chapter 16 Logging, Monitoring, and Alerting |
|
205 | (12) |
|
|
206 | (3) |
|
|
206 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
208 | (1) |
|
|
208 | (1) |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
209 | (5) |
|
|
210 | (1) |
|
|
210 | (1) |
|
|
210 | (1) |
|
|
211 | (1) |
|
|
211 | (1) |
|
|
212 | (1) |
|
|
212 | (1) |
|
Verification of Continuous Monitoring Activities |
|
|
213 | (1) |
|
Service Management Tool Integration |
|
|
213 | (1) |
|
|
214 | (2) |
|
|
214 | (1) |
|
|
214 | (1) |
|
|
214 | (1) |
|
Policies for Categorizing and Communicating Alerts |
|
|
215 | (1) |
|
|
216 | (1) |
Chapter 17 Operation of a Cloud Environment |
|
217 | (18) |
|
Confirm Completion of Backups |
|
|
218 | (1) |
|
|
218 | (2) |
|
|
218 | (1) |
|
|
219 | (1) |
|
Upgrading and Migrating Systems |
|
|
219 | (1) |
|
Deprecations or End of Life |
|
|
220 | (1) |
|
|
220 | (1) |
|
|
220 | (1) |
|
Configuration Management Database (CMDB) |
|
|
221 | (1) |
|
|
221 | (5) |
|
|
221 | (1) |
|
Fixes for Broken or Critical Infrastructure or Applications |
|
|
222 | (1) |
|
Scope of Cloud Elements to Be Patched |
|
|
222 | (2) |
|
|
224 | (1) |
|
|
225 | (1) |
|
|
225 | (1) |
|
Impacts of Process Improvements on Systems |
|
|
226 | (1) |
|
|
226 | (2) |
|
|
226 | (1) |
|
|
227 | (1) |
|
|
227 | (1) |
|
|
227 | (1) |
|
Development/QA/Production/DR |
|
|
227 | (1) |
|
|
228 | (6) |
|
|
229 | (1) |
|
|
229 | (2) |
|
|
231 | (1) |
|
|
231 | (1) |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
232 | (1) |
|
|
232 | (1) |
|
|
233 | (1) |
|
|
233 | (1) |
|
|
234 | (1) |
Chapter 18 Optimize Cloud Environments |
|
235 | (12) |
|
|
236 | (1) |
|
|
236 | (1) |
|
|
237 | (5) |
|
|
237 | (2) |
|
Network Interface Controllers (NICs) |
|
|
239 | (1) |
|
|
240 | (1) |
|
Software-Defined Networks (SDNs) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
242 | (1) |
|
|
242 | (1) |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
Device Drivers and Firmware |
|
|
243 | (3) |
|
|
244 | (1) |
|
|
244 | (1) |
|
|
245 | (1) |
|
|
246 | (1) |
Chapter 19 Automation and Orchestration Techniques |
|
247 | (12) |
|
Infrastructure as Code (IaC) |
|
|
248 | (1) |
|
Infrastructure Components and Their Integration |
|
|
249 | (1) |
|
Continuous Integration/Continuous Deployment (Cl/CD) |
|
|
249 | (1) |
|
|
250 | (1) |
|
|
251 | (1) |
|
|
252 | (1) |
|
|
252 | (1) |
|
|
252 | (2) |
|
|
253 | (1) |
|
|
253 | (1) |
|
|
253 | (1) |
|
|
254 | (1) |
|
|
254 | (1) |
|
|
254 | (1) |
|
|
254 | (1) |
|
|
255 | (1) |
|
Use of Individual Service Accounts |
|
|
255 | (1) |
|
|
255 | (1) |
|
|
255 | (1) |
|
|
255 | (2) |
|
|
257 | (2) |
Chapter 20 Backup and Restore Operations |
|
259 | (14) |
|
|
260 | (3) |
|
|
260 | (1) |
|
|
261 | (1) |
|
|
261 | (1) |
|
|
262 | (1) |
|
|
262 | (1) |
|
|
263 | (2) |
|
|
263 | (1) |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
265 | (1) |
|
|
265 | (1) |
|
|
265 | (1) |
|
|
266 | (1) |
|
Backup and Restore Policies |
|
|
266 | (3) |
|
|
266 | (1) |
|
|
267 | (1) |
|
|
267 | (1) |
|
Service-Level Agreements (SLAB) |
|
|
268 | (1) |
|
Recovery Time Objective (RTO) |
|
|
268 | (1) |
|
Recovery Point Objective (RPO) |
|
|
268 | (1) |
|
Mean Time to Recovery (MTTR) |
|
|
269 | (1) |
|
|
269 | (1) |
|
|
269 | (3) |
|
|
269 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
|
270 | (2) |
|
|
272 | (1) |
Chapter 21 Disaster Recovery Tasks |
|
273 | (8) |
|
|
274 | (1) |
|
|
274 | (1) |
|
|
275 | (1) |
|
|
275 | (1) |
|
On-Premises and Cloud Sites |
|
|
275 | (2) |
|
|
275 | (1) |
|
|
276 | (1) |
|
|
276 | (1) |
|
|
277 | (1) |
|
|
277 | (1) |
|
|
277 | (2) |
|
|
278 | (1) |
|
|
278 | (1) |
|
|
278 | (1) |
|
Geographical Data Center Requirements |
|
|
279 | (1) |
|
|
280 | (1) |
Chapter 22 Troubleshooting Methodology |
|
281 | (8) |
|
Always Consider Corporate Policies, Procedures, and Impacts Before Implementing Changes |
|
|
282 | (6) |
|
|
283 | (1) |
|
2 Establish a Theory of Probable Cause (Question the Obvious) |
|
|
284 | (1) |
|
3 Test the Theory to Determine Cause |
|
|
285 | (1) |
|
4 Establish a Plan of Action to Resolve the Problem and Implement the Solution |
|
|
285 | (1) |
|
5 Verify Full System Functionality and, if Applicable, Implement Preventive Measures |
|
|
286 | (1) |
|
6 Document the Findings, Actions, and Outcomes Throughout the Process |
|
|
286 | (2) |
|
|
288 | (1) |
Chapter 23 Troubleshoot Security Issues |
|
289 | (12) |
|
|
290 | (1) |
|
|
290 | (1) |
|
|
290 | (1) |
|
|
291 | (1) |
|
|
291 | (1) |
|
|
291 | (1) |
|
|
292 | (1) |
|
|
293 | (1) |
|
|
293 | (1) |
|
Directory Security Groups |
|
|
294 | (1) |
|
|
294 | (1) |
|
|
294 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
|
295 | (1) |
|
Misconfigured or Misapplied Policies |
|
|
295 | (1) |
|
|
296 | (1) |
|
|
296 | (1) |
|
|
296 | (1) |
|
|
296 | (1) |
|
Lack of Encryption in Protocols |
|
|
296 | (1) |
|
|
297 | (1) |
|
|
297 | (1) |
|
Misconfigured or Failed Security Appliances |
|
|
298 | (1) |
|
|
298 | (1) |
|
External/Internal Attacks |
|
|
298 | (2) |
|
|
300 | (1) |
Chapter 24 Troubleshoot Deployment, Automation, and Orchestration Issues |
|
301 | (16) |
|
|
302 | (2) |
|
Cloud Service Provider (CSP) or Internet Service Provider (ISP) Outages |
|
|
302 | (2) |
|
|
304 | (1) |
|
|
304 | (1) |
|
|
305 | (1) |
|
|
305 | (1) |
|
Applications in Containers |
|
|
306 | (1) |
|
|
306 | (1) |
|
Missing or Incorrect Tags |
|
|
306 | (1) |
|
|
307 | (1) |
|
|
307 | (1) |
|
|
308 | (2) |
|
Migrations of Vendors or Platforms |
|
|
308 | (1) |
|
Integration of Vendors or Platforms |
|
|
308 | (1) |
|
|
308 | (1) |
|
|
309 | (1) |
|
|
310 | (1) |
|
Change Management Failures |
|
|
310 | (1) |
|
|
311 | (1) |
|
|
311 | (1) |
|
|
312 | (1) |
|
|
312 | (1) |
|
Automation Tool Incompatibility |
|
|
313 | (1) |
|
|
313 | (1) |
|
API Version Incompatibility |
|
|
314 | (1) |
|
|
314 | (1) |
|
|
315 | (1) |
|
|
316 | (1) |
Chapter 25 Troubleshoot Connectivity Issues and Common Performance Issues |
|
317 | (24) |
|
Network Security Group Misconfigurations |
|
|
318 | (1) |
|
Access Control Lists (ACLs) |
|
|
318 | (1) |
|
|
319 | (1) |
|
Common Networking Configuration Issues |
|
|
319 | (5) |
|
|
320 | (1) |
|
Incorrect Subnet, IP Address, and IP Space |
|
|
320 | (1) |
|
|
321 | (1) |
|
|
322 | (1) |
|
Network Address Translation (NAT) |
|
|
322 | (1) |
|
Load Balancers and DNS Records |
|
|
323 | (1) |
|
VLAN/VxLAN/GENEVE and Proxy |
|
|
324 | (1) |
|
Maximum Transmission Unit (MTU) |
|
|
324 | (1) |
|
|
324 | (1) |
|
Time Synchronization Issues |
|
|
324 | (1) |
|
Network Troubleshooting Tools |
|
|
324 | (12) |
|
|
325 | (1) |
|
|
325 | (1) |
|
|
326 | (1) |
|
|
326 | (2) |
|
|
328 | (2) |
|
|
330 | (2) |
|
|
332 | (1) |
|
|
332 | (1) |
|
|
333 | (1) |
|
|
334 | (1) |
|
|
335 | (1) |
|
|
336 | (1) |
|
|
336 | (1) |
|
|
337 | (1) |
|
|
337 | (1) |
|
|
337 | (1) |
|
Incorrectly Configured or Failed Load Balancing |
|
|
338 | (1) |
|
|
339 | (2) |
Glossary of Essential Terms and Components |
|
341 | (20) |
Index |
|
361 | |