certification

Note-to-self: SOC2 mapping to ISO27001

Just in case you get into SOC2 and want to know how to map it to existing information security implementation, whatever it may be, GDPR, ISO27001, NIST, … check this page

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/mappingsrelevanttothesocsuiteofservices.html

It includes:

These links have nice XLS format sheets, with a bidirectional comparison between the frameworks.

Info on SOC1/SOC2/SOC3

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html

SOC and SOX?

 SOC reports refer to an audit of internal controls to ensure data security, minimal waste, and shareholder confidence; SOX relates to government-issued record keeping and financial information disclosure standards law. In other words, one is about keeping information safe, and the other is about keeping corporations in check.

https://immedis.com/blog/what-are-the-key-differences-between-soc-and-sox/

https://www.logicgate.com/blog/a-comparison-of-soc-and-sox-compliance/

Also

https://linfordco.com/blog/soc-2-security-vs-iso-27001-certification/

(braindump article, still in progress)

CCSP and CCAK, not versus: build your cloud security expertise path based on your needs.

Last week (ISC)² published a blog post on the choice between CCSP and CCAK.

You can find it here: https://www.isc2.org/articles/CCSP-versus-csa-ccak.

“What is the right certification for you?”

The main title of the (ISC)² article on CCSP vs CCAK is “CCSP Certification vs. CCAK Certificate: What Are the Distinctions?”

That’s exactly what you get. A list of technical differentiators between CCSP and CCAK, but according to (ISC)².

But if you hope to get an actual answer to what the right certification is, for you… they forget to ask …you.

What do you think would be the conclusion, if you ask that question to either one of the contestants while you compare 2 certifications? Of course each party will simply draw the conclusion that their own certification is the best choice.

To answer the most important question, the dilemma CCSP or CCAK, is simple: do you need technical or audit skills for cloud security?

The answer

In essence, the answer is simple:

  • if you need cloud audit skills, dive in to the Cloud Security Alliance (CSA) and ISACA Certificate CCAK.
  • if you want to have architect level technical cloud expertise and knowledge, choose CCSP
  • if you want cloud security knowledge, in basic or advanced hands-on, there are other choices to start with (more about it below)

So, if you ask the question “what is the right certification for you”, you immediately know that there is no right answer, but there are many options.
Options for a multi level expertise roadmap in cloud security, based on your current skills and your future goals.

If you like a tough challenge: why not jump into the CCAK or CCSP, CCSP or CCAK, whatever, right away.

But if you would like to boost your chance of success… take a deep breath and better plan smartly.

And don’t start with CCSP/CCAK, but prepare your track towards CCSP/CCAK first.

First some background to plan your roadmap

Setting expectations

Just to set expectations, this article only focuses on the personal education and certification options, offered by (ISC)², ISACA and CSA. Including other education provider would lead us too far.
There are way more other (cyber)security certifications available, but we focus on the cloud security track, which limits the options…

Feel free to comment with other options for cloud security training. I’ll update the article where relevant.

CSA CCSK

The Cloud Security Alliance launched the CCSK in 2011. And as they explained here, “the CCSK was quite literally the industry’s first examination of cloud security knowledge when it was released back in 2011. “

The CCSK is an easy entry, high level introduction to Cloud Security, and it doesn’t require you to have deep technical cloud security expertise.

But it still is a nice baseline for the cloud security essential knowledge.

(ISC)² – CCSP

In short: CCSP = CISSP [by (ISC)²]+ CCSK [by CSA]

The long version is explained in the (ISC)² article comparing CCSP and CCAK.

  • CCSP = Certified Cloud Security Professional
  • You need at least five years of cumulative, paid work experience
  • CCSP is pretty much the same level of difficulty as CISSP, but has focus on cloud security.

The CCSP was launched in 2015, as a cooperation between (ISC)² and CSA. (see CSA press release here), a couple years after the CCSK launch in 2011.
The CCSP is the bigger brother of the CCSK, more advanced, and as CSA rightfully mentions in there CCSK-CCSP comparison blog, the CCSP is on the level of CISSP with a major cloud flavor.

That’s where the dummy math description comes from…

CCSP = CISSP + CCSK.

But CCSP certainly is not an entry level exam.

More information:

ISACA & CSA – CCAK

CCAK = CISA [ISACA] + CCSK [CSA]

CCAK (Certificate of Cloud Auditing Knowledge) is cohosted by ISACA and CSA.
And then you immediately know the approach is different than the approach of (ISC)².

ISACA (Previously known as the Information Systems Audit and Control Association®) stems from audit.
CSA focuses on cloud security.

That’s exactly what CCAK is about : cloud security audit.

See here:

As ISACA mentions on their product page: “The Industry’s First Global Cloud Auditing Credential”.

CISSP

For completeness, I mentioned the CISSP ( Certified Information Systems Security Professional).
I don’t think it needs a lot of explanation, it’s pretty much the reference standard for IT Systems security. (ISC)² references it as “The World’s Premier Cybersecurity Certification”.

It’s a pretty heavy exam, and it does require at least 5 years professional security experience. This is not an entry level exam.

More info: https://www.isc2.org/Certifications/CISSP

SSCP (Systems Security Certified Practitioner)

Due to the experience requirements, CISSP might be a tough credential to start with, although you can pass the exam, and continue to build your experience to grab the CISSP title…

If you want the plan your credentials the smart way, or you’re fresh in cyber-, information or IT-security, you better start with SSCP.

That the little brother of CISSP, and it’s an excellent way to step up to CISSP. More info: https://www.isc2.org/Certifications/SSCP

Where to start?

Cybersecurity & Information security essentials

As explained earlier, for tech skills in cyber-, IT and information security: look into SSCP first.

(Then step up to CISSP.)

Cloud security essentials: CCSK

Now it’s obvious what your first step in cloud security education should be: CCSK.

The CCSK is the perfect introduction to cloud security essentials.

Although it’s very helpful to have some technical IT basic knowledge, the CCSK is very accessible for general audience.

To prepare for the CCSK, you can follow classes or self-study via a completely free preparation toolkit.

Source: CSA CCSK v4 exam (https://cloudsecurityalliance.org/artifacts/ccskv4-exam-prep-kit/)

You can buy a double-try access ticket for the CCSK online exam (60 questions, 90 minutes), so if you would fail the first attempt, study again and retry the exam.

Then plan your track: only technical (no interest for audit) or audit, or both

Only technical

If you focus on technical expertise in cloud security, CCSP is a reference standard (at least, on of them…) .

As mentioned: CCSP = CISSP + CCSK.

So the track is clear

  • After passing the CCSK exam,
  • Take the CISSP exam
  • then take the CCSP

This is the easier route if you already have 5yr+ experience. It’s not the cheapest route, as you pass the CISSP first, but it’s worth the effort. (you only need to pay 1 yearly fee at (ISC)², so after 1 certification, … no extra cost in yearly membership fee)
For junior, less experienced, security engineers, start with SSCP before jumping into CISSP, and then CCSP.

Audit

When you target IT security audits, you need to take a different route depending your background.
Having the CCSP/CISSP background is extremely useful to boost your career in audit.

But for the CCAK, the core audit baseline is CISA.

Keep in mind, similar to CISSP and CCSP, CISA has the same requirements regards professional experience, 5 years.

But if you’re a ISACA CISA, you can add CCSK to the track and land on the CCAK.

Both?

Then it’s obvious, first tech, then audit, meaning a smart combination of

  1. CCSK
  2. (SSCP > ) CISSP
  3. CCSP
  4. CISA (or alternative)
  5. CCAK

Alternative routes

ISO27001 Implementer & Auditor

And alternative route to the auditing experience is ISO27001 auditing, but you’ll need some implementation experience before you can audit.

CISM

Within the ISACA portfolio, the CISM (Certified Information Security Manager), covers the same areas as most ISO27001 (lead) implementer courses.

Which can be helpful to ramp up for the CISA audit part, to gain some hands-on in IT & Infosec governance.

Visualizing your cloud security education roadmap

Lots of blah for a simple choice?

Allow me to visualize the options…

The difference between “certification” and “certificate”, does it really matter?

In it’s blog post (ISC)² tries to put CCSP above CCAK by saying “CCSP is a certification; CCAK is a certificate.”

And they continue “A certification recognizes a candidate’s knowledge, skills, and abilities, typically framed by a job role, while a certificate’s scope is narrower and only documents training course completion. A certification often requires continuing professional education (CPE) to stay in front of trends, while a certificate’s body of knowledge does not evolve over time or require CPE credits to maintain.

And their explanation is at least flawed and cutting corners to benefit CCSP.

There are many explanations and interpretations of “certification”, depending the context.
But in essence, “certification” is a process and a certificate is a document (the result).

When you certify for “CCSP” at (ISC)², you need to comply with the CCSP condition and then get a document, your CCSP certificate.
Idem for CCAK, you need to comply with their conditions.

Both the certification process for CCSP as the process for the CCAK are used by other similar education providers.

Eg, PECB, ISACA, EC-COUNCIL, … and others require to pay a yearly fee, keep CPE/CPD (continous professional education or development). Some yearly fees are cheaper as others.

Like CSA, Microsoft and others ask for a 1 time exam fee, and then update the exam on longer term, not yearly, and do not require a yearly maintenance fee.

It’s a choice of the certificate owner, how the evaluation and exams are done.

Some of them comply to the ISO17024, and education standard. There are huge benefits to comply (like increased credibility, compatibility with other certifications, …). But it’s not mandatory.

(ISC)² uses an exam, with experience requirement and continuous education once you pass the exam, but you do not need to pass the exam again, unless it’s upgraded to a new build or major version.

But CSA does exactly the same, for example when CCSK was upgraded from v3 to v4, you needed to pass the exam again.

Not on a yearly basis, but the program is updated, the exam is updated… on a regular basis, without yearly fee.

It’s rather a (small) financial effort, not of significance for most companies paying the bill. (Although as an individual, the cost of certification can become a serious burden…)

And it’s certainly not relevant when choosing between CCSP and CCAK. CCAK is cheaper, as referenced in the (ISC)² comparison chart.

References

(ISC)²: CCSP Certification vs. CCAK Certificate: What Are the Distinctions?

Cloud Security Alliance (CSA)

CSA Certificate of Cloud Security Knowledge (CCSK)

CSA & ISACA CCAK

CCAK learning material

CCSK vs CCSP

Vocabulary (alphabetical)

CCAK: Certificate of Cloud Auditing Knowledge (https://cloudsecurityalliance.org/education/ccak/)

CCSK: Certificate of Cloud Security Knowledge (https://cloudsecurityalliance.org/education/ccsk/)

CCSP: Certified Cloud Security Professional (https://www.isc2.org/Certifications/CCSP)

CSA: Cloud Security Alliance (https://cloudsecurityalliance.org/)

(ISC)²:  International Information System Security Certification Consortium (https://www.isc2.org/)

PECB MS : Building your data protection foundation by using the ISO/IEC 27701 core components

I had a great opportunity working with PECB MS, writing an article on building a #dataprotection foundation, using #ISO27701,.. perfectly fit for small business #SMB/#smebusiness.

Your data protection is a very strong #marketing tool to become the #trustedpartner of your customers.

No doubt: Get started! Doing nothing will cost you.

You can find the article over here:

Enjoy!

And even better, get in touch if you want to have a chat building your data protection.

Free (ISC)² Exams flash cards all in one place (*)

(*) with respect for your privacy, no login, nor mail required for

CISSP

CSSLP

CCSP

SSCP

CAP

HCISSP

Sorry, (free) registration still required for:

CISSP-ISSAP:https://enroll.isc2.org/product?catalog=CISSP-ISSAP-FC

CISSP-ISSEP: https://enroll.isc2.org/product?catalog=CISSP-ISSEP-FC

CISSP-ISSMP:https://enroll.isc2.org/product?catalog=ISSMP-FC-2019

Signing a PDF with Belgian eID – step-by-step for beginners (a bit more then what they tell you on the official page)

On the website for the Belgian eID, you can find some basic hints & tips to sign PDF documents with the Belgian identity card and the Acrobat reader application….

But there are other PDF applications than Acrobat Reader DC and the guide on the eID signing doesn’t detail the prerequisites in the signing manual to make it work.

Technical tip: the tech prerequisites and how to validate them are explained in the technical manual (over here: https://eid.belgium.be/nl/technische-documentatie#7389)

Acrobat Reader DC may be the most prominent PDF reader, it’s certainly not the only one and certainly not the most performant one.

Furthermore, the document signing in Acrobat Reader is pretty confusing as you must select the “Certificates” module and NOT “Fill & Sign”.

Difference between Authentication & Signing

When you, as verified user, want to put a digital signature on documents, this is called “signing”, confirming the document content.

In this circumstances, the “authentication” part is not relevant. Authentication is used to prove your identity.

For your information: the Belgian eID is NOT designed to provide encryption (which is the 3rd option to use a certificate). So you cannot use the BE eID for encryption of documents, sadly enough.

More info (NL, also EN version available): https://eid.belgium.be/nl/aanmelden-met-eid#7559 (EN, https://eid.belgium.be/en/log-eid#7559)

Prerequisites

Certificates in user certificate store

You need to have the user certificates installed on your user account on the local pc (actually the personal user certificate store) to make the document signing work in the applications.

If you haven’t used the eID certificates before, or in the case of a new computer, you’ll need to install the user certificates on your computer.
The easiest and official way to install them, is using the eID viewer application.

eID Software

Note on Language

The eID website is supporting NL, FR, DE and EN as language, I’ll only refer to NL and EN as main languages but FR and DE are supported too.

Download

Download and install the eID software from this source: https://eid.belgium.be/nl (for NL. Also available: EN, FR and DE).
It includes the eID middleware and the eID viewer we’ll use to read and install the eID certificaties on your computer (actually your user account).

Install

The manual to install the eID software is here:

(NL) https://eid.belgium.be/nl/hoe-installeer-ik-de-eid-software

(EN) https://eid.belgium.be/en/technical-documentation

Verifying the presence of the user certificates (Signing)

When you use the certificates and/or the eID software, the certificates should be installed in the user certificates store automatically, but that is not always the case, depending the configuration and security of your computer.

Technical hint: there is a “Certificate Propagation Service” troubleshooting article on the eID website that helps you: https://eid.belgium.be/nl/technische-documentatie#7256

To sign PDF documents with a certificate, most PDF readers will check for certificates in the user certificate store on the local computer, not directly from the card reader.

Steps

1. MMC

Via the Windows button, run the mmc (Microsoft Management Console), you’ll need to run it in elevated mode (so consent the UAC popup)

2. Add snap in : Certificates

Via menu “File”, “Add/Remove Snap-in”, add the “Certificates” snap in.
Choose “My User Account” (as the eID certificates are injected in your user account, not your computer or service account)

Finish and click ok.

3. Open the personal certificate store

In the “certificates – current user” > Personal > Certificates, check the list of certificates available.

You should see something like:

If ok, then you’re ready to sign documents, using eID.

If NOT, then you’ll need to add the certificates manually.

Manual installation of the eID certs

1. Insert your eID

Attach a supported card reader and insert your eID smart card.

2. open the eID viewer > Certificates tab

Right click the “Signature” certificate (you can do the same for the Authentication certificate. Select “Detailed Information”.

Then, click the “install certificate…” button:

Then run the default option steps: click next, next next … next… finish.

Import the certificate to the current user certificate store

Click Finish and you should be set to go for signing documents.

Signing PDF docs

Adobe Acrobat DC

This is explained on the eID website:

(NL) https://eid.belgium.be/nl/digitale-handtekeningen#7261

(EN) https://eid.belgium.be/en/digital-signatures#7261

IMPORTANT

Select the “Certificates” module and NOT “Fill & Sign”.

The “Fill and Sign” is used for graphical signatures, replacing the manual signing of paper copies, and eliminates the need of rescanning.

eID is a “qualified” and legally support signature.

If your counterpart (the other signing party) doesn’t require a qualified signature, this is a good alternative for eID (as there is some sensitive data like social security number, incl birthday and gender mentioned in the eID signature)

Foxit PDF

Open the PDF file you want to sign.

Verify the presence of the Signature certificate

It should be popping up from the certificate store, which we fixed earlier. (if not present, go back and fix it)

Signing a document

When the certificate is correctly installed, go to the “Protect” menu, then click the “Sign & certify” button in the ribbon.

Then drag an area to mark a signing area and choose the signature options.

Done!

References

Digitale handtekeningen:

(NL) https://eid.belgium.be/nl/digitale-handtekeningen

(EN) https://eid.belgium.be/en/digital-signatures

And also

Add or remove a digital signature in Office files: https://support.microsoft.com/en-us/office/add-or-remove-a-digital-signature-in-office-files-70d26dc9-be10-46f1-8efa-719c8b3f1a2d

Last update:2020-12-28

Useful GDPR resources (Working doc)

Certification

IAPP article: 4 GDPR-certification myths dispelled (EN)

EDPB (European Data protection Board)

GDPR docs: https://edpb.europa.eu/node/28

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation – version adopted after public consultation

ENISA

Interplay between standardisation and the General Data Protection Regulation: https://www.enisa.europa.eu/events/enisa-cscg-2017/presentations/kamara

Recommendations on European Data Protection Certification

 

 

Note-to-self: CCSK vs CCSP

Just for easy, future reference… the difference between CSA CCSK and (ISC)² CCSP, quickly explained:

https://blog.cloudsecurityalliance.org/2018/04/24/ccsk-vs-ccsp-unbiased-comparison/

http://www.confidis.co/cloud-security-certifications-ccsk-vs-ccsp/

 

CCSK – DOMAIN 4 (Compliance and Audit Management) reference material

CCSK

Preparation tool kit (with registration): https://cloudsecurityalliance.org/artifacts/ccskv4_exam_prep_kit

Separate downloads:

(ISC)² Belux Chapter

2019-04-04 meeting presentation on CCSP-CCSK

ISC2-Belux-Chapter-20190404-Event

Additional Reading

PCI-DSS

Download PCI-DSS  without registration: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf

Documentation library: https://www.pcisecuritystandards.org/document_library

SOC1/SOC2/SOC3

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html

Microsoft Azure – Cloud Security Compliance (Trust center)

https://www.microsoft.com/en-us/trustcenter/compliance/compliance-overview

Documents download: https://servicetrust.microsoft.com/ViewPage/MSComplianceGuideV3

https://servicetrust.microsoft.com/ViewPage/MSComplianceGuide

Regional & country compliance: https://www.microsoft.com/en-us/trustcenter/compliance/regional-country-compliance

Google Cloud Security Compliance

Google Cloud security compliance – general

ISO27001: https://cloud.google.com/security/compliance/iso-27001/

CSA STAR

ISO Standards

ISO27001

ISO27002

ISO27017 (Cloud security)

ISO27018 (Personal data)

ISO27032 (Cybersecurity)

CSA STAR

https://cloudsecurityalliance.org/star/#_overview

Other

Interesting collection of documents & references on compliance and standards: here,  including, HIPAA, PCI-DSS, ISO27001/27002, …

 

 

 

Note-to-self: prepping for CSA CCSK v4 upgrade

Note-to-self: extended reprint of a LinkedIn post…

I might have mentioned it already, but if you have passed the CCSK exam before, better logon to your CCSK profile on the CSA website and check if you still have an exam token left.

By default you get 2 tokens each exam registration, so…

If you pass your exam the first time, the “second try” backup token is left unused in your profile.

And (if not yet expired) you can use it to upgrade your CCSK to v4.

Tokens stay valid for 2 years after purchase.

More info: https://ccsk.cloudsecurityalliance.org/en/faq

On that page you can also find the required study material for the exam.

You can download the CCSK v4 prep kit from : https://downloads.cloudsecurityalliance.org/ccsk/CCSKv4_Exam_Preparation_Kit.zip

It’s an online exam and thus open book exam, using the below reference guides.

But realise:  60 questions in 90 minutes still is hard work, so better do some prep work up front to maximize your chances.

Once you pass this one, you can go for the (ISC)² CCSP with more confidence…