Why it’s not appropriate to ask for a copy of the identity card by default and systematically before you respond to a #GDPR data access request?

The EDPB guidelines on the data subject’s rights of access contain 60 pages of very useful instructions. This article is not elaborating all of it, but only highlights the topics relative to the use of ID card photocopies, as there has been a recent case at the Belgian Data Protection Authority strongly referring to the data access request guidelines by the European Data Protection board (EDPB).

Background

In a recent publication of a case (DOS-2020-05314), the Belgian Data protection Authority decided to classify the complaint itself without any consequences, but they explicitly confirmed that the use of a photocopy of the ID card is a very bad idea in general.

A very clear reminder that you shall not systematically request a copy of the identity card

In the motivation of the case it sets a very clear reminder that it’s considered illegal to systematically request for a copy of an identity card as a condition to respond to a GDPR data access request, in accordance with the EDPB (European Data Protection Board) guidelines on the right to access.

Why is a copy of an ID card a bad idea?

The copy of the ID card contains a lot of sensitive data like your national number, that can be abused to harm you, by stealing your identity.
Using your identity data, people can open bank accounts and credits, steal your many, empty your existing bank account, … so the impact is very personal, very real and very high when your identity is stolen.

EDPB guidelines Guidelines 01/2022 on data subject rights – Right of access

The highlights

The EDPB explains in the executive overview of their guidelines that “The right of access of data subjects is enshrined in Arti. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR.

“There are no specific requirements on the format of a request. The controller should provide appropriate and user-friendly communication channels that can easily be used by the data subject.”

“The request for additional information must be proportionate to the type of data processed, the damage that could occur etc. in order to avoid excessive data collection.”

Do not excessively demand for personal data when validation of access request

In the guidelines, the EDPB says:

“65. /../ In general, the fact that the controller may request additional information to assess the data subject’s identity cannot lead to excessive demands and to the collection of personal data which are not relevant or necessary to strengthen the link between the individual and the personal data requested.”

Copy of ID card should generally not be considered an appropriate way of authentication

EDPB guideline:

74. Taking into account the fact, that many organisations (e.g. hotels, banks, car rentals) request copies of
their clients’ ID card, it should generally not be considered an appropriate way of authentication
.

Alternatively, the controller may implement a quick and effective security measure to identify a data subject who has been previously authenticated by the controller, e.g. via e-mail or text message containing confirmation links, security questions or confirmation codes.”

Information on the ID that is not necessary for confirming the identity should be hidden

EDPB guidine 75:
In any case, information on the ID that is not necessary for confirming the identity of the data subject,
such as the access and serial-number, nationality, size, eye colour, photo and machine-readable zone,
may be blackened or hidden
by the data subject before submitting it to the controller, except where
national legislation requires a full unredacted copy of the identity card (see para. 77 below).

Generally, the date of issue or expiry date, the issuing authority and the full name matching with the online
account are sufficient for the controller to verify the identity, always provided that the authenticity of
the copy and the relation to the applicant are ensured. Additional information such as the birth date
of the data subject may only be required in case the risk of mistaken identity persists, if the controller
is able to compare it with the information it already processes.

Inform about data minimization and apply it.

EDPB guideline 76.

“To follow the principle of data minimisation

the controller should inform the data subject about the information that is not needed and

about the possibility to blacken or hide those parts of the ID document.

In such a case, if the data subject does not know how or is not able to blacken such information, it is good practice for the controller to blacken it upon receipt of the document, if this is possible for the controller, taking into account the means available to the controller in the given circumstances.”

Making the information available in a commonly used electronic form

Following EDPB guideline, paragraph 32, the controller must provide the answer in a commonly used electronic form.

the event of a request by electronic form means, information shall be provided by electronic means
where possible and unless otherwise requested by the data subject
(see Art. 12(3)). Art. 15(3), third
sentence, complements this requirement in the context of access requests by stating, that the
controller is in addition obliged to provide the answer in a commonly used electronic form, unless
otherwise requested by the data subject
. Art. 15(3) presupposes, that for controllers who are able to
receive electronic requests it will be possible to provide the reply to the request in a commonly used
electronic form (e.g. in PDF). This provision refers to all the information that needs to be provided in
accordance with Art. 15(1) and (2). Therefore, if the data subject submits the request for access by
electronic means, all information must be provided in a commonly used electronic form.”

Some practical data protection life hacks

Protecting your identity card

  • keep your ID card in your pocket or wallet as much as possible.
  • do NOT hand over your identity card to any party, unless it’s a legal authority (police, … )
  • Quickly showing your ID card for validation is fine, but resist to the requests to get a copy of your card.
  • prepare to have a masked paper copy of your ID card,
    • make sure to hide all the irrelevant, sensitive information yourself
    • keep a paper copy in your wallet
  • Prepare a masked digital photo copy of your ID card, yourself.
  • mask all all the irrelevant, sensitive information on your identity card, do it yourself
    • eg, use tippex to wipe out info, but you can simply scratch tippex when an official authority needs to validate your sensitive information)
    • ‘accidental’ copies will still mask your data, and you can detect if an unauthorized party scratches your ID card

From a corporate perspective

  • Do not request copies of identity cards by default, there are many more practical means to verify identity in a secure way
  • Only authenticate ID cards, when there are no other options.
  • use electronic authentication without disclosure of sensitive data
  • use an alternative means of authentication, there are many ways to do this securely
  • do not keep a copy of any identity card, there are virtually NO reasons to keep a copy, quick validation is mostly enough
  • delete any copy of identity cards as soon as possible…

Reference information:

Note-to-self: CIS Controls v8 (2021-05)

No need to pay with your privacy to bypass the registration wall… (no need to accept cookies either)

CIS Controls v8 PDF

https://learn.cisecurity.org/l/799323/2021-05-18/47qgs

CIS Controls v8 Excel

https://learn.cisecurity.org/l/799323/2021-05-18/47qgv

v8 Change Log

https://learn.cisecurity.org/l/799323/2021-05-18/47qgz

Also available

Translations

Italian, Portuguese, Japanese, Spanish:

https://learn.cisecurity.org/control-download

Outlook: Set an automatic out-of-office message with Power automate

Credits

FEMKE CORNELISSEN

This article has been translated from the original Dutch version published by Femke Cornelissen in to English, with an explicit and upfront consent of Femke (find her on LinkedIn).

Original article in Dutch

You can find the original article here: https://femkecornelissen.com/2022/02/23/afwezigheid-automatisch-instellen-via-power-automate/.

Except from the original Dutch content, also some Dutch screenshots have been replaced with an English version. And some extra notes are added for clarity.

Additional information

Power Automate is part of M365 license. More information here: https://docs.microsoft.com/en-us/power-platform/admin/power-automate-licensing/types

Set an automatic out-of-office message with Power automate

You got a day off and you forgot to turn on your out-of-office (OOF) assistant in Outlook. Pretty recognizable, right?

With the out-of-office message, people who send you an email see that you are absent. But in addition, this is of course also reflected in Microsoft Teams. When you try to contact someone, there is a notification or you can recognize it by the presence icon of the profile picture in the chat.

It’s quite interesting that this process is quite easy to automate with Power Automate. When I’m OOF is set in my calendar, the next step (in this case, turn on absence) must be performed.

Shall we walk through it together?

Steps

You go to https://flow.microsoft.com/ where you land in (M365) Power Automate.

Then click the create button.

Opt for an automated cloud flow.  We’re going to make sure when something is on your calendar, something happens.

Create > Automated cloud flow

Choose a flow name (like for example “Automatic out of office”)

Define flow name

At the trigger, choose “When an upcoming event is starting soon (V3)” and then click Create.

Select: When an upcoming event is starting soon (V3)

When the flow is created, make sure your calendar is selected.

Select your calendar

Then click new step.

Choose “Condition” or find the option conditions and then select it.

Condition Selection

For example, the condition can be the triggers that indicate that you are free or unreachable.

[Note, this can be a certain word in the subject, or an event type. Femke’s example is using a marker word in the subject. ]

Set condition type and options

Then you have the following two options:

  • With YES you indication which actions must be executed.
  • At NO, nothing happens (in our case)
Yes/No condition options

We’re going to add an action to the “If yes” clause.

You choose the action “Set up automatc replies (V2)

Automatic replies

[Make sure to set the start and end date of your appointment, as this will set the OOF start and end time too…]

You can copy the following data, but of course make it a personal text.

[Note: a white line, or break line must be set in HTML tag <br>]

You can click save in the top right corner and you’re done!

Now you never have to turn on your absence again, but this happens automatically. Handy, right?

Credits & original article: https://femkecornelissen.com/2022/02/23/afwezigheid-automatisch-instellen-via-power-automate/ by FEMKE CORNELISSEN

Cadeautje! #MinistryofPrivacy Magazine n°3 – data brokers kweken nog steeds ongemerkt uw persoonlijke data

Afgelopen week werd het 3e nummer van het #MinistryofPrivacy gepubliceerd.

De nieuwe editie pakt opnieuw uit met interessante bijdragen van Ruben De Smet (met co-auteurs Thibaut Vandervelden, Kris Steenhaut en An Braeken), Koen Vervloesem, Arthur Zeeuw, Olivier Sustronck, Arno Jansen, Liesbet Demasure en mezelf.

In totaal 36 pagina’s artikels met volgende onderwerpen:

  • Voorwoord door Matthias Dobbelaere-Welvaert
  • End-to-end encryptie is niet het einde – Ruben De Smet
  • De Tandeloze Identiteit – Arthur Zeeuw
  • Hoe GDPR-conform is ‘The Squid Game’? – Olivier Sustronck
  • Voorstelling board member: Redona Ukshinaj
  • Pegasus in Europa. Een blijver? – Arno Jansen
  • Kort privacynieuws
  • GDPR killed the direct-marketing star- Peter Geelen
  • “Datamacht en tegenkracht” – Koen Vervloesem
  • Voorstelling board member: William Leemans
  • 2022, het jaar van cybersecurity. Niet? – Liesbet Demasure

Het magazine sluit af met een echte gloednieuwe cartoon van privacymakker Lectrr!

Leden kunnen het 3e nummer van het #MinistryofPrivacy lezen en ook downloaden.

Mijn artikel mag ik je alvast cadeau doen… download link onderaan dit artikel.

Korte samenvatting van m’n artikel

  • Bedrijfsdata, persoonlijke data of niet-persoonlijke data?
  • Wat is direct marketing?
  • Wat zijn data brokers?
  • Wat is het nadeel van het gebruik van onpersoonlijke bedrijfsdata voor data brokers?
  • Wat wordt er eigenlijk verwacht van een verwerkingsverantwoordelijke als ze persoonlijke data verzamelen?
  • En wat doen data brokers en direct marketing bedrijven in de praktijk?
  • Waarom is dat belangrijk voor jou?
  • Nog even wat praktische bedenkingen…
  • Wat kan (of moet) je nu zelf aan doen om misbruik tegen te gaan?

Referenties

Meer info over misbruik van KBO data voor direct marketing

Hoe zit dat met data brokers, direct marketing en KBO? Is dat legaal? En is dat nu GDPR of niet? Hoe aanpakken?

Download van m’n Ministry of Privacy artikel

Je kan m’n artikel alvast hier downloaden in PDF formaat om ‘t offline te lezen:

MoP Magazine nr 3 – Artikel Peter Geelen

Outlook troubleshooting: Outlook keeps prompting for password

Overview

Issue: when opening Outlook and afterwards on a regular intervals afterwards, Outlook keeps prompting for a password multiple times (x5 or more), even when the password is correct.

The error/connection message is sent to the desktop foreground on top of other applications.

Even when the password is ok, the message is thrown again multiple times, when the Outlook client is checking for mail, at certain intervals…

[Solution Spoiler = configure the registry to enable ExcludeExplicitO365Endpoint, but there might be other options for your case…]

Product version

In this specific situation, the products below were involved. The issue might also apply to other versions

  • Office version= Microsoft 365
  • Outlook version Microsoft® Outlook® for Microsoft 365 MSO (Version 2109 Build 16.0.14430.20224) 64-bit
  • Exchange server version 15.1.2308.4008. (on premises)

Additional information

Type of mailbox

In this case, the issue was related to connecting to a functional/shared mailbox.
Connection to the personal mailbox was working fine, at first sight.

Standalone vs Domain

In this particular case, the PC was not connected to the domain of the Exchange server.

But also important connection on Outlook from domain joined PC is ok, no reconnection message.
[More on this at the end of the article, as the domain client had specific GPO policies configured, …]

Multiple mail accounts

Outlook connected to multiple mail accounts (so removing Outlook completely, was not really an option…)

No issue on phone

Connecting the same account on a smartphone, works fine.

Symptoms

Error message

No explicit error message but you get a window with

“Windows security

Microsoft Outlook

Connecting to <… mailbox …>

Remember my credentials”

Error screen

Troubleshooting

Account credentials

WARNING:

you might end up with a locked user account if you enter the wrong credentials by accident while outlook keeps popping up the password request. Better double check your password and better NOT enter it again, or change it in the password request. But you’ll get this request multiple times in a few seconds, that it can be quite annoying to get past it.

Mail account

  • Tried to reinstall the mail account.
  • Removed the mail account and reinstalled mail account.

Configuration panel – Mail profile

Create a new Outlook profile (do NOT remove the existing Outlook profile) and add ONLY the problematic account. Set it to ONLINE mode (disable caching mode)

You can manage this option via Control Panel > mail

Alternatively, when reinstalling the mail account in outlook, disable the option “Use cached Exchange Mode to download email to an Outlook data file”.

Check Outlook connection status

When Outlook is active, you’ll find an Outlook icon in the task bar…

To check the Outlook connection status you need to hold the CTRL button and then right click on the Outlook icon.

Then click “Connection Status…”


Check if you see the personal mailbox and shared mailbox connection.

Test Email AutoConfiguration…

When Outlook is active, you’ll find an Outlook icon in the task bar…

To check the Outlook connection status you need to hold the CTRL button and then right click on the Outlook icon.

Then click “Test Email AutoConfiguration…”

In the menu enter the mail address of the target mailbox, in this case it’s a share mailbox with a specific mail address.

Very likely you’ll see a bunch of autodiscover failures like:

Alternative – Network analysis with Fiddler

You can collect a network log with Fiddler or other network sniffer

www.telerik.com

  1. Install Fiddler.
  2. Select decrypt https traffic
  1. Close fiddler
  2. Close all programs, messengers, browser etc.
  3. Start Fiddler
  4. Start Outlook and wait until problem comes up
  5. When problem appears STOP fiddler and close Outlook
  6. Check the log files and see if you can detect the issue.

Solution

Policy control via registry setting

Source: Outlook 2016 implementation of Autodiscover

This applies to 2016 2019 etc… as well.

The policy values that are defined the Autodiscover Process section can be either policy-based registry values or non–policy-based values.  When they are deployed through GPO, or manual configuration of the policies key, the settings take precedence over the non-policy key.
Non-Policy Key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover
Policy Key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\AutoDiscover

Each value is of type DWORD.

So to exclude Office365 checking point we add following key:

ExcludeExplicitO365Endpoint and set the value to 1.


This setting is registry for client only.
Outlook will skip checking Office365 Endpoint for Autodiscover.

If you have already configured XML autodiscover it should not affect the existing setting as the information are stored in this XML file locally anyway so Outlook will know how to connect.

Outlook as priority always prefer local XML configuration. Then in case it cannot obtain certain data goes to another check point. So apart from first two steps  Outlook 2016 implementation of Autodiscover (microsoft.com) there are checking points we can configure how Outlook should obtain certain information. We can disable them or force them.

You can give it a try if this won’t work as desired you can always revert the changes.

Always make a copy of your registry before you change anything in the registry.

There is no really any other way from the client perspective.

In our case we can see many redirections and autodiscover failures. Not sure why, looks like Outlook refers to some old data or old domain URLS or cannot obtain properly Autodiscover configuration file and it is trying different combinations to guess which link for Autodiscover is working.
Once it calls for HTTPS Autodiscover of the correct link it gets timeouts… which might also indicate firewall issue or something.

Then it tries unencrypted HTTP and it succeeds. Now it redirects to Autodiscover configuration link. But it takes a few attempts to get there.
That’s why you get multiple popups of the error message / or the password prompt.

Why the issue did not hit the domain joined mail clients?

The mail administrator had following options configured already:

Setting the options for

  • DisableAutodiscoverV2Service = 1
  • ExcludeExplicitO365Endpoint = 1
  • excludehttpredirect = 1
  • excludehttpsautodiscoverdomain = 1
  • excludehttpsrootdomain = 1
  • excludelastknowngoodurl = 1
  • excludeScpLookup = 1
  • excludesrvrecord = 0
  • zeroconfigexchangeonce = 1

References

‘t QVAX data retentie fabeltje: alle gegevens zijn gewist. Echt niet.

Als Belg kent u ongetwijfeld QVAX, het kaduke wachtlijst platform dat in het leven geroepen is om het dagelijks overschot aan anti-corona vaccinaties op te lossen…

Bij de lancering ging het al stevig de mist in doordat het slecht ontworpen vertragings-mechanisme de overbelasting alleen maar erger maakte.

Het was bovendien met een Adblocker / cookie-blocker ook nog makkelijk te omzeilen ook…

Er zijn nog 250.000 wachtenden voor U,… nee 300.000…. of 400.00.

Nu hebben ze midden in de 5e Corona pandemie golf voor het booster vaccin QVAX opnieuw geactiveerd.

Als je jezelf wil aanmelden krijg je meteen een melding, ik citeer

“Als u QVAX als hebt gebruikt tijden de eerste vaccinatiecampagne, moet u weten dat alle gegevens zijn gewist. Uw QVAX Account bestaat niet meer en u zult een nieuwe moeten aanmaken.

Wees heel voorzichtig het het invullen van de juiste informatie. Maak vooral geen tikfouten in het e-mailadres (pas op voor de automatische correctie op een smartphone) en onthoud uw wachtwoord goed.”

en ook

“Let op! Als u QVAX al hebt gebruikt tijdens de eerste vaccinatiecampagne en u wilt uw account opnieuw activeren, weet dan dat dit niet mogelijk is! Alle bestaande accounts zijn verwijderd en u moet dus een nieuwe account aanmaken”

https://www.qvax.be/login

Dus dan denk je… ik maak dus een nieuwe account aan.

Dan krijg je dus deze foutmelding

“Reeds bestaand account voor dit identificatienummer (INSZ)”

Dan probeer je in te loggen, … met een password manager, …

Blijkt de login niet te werken. Dan maar even zelf proberen… Zonder success.

Dus dan maar een reset.

Met het oude passwoord, van de password manager.

DAT heeft ie dus OOK nog onthouden.

Dus, als je TOCH nog QVAX wil gebruiken om sneller aan je booster te geraken, beste jongeling, … probeer eerst in te loggen via https://www.qvax.be/login.
Als dat niet werkt, doe een password reset via https://www.qvax.be/password.

Want je gegevens zitten nog in het systeem… en voor hoelang, dat zoek je zelf maar uit.
Zolang de pandemie duurt… als we nog een serie corona golven krijgen… + 5 dagen na het einde van de laatste golf.
“Als algemene regel geldt dat de verwerkingsverantwoordelijken de persoonsgegevens niet langer
bewaren dan redelijkerwijs noodzakelijk is voor de doeleinden waarvoor zij zullen worden
gebruikt en in overeenstemming met de wettelijke en bestuursrechtelijke voorschriften.
Wij bewaren uw gegevens tot maximum 5 dagen vanaf de dag na de bekendmaking van het
koninklijk besluit dat het einde van de epidemie ten gevolge van het COVID-19 coronavirus
aankondigt.”

Dat is wat hun Privacybeleid tenminste zegt.
Het is alvast korter bij de waarheid dat ze je gegevens niet wissen.

Image by mohamed Hassan from Pixabay

Note-to-self: KopieID (to blur your ID card fotocopy)

Source:

As explained here (in Dutch) and here (Dutch), it’s a terrible ID (sorry, idea), to copy your identity card and hand over the unprotected copy to someone….

Therefore it’s highly interesting to protect the photocopy against abuse, in the ultimate case you need a photocopy of your identity card…

KopieID NL

In the Netherlands the government has provided an app for your mobile phone, to take a photo of your ID and then blur the redundant information and to add a remark / watermark to indicate the purpose limitation.

Check it out here:

They also provide an interesting video explanation:

KopieID BE

In Belgium, there is a website (without app) that does the same, see here:

References

Source articles:

Reference material from the articles:

Picture credits: Image by mohamed Hassan from Pixabay 

Image source: https://pixabay.com/illustrations/hack-fraud-card-code-computer-3671982/

Note-to-self: SOC2 mapping to ISO27001

Just in case you get into SOC2 and want to know how to map it to existing information security implementation, whatever it may be, GDPR, ISO27001, NIST, … check this page

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/mappingsrelevanttothesocsuiteofservices.html

It includes:

These links have nice XLS format sheets, with a bidirectional comparison between the frameworks.

Info on SOC1/SOC2/SOC3

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html

SOC and SOX?

 SOC reports refer to an audit of internal controls to ensure data security, minimal waste, and shareholder confidence; SOX relates to government-issued record keeping and financial information disclosure standards law. In other words, one is about keeping information safe, and the other is about keeping corporations in check.

https://immedis.com/blog/what-are-the-key-differences-between-soc-and-sox/

https://www.logicgate.com/blog/a-comparison-of-soc-and-sox-compliance/

Also

https://linfordco.com/blog/soc-2-security-vs-iso-27001-certification/

(braindump article, still in progress)

This award is for you, because YOU are my most valuable professional who made this possible.

I’m honored and humbled that I’m part of the Microsoft Most Valuable Professional (MVP) community award for another year.


As explained on the program page “MVPs, are technology experts who passionately share their knowledge with the community.” It’s an award for your Microsoft community work of the past year… you can find more details on the MVP website mentioned earlier.

But building community is not a one-person activity, not a job, …

It’s a passion, it’s fun, sharing knowledge and best practices with many people over the world, all eager to build community.

And last year (or longer) has been very challenging to keep the community running without face-2-face events, shifting to online only. It was hard work. And the MVP award renewal cycle has been very special this year, taking into account the Corona conditions.

But nevertheless, I can’t keep up this work without support of you, my dearest colleagues, partners, technology experts, community fellows, my audience, …
I won’t list any specific person, because I would not do honor to all the rest… too many to list.

Therefor a big shout out of gratitude for your support.

Thank YOU for supporting me, making this possible.

I dedicate this award to you, to your support. This is your award.


In the world of security, cyber- and cloud security, sharing knowledge is one of the most important principles to win the battle against cybercrime. Learn from the mistakes others have made.

I’m doing my best to keep up the work and to meet the bar of excellence, to be an community lead, to build community and to share knowledge.

This award and your appreciation gives me the extra motivation to keep going and do better next year!

Thank you!




CCSP and CCAK, not versus: build your cloud security expertise path based on your needs.

Last week (ISC)² published a blog post on the choice between CCSP and CCAK.

You can find it here: https://www.isc2.org/articles/CCSP-versus-csa-ccak.

“What is the right certification for you?”

The main title of the (ISC)² article on CCSP vs CCAK is “CCSP Certification vs. CCAK Certificate: What Are the Distinctions?”

That’s exactly what you get. A list of technical differentiators between CCSP and CCAK, but according to (ISC)².

But if you hope to get an actual answer to what the right certification is, for you… they forget to ask …you.

What do you think would be the conclusion, if you ask that question to either one of the contestants while you compare 2 certifications? Of course each party will simply draw the conclusion that their own certification is the best choice.

To answer the most important question, the dilemma CCSP or CCAK, is simple: do you need technical or audit skills for cloud security?

The answer

In essence, the answer is simple:

  • if you need cloud audit skills, dive in to the Cloud Security Alliance (CSA) and ISACA Certificate CCAK.
  • if you want to have architect level technical cloud expertise and knowledge, choose CCSP
  • if you want cloud security knowledge, in basic or advanced hands-on, there are other choices to start with (more about it below)

So, if you ask the question “what is the right certification for you”, you immediately know that there is no right answer, but there are many options.
Options for a multi level expertise roadmap in cloud security, based on your current skills and your future goals.

If you like a tough challenge: why not jump into the CCAK or CCSP, CCSP or CCAK, whatever, right away.

But if you would like to boost your chance of success… take a deep breath and better plan smartly.

And don’t start with CCSP/CCAK, but prepare your track towards CCSP/CCAK first.

First some background to plan your roadmap

Setting expectations

Just to set expectations, this article only focuses on the personal education and certification options, offered by (ISC)², ISACA and CSA. Including other education provider would lead us too far.
There are way more other (cyber)security certifications available, but we focus on the cloud security track, which limits the options…

Feel free to comment with other options for cloud security training. I’ll update the article where relevant.

CSA CCSK

The Cloud Security Alliance launched the CCSK in 2011. And as they explained here, “the CCSK was quite literally the industry’s first examination of cloud security knowledge when it was released back in 2011. “

The CCSK is an easy entry, high level introduction to Cloud Security, and it doesn’t require you to have deep technical cloud security expertise.

But it still is a nice baseline for the cloud security essential knowledge.

(ISC)² – CCSP

In short: CCSP = CISSP [by (ISC)²]+ CCSK [by CSA]

The long version is explained in the (ISC)² article comparing CCSP and CCAK.

  • CCSP = Certified Cloud Security Professional
  • You need at least five years of cumulative, paid work experience
  • CCSP is pretty much the same level of difficulty as CISSP, but has focus on cloud security.

The CCSP was launched in 2015, as a cooperation between (ISC)² and CSA. (see CSA press release here), a couple years after the CCSK launch in 2011.
The CCSP is the bigger brother of the CCSK, more advanced, and as CSA rightfully mentions in there CCSK-CCSP comparison blog, the CCSP is on the level of CISSP with a major cloud flavor.

That’s where the dummy math description comes from…

CCSP = CISSP + CCSK.

But CCSP certainly is not an entry level exam.

More information:

ISACA & CSA – CCAK

CCAK = CISA [ISACA] + CCSK [CSA]

CCAK (Certificate of Cloud Auditing Knowledge) is cohosted by ISACA and CSA.
And then you immediately know the approach is different than the approach of (ISC)².

ISACA (Previously known as the Information Systems Audit and Control Association®) stems from audit.
CSA focuses on cloud security.

That’s exactly what CCAK is about : cloud security audit.

See here:

As ISACA mentions on their product page: “The Industry’s First Global Cloud Auditing Credential”.

CISSP

For completeness, I mentioned the CISSP ( Certified Information Systems Security Professional).
I don’t think it needs a lot of explanation, it’s pretty much the reference standard for IT Systems security. (ISC)² references it as “The World’s Premier Cybersecurity Certification”.

It’s a pretty heavy exam, and it does require at least 5 years professional security experience. This is not an entry level exam.

More info: https://www.isc2.org/Certifications/CISSP

SSCP (Systems Security Certified Practitioner)

Due to the experience requirements, CISSP might be a tough credential to start with, although you can pass the exam, and continue to build your experience to grab the CISSP title…

If you want the plan your credentials the smart way, or you’re fresh in cyber-, information or IT-security, you better start with SSCP.

That the little brother of CISSP, and it’s an excellent way to step up to CISSP. More info: https://www.isc2.org/Certifications/SSCP

Where to start?

Cybersecurity & Information security essentials

As explained earlier, for tech skills in cyber-, IT and information security: look into SSCP first.

(Then step up to CISSP.)

Cloud security essentials: CCSK

Now it’s obvious what your first step in cloud security education should be: CCSK.

The CCSK is the perfect introduction to cloud security essentials.

Although it’s very helpful to have some technical IT basic knowledge, the CCSK is very accessible for general audience.

To prepare for the CCSK, you can follow classes or self-study via a completely free preparation toolkit.

Source: CSA CCSK v4 exam (https://cloudsecurityalliance.org/artifacts/ccskv4-exam-prep-kit/)

You can buy a double-try access ticket for the CCSK online exam (60 questions, 90 minutes), so if you would fail the first attempt, study again and retry the exam.

Then plan your track: only technical (no interest for audit) or audit, or both

Only technical

If you focus on technical expertise in cloud security, CCSP is a reference standard (at least, on of them…) .

As mentioned: CCSP = CISSP + CCSK.

So the track is clear

  • After passing the CCSK exam,
  • Take the CISSP exam
  • then take the CCSP

This is the easier route if you already have 5yr+ experience. It’s not the cheapest route, as you pass the CISSP first, but it’s worth the effort. (you only need to pay 1 yearly fee at (ISC)², so after 1 certification, … no extra cost in yearly membership fee)
For junior, less experienced, security engineers, start with SSCP before jumping into CISSP, and then CCSP.

Audit

When you target IT security audits, you need to take a different route depending your background.
Having the CCSP/CISSP background is extremely useful to boost your career in audit.

But for the CCAK, the core audit baseline is CISA.

Keep in mind, similar to CISSP and CCSP, CISA has the same requirements regards professional experience, 5 years.

But if you’re a ISACA CISA, you can add CCSK to the track and land on the CCAK.

Both?

Then it’s obvious, first tech, then audit, meaning a smart combination of

  1. CCSK
  2. (SSCP > ) CISSP
  3. CCSP
  4. CISA (or alternative)
  5. CCAK

Alternative routes

ISO27001 Implementer & Auditor

And alternative route to the auditing experience is ISO27001 auditing, but you’ll need some implementation experience before you can audit.

CISM

Within the ISACA portfolio, the CISM (Certified Information Security Manager), covers the same areas as most ISO27001 (lead) implementer courses.

Which can be helpful to ramp up for the CISA audit part, to gain some hands-on in IT & Infosec governance.

Visualizing your cloud security education roadmap

Lots of blah for a simple choice?

Allow me to visualize the options…

The difference between “certification” and “certificate”, does it really matter?

In it’s blog post (ISC)² tries to put CCSP above CCAK by saying “CCSP is a certification; CCAK is a certificate.”

And they continue “A certification recognizes a candidate’s knowledge, skills, and abilities, typically framed by a job role, while a certificate’s scope is narrower and only documents training course completion. A certification often requires continuing professional education (CPE) to stay in front of trends, while a certificate’s body of knowledge does not evolve over time or require CPE credits to maintain.

And their explanation is at least flawed and cutting corners to benefit CCSP.

There are many explanations and interpretations of “certification”, depending the context.
But in essence, “certification” is a process and a certificate is a document (the result).

When you certify for “CCSP” at (ISC)², you need to comply with the CCSP condition and then get a document, your CCSP certificate.
Idem for CCAK, you need to comply with their conditions.

Both the certification process for CCSP as the process for the CCAK are used by other similar education providers.

Eg, PECB, ISACA, EC-COUNCIL, … and others require to pay a yearly fee, keep CPE/CPD (continous professional education or development). Some yearly fees are cheaper as others.

Like CSA, Microsoft and others ask for a 1 time exam fee, and then update the exam on longer term, not yearly, and do not require a yearly maintenance fee.

It’s a choice of the certificate owner, how the evaluation and exams are done.

Some of them comply to the ISO17024, and education standard. There are huge benefits to comply (like increased credibility, compatibility with other certifications, …). But it’s not mandatory.

(ISC)² uses an exam, with experience requirement and continuous education once you pass the exam, but you do not need to pass the exam again, unless it’s upgraded to a new build or major version.

But CSA does exactly the same, for example when CCSK was upgraded from v3 to v4, you needed to pass the exam again.

Not on a yearly basis, but the program is updated, the exam is updated… on a regular basis, without yearly fee.

It’s rather a (small) financial effort, not of significance for most companies paying the bill. (Although as an individual, the cost of certification can become a serious burden…)

And it’s certainly not relevant when choosing between CCSP and CCAK. CCAK is cheaper, as referenced in the (ISC)² comparison chart.

References

(ISC)²: CCSP Certification vs. CCAK Certificate: What Are the Distinctions?

Cloud Security Alliance (CSA)

CSA Certificate of Cloud Security Knowledge (CCSK)

CSA & ISACA CCAK

CCAK learning material

CCSK vs CCSP

Vocabulary (alphabetical)

CCAK: Certificate of Cloud Auditing Knowledge (https://cloudsecurityalliance.org/education/ccak/)

CCSK: Certificate of Cloud Security Knowledge (https://cloudsecurityalliance.org/education/ccsk/)

CCSP: Certified Cloud Security Professional (https://www.isc2.org/Certifications/CCSP)

CSA: Cloud Security Alliance (https://cloudsecurityalliance.org/)

(ISC)²:  International Information System Security Certification Consortium (https://www.isc2.org/)