PECB Lead Cloud Sec case studies
PECB Lead Cloud Sec · Put your knowledge to work in context.
The PECB Certified Lead Cloud Security Manager is a professional credential awarded by PECB after a candidate passes the Lead Cloud Security Manager exam and satisfies the corresponding certification requirements. It is aimed at cloud security and information security professionals who want to manage a cloud security program, managers and consultants who want to master cloud security best practices, people responsible for maintaining and managing such a program, technical experts broadening their cloud security knowledge, and cloud security expert advisors. The PECB Lead Cloud Sec case studies are 5 cases and about 4,209 words.
1Northwind Freight: a single 'cloud' risk line and a board minute that says risk is transferred
Northwind Freight runs 340 workloads, 61 of them in a public IaaS tenancy, with a plan to close both data centres within 18 months. The risk register lists cloud as a single asset, with likelihood rated low because the IaaS provider holds an ISO/IEC 27001 certificate and issued a SOC 2 Type II report that the security manager downloaded last year.
866 words, about 4 min2Bramble Retail: splitting responsibility for a managed database and testing what an ISO/IEC 27018 certificate actually proves
Bramble Retail holds profiles of 4.2 million loyalty customers in a public cloud. Two components are involved: self-managed virtual machines running the analytics application, and the provider's managed relational database holding profiles and purchase history.
838 words, about 4 min3Halden Utilities: an 11-day exposure, a seven-day log retention and a notification clock nobody owns
On 3 March a security researcher emails Halden Utilities that a storage bucket behind its customer portal is publicly readable. The bucket holds 180,000 meter-service records: names, addresses and partial bank details for 4,100 customers.
828 words, about 4 min4Vantage Insurance: 1,240 findings, a managed platform that cannot be scanned, and a board asking for one number
Vantage Insurance runs a monthly cloud security posture scan. Last month it produced 1,240 findings across three subscriptions and 470 accounts; 58% were never triaged and 31% were duplicates of four recurring rules.
790 words, about 4 min5Corvus Media: a stale cloud policy, two unsanctioned SaaS tools and a role that no longer exists
Corvus Media's cloud security policy was approved 34 months ago. It is a 14-page PDF with two appendices: appendix B, superseded six months ago by the current logging standard, is still referenced in the body text.
887 words, about 4 min