CCSK Training and Exam

Jose Malacara

In my last blog post, I wrote about the then-upcoming CCSK training offered by the CSA in San Jose on June 8-10th. Details of the course content can be found here. The training was hosted by Ebay/Paypal and administered by independent security firm, Securosis.

I attended the first two days of training, which were made up of a Basic and Plus session. The first day (Basic) was a high-level overview of cloud computing in general and also went into detail on the topics covered in the CCSK exam. The second day (Plus) was a hands-on session where students worked through the process of deploying servers into the Amazon cloud. These lab exercises were focused deploying servers securely within Amazon's public cloud. Amazon's cloud offering is probably the most flexible, but also the most complex cloud environment to learn when compared to other vendors. It was a great introduction to their Elastic Cloud Compute (EC2) and Simple Storage Service (S3) services for those not familiar with Amazon or used to working with other cloud providers.

The students in the class were made up of a diverse mix of security and IT professionals, consultants and management personnel. In general, I would recommend the first day (Basic) for those looking for an introduction to cloud computing or higher-level thinkers who aren't concerned with the nitty-gritty details of deployment. Please keep in mind that this is not a boot-camp style course where you focus only on how to pass the exam.  That being said, the instructors from Securosis did help to author the CCSK exam, so they were a great resource for asking questions about the exam material. The second day (Plus) would be more suited for IT, network or security personnel that would be doing actual deployments and need to know how to translate those high-level concepts learned in the Basic course into practice and migrate servers into the cloud.

I scheduled my CCSK for the day after training, and I think that worked to my benefit. The night before the exam, I spent reviewing the CSA and ENISA material one last time. With everything fresh in my head, I was easily able to recall specifics and pass the exam. Please keep in mind that the test is timed so even with knowing the material, it was still a race against the clock. You’ll have a little over a minute to answer each question so don’t expect to have too much time to flip through the docs and dig for answers. Take advantage of the PDFs for quick scanning if you get stuck on any questions (and you probably will on at least a few).

Overall, I would recommend the CSA training to anyone looking to pass the CCSK.  This was the first time the CSA has officially offered the training classes, and as expected, there are a still a few kinks to be ironed out. I think my biggest gripe would be with the documentation given away at training. During the Basic class, we were given a binder with screenshots from the lecture. It was in black and white and in some cases the diagrams were illegible or the print too small to read on some pages. All handouts were given out in hard copy only. There were no handouts for the Plus course, however, considering how technical in nature it was, it would have been nice to have some reference material to take home.  I’m sure the course material will only get better as time progresses. The CSA certainly seems to be off to a good start.

Besides passing my CCSK, I think my biggest takeaway from the training course was to see just how many people are interested in the field of cloud computing. There were over fifty people in the class, and I was told there was a waiting list for each. That’s not bad for a relatively unknown certification in a niche field of security. It should be interesting to see if the demand keeps up for CCSK training and the certification in general as more and more companies migrate into the cloud. It's a great opportunity to jump in for any IT or security professional who wants to stay ahead of the technology curve.