Sikkerhetskurs for IT

CISSP er en forkortelse for Certified Information System Security Professional. Sertifiseringen regnes som ”gullstandard” innen IT-sikkerhetssertifisering for henholdsvis teknikere og ledere internasjonalt. Et CBK Review kurs regnes for å være den beste måten å forberede seg på en CISSP sertifisering. Det man først og fremst husker fra disse kursene, er hvor mye man lærte, både på dagtid og under kveldsstudiene. Begge pensum er svært omfattende. Nesten uansett kunnskapsbakgrunn, opplever de fleste et stort kompetanseløft i løpet av kursene. Dessuten blir kunnskapen satt inn i et rammeverk som gjør det lettere å holde seg oppdatert. • Security and Risk Management (Security, Risk, Compliance, Law, Regulations, and Business Continuity)• Asset Security (Protecting Security of Assets)• Security Engineering (Engineering and Management of Security)• Communication and Network Security (Designing and Protecting Network Security)• Identity and Access Management (Controlling Access and Managing Identity)• Security Assessment and Testing (Designing, Performing, and Analyzing Security Testing)• Security Operations (Foundational Concepts, Investigations, Incident Management, and Disaster Recovery)• Software Development Security (Understanding, Applying, and Enforcing Software Security)       [-]

Studieår: 2013-2014   Gjennomføring: Høst og vår Antall studiepoeng: 5.0 Forutsetninger: Ingen. Innleveringer: For å kunne gå opp til eksamen må 8 av 12 øvinger være godkjent. Personlig veileder: ja Vurderingsform: Skriftlig, individuell, 3 timer,  Ansvarlig: Olav Skundberg Eksamensdato: 16.12.13 / 26.05.14         Læremål: KUNNSKAPER:Kandidaten kan:- forklare hvordan en datamaskin utsettes for angrep gjennom skadelig programvare og hvordan man kan beskytte seg mot dette- beskrive ulike typer nettbaserte angrep og hvordan man kan beskytte seg mot dette- beskrive ulike krypteringsmekanismer og forklare hvordan digitale sertifikat brukes for å oppnå sikre tjenester.- referere til aktuelle lover og retningslinjer innen sikkerhet- gjøre greie for en organisasjonsmessig informasjonssikkerhetssikkerhetspolicy FERDIGHETER:Kandidaten kan:- kontrollere egen PC for skadelig programvare- kontrollere at installert programvare er oppdatert- utføre pakkefangst med Wireshark og tolke resultatet GENERELL KOMPETANSE:Kandidaten:- er bevisst på å holde programvare oppdatert og å bruke nettvett Innhold:Skadelig programvare: sikkerhetshull, informasjonskapsler, virus og antivirus Nettverk: Virtuelle private nett (VPN), brannmur, demilitarisert sone (DMZ), tjenestenektangrep Sikre tjenester: Krypteringsmetoder og sjekksum. Digitale sertifikater og Public Key Infrastructure (PKI) Samfunn og virksomhet: ekom-loven og personvernloven. Sikkerhetshåndbok og ISO27001Les mer om faget herDemo: Her er en introduksjonsvideo for faget Påmeldingsfrist: 25.08.13 / 25.01.14         Velg semester:  Høst 2013    Vår 2014     Fag Internett og sikkerhet 4980,-         Semesteravgift og eksamenskostnader kommer i tillegg.  [-]

This course is three days of instructor-led training that will help you to: Differentiate the architecture and components of the Cortex XDR family Describe Cortex, Cortex Data Lake, the Customer Support Portal, and the hub Activate Cortex XDR, deploy the agents, and work with the management console Work with the Cortex XDR management console, describe a typical management page, and work with the tables and filters Create Cortex XDR agent installation packages, endpoint groups, policies, and profiles Create and manage exploit and malware profiles, and perform response actions Describe detection challenges with behavioral threats Differentiate the Cortex XDR rules BIOC and IOC, and create and manage them Describe the Cortex XDR causality analysis and analytics concepts Triage and investigate alerts and incidents, and create alert starring and exclusion policies Work with the Causality and Timeline Views and investigate threats in the Query Center   ObjectivesSuccessful completion of this instructor-led course with hands-on lab activities should enhance the student’s understanding of how to activate a Cortex XDR instance; create agent installation packages to install the Cortex XDR agents; create security policies and profiles to protect endpoints against multi-stage, fileless attacks built using malware and exploits; respond to attacks using response actions; understand behavioral threat analysis, log stitching, agent-provided enhanced endpoint data, and causality analysis; investigate and triage attacks using the incident management page of Cortex XDR and analyze alerts using the Causality and Timeline analysis views; use API to insert alerts; create BIOC rules; and search a lead in raw data sets in Cortex Data Lake using Cortex XDR Query Builder.   Course Modules1. Cortex XDR Family Overview2. Working with the Cortex Apps3. Getting Started with Endpoint Protection4. Malware Protection5. Exploit Protection6. Exceptions and Response Actions7. Behavioral Threat Analysis8. Cortex XDR Rules9. Incident Management10. Alert Analysis Views11. Search and Investigate12. Basic Troubleshooting   [-]

  Studieår: 2013-2014   Gjennomføring: Høst og vår Antall studiepoeng: 5.0 Forutsetninger: Faget «Datakommunikasjon» eller tilsvarende grunnleggende fag. (TCP/IP forutsettes kjent). Faget «Nettverksteknologi» Innleveringer: Øvinger: 8 av 12 må være godkjent. Øvingene må dekke en bred del av pensum. Vurderingsform: Skriftlig, individuell, 3 timer, Ansvarlig: Helge Hafting Eksamensdato: 04.12.13 / 07.05.14         Læremål: KUNNSKAPER:Kandidaten:- kan forklare en del protokollbaserte farer/angrep i kablede og trådløse nett- kan gjøre rede for mottiltak mot angrepene over- kan gjøre rede for andre farer og mottiltak, som fysiske sikringstiltak og «social engineering»- kan gjøre rede for og planlegge bruk av vanlige sikringstiltak som IDS, IPS, VPN og proxyer FERDIGHETER:Kandidaten kan:- sette i drift et VPN- installere brannmur- Observere nettverkstrafikk med pakkesniffer GENERELL KOMPETANSE:Kandidaten:- kan granske sikkerheten i et nettverk, og velge passende tiltak.Innhold:Generell nettverkssikkerhet. Hvordan planlegge, organisere og sette sikkerhet i små og store nettverk. Brannmurer, VPN, IDS/IPS. Sikkerhet rundt epost, trådløse nett og rutere. En del vanlige angrep, og mottiltak.Les mer om faget her Påmeldingsfrist: 25.08.13 / 25.01.14         Velg semester:  Høst 2013    Vår 2014     Fag Nettverkssikkerhet 4980,-         Semesteravgift og eksamenskostnader kommer i tillegg.    [-]

Dette intensive fem dagers kurset gir deg muligheten til å utvikle den nødvendige ekspertisen til å demonstrere kunnskap, ferdigheter og kompetanse, for å implementere, håndtere og endre et personvernrammeverk basert på General Data Protection Regulation (GDPR). Du vil kunne forstå gapet mellom GDPR and nåværende organisatoriske prosesser inkludert personvernpolicyer, prosedyrer, arbeidsinstrukser, samtykkeskjemaer, personvernkonsekvensutredning (Data Protection Impact Assessment), etc. for å bistå organisasjoner med sitt compliance-arbeid. Dette kurset er basert på teoretiske presentasjoner etterfulgt av praktiske oppgaver. Kurset går over 5 dager med avsluttende eksamen siste dag. Inkludert i prisen er dokumentasjon, kursbevis, eksamensavgift, lunsj og kaffe/te. [-]

Bli autorisert styremedlem Trenger du eller ditt styre å øke sin kompetanse og profesjonalitet innen styrearbeid? Gjennom Styreskolen tilbyr Foreningen for bedre styrearbeid et nettbasert autorisasjonskurs i styrearbeid. Kurset gir en grunnleggende innføring i de mest sentrale juridiske og praktiske forhold daglig leder og styremedlemmer i et aksjeselskap bør kjenne til. Du vil gjennom kurset få en kompetansetilførsel som gjør at du kan utøve ditt verv mer korrekt og profesjonelt.  Kurset passer blant annet for de som ønsker å: Styrke sin kompetanse innen styrearbeid Oppdatere seg på styrerelaterte endringene i aksjeloven og GDPR Kontrollere at de kan det mest elementære innen styrearbeid Dokumentere sin basiskompetanse i styrearbeid gjennom et autorisasjonsbevis Kurset Kurset er 100 prosent nettbasert (tilpasset både mobil, nettbrett og/eller PC) og består av følgende 20 seksjoner: Selskapsformer Generalforsamling Forvaltning- og tilsynsansvar Inhabilitet Sammensetning av styret Ansatterepresentanter Styrets leder Styreinstruks Daglig leder og styret Taushetsplikt Innkalling til styremøte Styrehonorar Behandling av styresaker GDPR for styret Styreprotokoll Styrets årsplan Erstatningsansvar Styreevaluering Årsregnskap Før du takker ja til nytt styreverv Eksamen Kurset avsluttes med en nettbasert eksamen som består av 40 flervalgsoppgaver. Du kan ta eksamen flere ganger. Autorisasjonsbevis Ved bestått eksamen vil du automatisk motta autoriseringsbevis fra Foreningen for bedre styrearbeid. Flere kursdeltakere Ta styrearbeidet på alvor og la hele styret og daglig leder ta kurs i styrearbeid på selskapets regning. Pris for hele styret + daglig leder er kr 15.000 + mva. Dersom flere personer i samme organisasjon tar autoriseringskurset kan daglig leder eller styrets leder be om å få sendt faktura og innloggingskoder til selskapet ved å kontakte på post@styreskolen.org.   Om Styreskolen Styreskolen er utviklet av Foreningen for bedre styrearbeid og Orgbrain - som er spesialist innen utvikling av digitale løsninger innen styrearbeid. Selskapets arbeid støttes av Innovasjon Norge og Norges Forskningsråd. «Styreskolen er blant annet basert på praktiske problemstillinger jeg har opplevd som både daglig leder, styremedlem og styreleder i en rekke selskaper gjennom 20 år. Dersom du lærer deg pensumet i Styreskolen har du et godt grunnlag for å kunne håndtere mange av de utfordringer du vil møte som både styreleder og styremedlem.» - Dag Asheim, Styreleder i Foreningen for bedre styrearbeid Varighet Kurset vil være tilgjengelig i 12 måneder fra betalingstidspunkt. Det må påregnes at det tar rundt 20 timer å gjennomføre kurset og eksamen. Starter du kurset i dag kan du være autorisert styremedlem innen neste uke.    Besøk oss på www.styreskolen.org   [-]

MasterClass: Hacking Windows Infrastructure, 2 dagerIn this workshop you will investigate the critical tasks for a high-quality penetration test. Well look at the most efficient ways to map a network and discover target systems and services. Once the systems are discovered, we will search for vulnerabilities and reduce false positives with manual vulnerability verification. At the end we will look at exploitation techniques, including the use of the authored and commercial tools. In the attack summary we will always go through the securing techniques. MasterClass: Securing Windows Infrastructure, 3 dagerThis is a deep dive course on infrastructure services security. It is a must-go for enterprise administrators, security officers and architects.  Delivered by one of the best people in the market in the security field – with practical knowledge from tons of successful projects, many years of real-world experience, great teaching skills and no mercy for misconfigurations or insecure solutions. The course has a form of intense workshop! [-]

This course enables the participants develop the competence to master the basic Risk Management elements related to all the assets of relevance for Information Security using the ISO/IEC 27005 standard as a reference framework. Based on practical exercises and case studies, participants acquire the necessary knowledge and skills to perform an optimal Information Security Risk Assessment and manage risks in time by being familiar with their life cycle. This training fits perfectly in the framework of an ISO/IEC 27001 standard implementation process. Learning Objectives: To understand the concepts, approaches, methods and techniques that allow effective Risk Management according to ISO 27005 To interpret the requirements of ISO 27005 on Information Security Risk Management To understand the relationship between the Information Security Risk Management, the security controls and the compliance with all the other requirements) Day 1: Introduction, risk management program, risk identification and assessment according to ISO 27005 Concepts and definitions related to risk management Risk management standards, frameworks and methodologies Implementation of an information security risk management program Risk identification and risk assessment Day 2: Risk evaluation, treatment, acceptance, communication and surveillance according to ISO 27005 Risk evaluation and treatment Acceptance of information security risks and management of residual risks Information security risk monitoring and review Certified ISO/IEC 27005 ANSI Accredited Exam Sertifisering: About the Examination: The “Certified ISO 27005 Risk Manager” exam fully meets the requirements of the PECB Examination and Certification Program (ECP). The “Certified ISO 27005 Risk Manager exam covers the following competence domains: Domain 1: Fundamental concepts, approaches, methods and techniques of information security risk management Domain 2: Implementation of an information security risk management program Domain 3: Information security risk assessment based on ISO 27005 The exam is available in different languages, including English, French, Spanish and Portuguese The exam consists of 5 essay-type questions Open book: Participants may use all PECB provided documentation plus their own course notes, but will not be permitted to use any computer, laptop or any other electronic device Paper-based exam A minimum score of 70% is required to pass the exam The exam lasts 90 minutes Certification: A certificate of “ISO/IEC 27005 Risk Manager” will be issued to those participants who successfully pass the exam and comply with all the other requirements related to this credential: Professional experience: Two years, one year of Risk Management related work experience Risk assessment experience: Risk Management activities totaling 200 hours [-]

Kurset tar for seg de mest sentrale problemstillingene knyttet til sikkerhet rundt bruken av datautstyr som datamaskiner, smarttelefoner og nettbrett.    Kurset vil gi brukeren kunnskap om ulike «feller» man kan gå i samt nyttige og praktiske tips og veiledninger til hvordan man unngår at data kommer på avveie eller ødelegges permanent.   Kurset inneholder 50 opplæringsvideoer. Mens andre  kurs fokuserer på å bruke IT-verktøy effektivt, vil dette kurset gi deg innsikt i å bruke IT trygt og sikkert.   Kurset passer for databrukere i alle typer bedrifter og organisasjoner.   Innhold i kurset • Datamaskinen • Passord • Ute av kontoret • Minnepinner • Sikkerhetskopi • E-post • Internett • Ettertest Krav til forkunnskaper Grunnleggende datakunnskaper Kursbevis Etter endt opplæring vil man kunne ta en ettertest for å måle sin nye kunnskap. Ved bestått test så vil man få tilgang til et kursbevis   Nettbasert  Timetall: 6  Kursstart Info: Når som helst - Hele året !  Klokkeslett: 00:00 - 24:00  Påmeldingsfrist:  Pris: kr 1.175,- inkl. mva.  Nettbasert - Web     Kontaktperson: Frode Ingebrigtsen    Status: Åpent for påmelding Gå til påmelding [-]

Dette intensive fem dagers kurset  innen informasjonssikkerhet/ Information Security, gir deg den nødvendige kunnskapen og ekspertisen for å planlegge og implementere et effektivt styringssystem (ISMS) for din virksomhet i henhold til ISO 27001. Hvem er kurset laget for? Prosjektledere eller konsulenter som skal støtte en virksomhet i implementering av et ISMS ISO 27001 revisor som ønsker å også mestre implementeringsprosessen Deg som er ansvarlig for informasjonssikkerhet i din virksomhet Deltagere i prosjekt for implementering av styringssystem Rådgivere innen informasjonssikkerhet Mål med kurset Målsetningen med kurset er å gjøre deg i stand til å mestre det du trenger for å implementere sikkerhetskontroller fra de 11 områdene i ISO 27002. Etter kurset skal du kunne: beskrive hvordan et styringssystem bygges opp og implementeres mestre konseptene, standardene og metoder for å administrere et ISMS på en effektiv måte kjenne forholdet mellom styringssystem, risikovurdering og compliance i henhold til virksomhetens egne krav støtte virksomheten i å få implementert og videreutviklet sitt styringssystem velge ut ressurser i egen virksomhet som utgjør teamet som er ansvarlig for at systemet fungerer til daglig vise til bedre kunnskaper for analyse og beslutningstagning innenfor informasjonssikkerhet   [-]

Unlike most other pen testing programs that only follow a generic kill chain methodology; the ECSA presents a set of distinguishable comprehensive methodologies that are able to cover different pentesting requirements across different verticals. The ECSA penetration testing course provides you with a real world hands-on penetration testing experience and is a globally accepted hacking and penetration testing class available that covers the testing of modern infrastructures, operating systems and application environments while teaching the students how to document and write a penetration testing report.The ECSA pentest program takes the tools and techniques you learned in the Certified Ethical Hacker course (CEH) and elevates your ability into full exploitation by teaching you how to apply the skills learned in the CEH by utilizing EC-Council’s published penetration testing methodology. It focuses on pentesting methodology with an emphasis on hands-on learning.   Course outline: Security Analysis and Penetration Testing Methodologies TCP IP Packet Analysis Pre-penetration Testing Steps Information Gathering Methodology Vulnerability Analysis External Network Penetration Testing Methodology Internal Network Penetration Testing Methodology Firewall Penetration Testing Methodology IDS Penetration Testing Methodology Web Application Penetration Testing Methodology SQL Penetration Testing Methodology Database Penetration Testing Methodology Wireless Network Penetration Testing Methodology Mobile Devices Penetration Testing Methodology Cloud Penetration Testing Methodology Report Writing and Post Test Actions [-]

Public Key Infrastructure (PKI) is a core service that facilitates authentication, encryption, and digital signing. This 4-day course teaches the skills required to design, operate, and maintain your PKI system. The training begins with an overview of cryptography and the working principals of algorithms. After gaining an understanding of certificates, you will learn about the considerations for designing a highly reliable Certification Authority structure. Practical implementation examples are given in both Windows and Linux environments. Use-cases show how PKI can be used for, among others, securing websites, encrypting storage, validating executable code, and protecting communication.   Course outline:  Cryptography Basics: Introduction to Cryptography: Symmetric Cryptography Asymmetric Cryptography Hash Functions Security Goals Usage Scenarios Encryption Signing Components of PKI Algorithms, Protocols and Standards DES and 3DES RSA Object Identifiers X.500, X.509 PKCS#10, PKCS# Understanding Certificates Structure and Content Extensions Getting Started with CAs: Using External CAs Self-signed Certificates CA Hierarchy Writing Policies Certificate Policy Certification Practice Statement Windows Server Certificate Security Choosing an Architecture Implementing a CA Hierarchy Certificate Templates Issuing Certificates Certificate Renewal OpenSSL on Linux Maintaining a CA Verifying and Monitoring Backup Certificate Revocation Reasons for Revocation Methods of Revocation Checking Practical Applications: SSL for Web Server Internet Information Services (IIS) Apache (optional) Certificate-based Authentication Authentication User Authentication vs Server Authentication Considering Smart Card Logon Virtual Private Networking (optional) Wi-Fi with 802.1x Encrypting File System (EFS) Local EFS Encryption EFS Within a Domain Recovery Securing E-Mail Certificate Requirements Signing in Outlook Encryption in Outlook Code Signing Time Stamping Signing PowerShell Scripts (optional) Signing Visual Studio Files (optional) Signing Office VBScript Code Other PKI-Enable Applications   [-]

The Certified Data Protection Officer training course enables you to develop the necessary knowledge, skills and competence to effectively implement, manage and align a privacy framework based on the General Data Protection Regulation requirements. After mastering all the necessary concepts of General Data Protection Regulation (GDPR), you can sit for the exam and apply for a “PECB Certified Data Protection Officer” credential. By holding a PECB Certified Data Protection Officer Certificate, you will demonstrate that you thoroughly understand the gap between the General Data Protection Regulation and the current organizational processes including: privacy policies, procedures, working instructions, consent forms, data protection impact assessments, in order to associate organizations in the adoption process to the new regulation. Learning objectives: Understand the history of personal data protection in Europe Gain a comprehensive understanding of the concepts, approaches, methods and techniques required for the effective alignment with the General Data Protection Regulation Understand the new requirements that the General Data Protection Regulation brings for EU organizations and non-EU organizations and when it is necessary to implement them Acquire the necessary expertise to support an organization in assessing the implementation of these new requirements Learn how to manage a team implementing the GDPR Gain the knowledge and skills required to advise organizations on best practices in the management of personal data Acquire the expertise for analysis and decision making in the context of personal data protection   Course Agenda Day 1: Introduction to GDPR and Privacy Principles Day 2: The role of the Data Protection Officer Day 3: Risk Management and Information Security Day 4: Incident Management, Business Continuity and Data Protection Impact Assessment Day 5: Certification Exam Exam and all necessary course material are included in the course Education approach Lecture sessions are illustrated with examples based on real case scenarios Practical exercises include real case scenarios, examples and discussions Practice tests are similar to the Certification Exam [-]

The training not only teaches the features and functionalities of Panorama but also provides guidance on how to design a distributed firewall network that is managed from a central location.  If you are or planning to use Panorama to manage multiple FireWalls in your infrastructure then you should take this course. The Panorama management is very similar to the FireWall but it has a additional concepts like device-groups and templates that are essential to understand. The main focus of this course, besides all the Panorama concepts and initial configuration, is to show how you design and manage an infrastructure with many FireWalls because if the structure isn't setup right from the beginning, then this usually means a lot of extra work and complications at a later stage. If you are using Panorama only for centralised logging and reporting then you might skip this course.   COURSE OBJECTIVES This course will help students to gain in-depth knowledge about how to configure and manage their Palo Alto Networks® PanoramaTM management server. Upon completion of this course, administrators should be familiar with the PanoramaTM management server’s role in managing and securing their overall network. Network professionals will be shown how to use PanoramaTM aggregated reporting to provide them with a holistic view of a network of Palo Alto Networks® next-generation firewalls.   SCOPE Course level: Intermediate Course duration: 2 days Course format: Combines lecture with hands-on labs Language: Undervisningen er på engelsk og dokumentasjonen på engelsk.   KURSINNHOLD Module 1: Panorama™ Overview Module 2: Initial Configuration Module 3: Adding Firewalls to Panorama™ Module 4: Panorama™ High Availability Module 5: Templates Module 6: Device Groups Module 7: Administrative Accounts Module 8: Log Forwarding and Collection Module 9: Aggregated Monitoring and Reporting Module 10: Troubleshooting   Kurset tilbys også som bedriftsinternt kurs, og arrangeres hos dere eller i våre lokaler, alt etter hva som passer best. Ta kontakt med oss og vi kan finne en god løsning sammen. [-]

The cloud is here. Are you ready to meet the security challenge? This CCSP: Certified Cloud Security Professional Boot Camp is the most comprehensive review of cloud security concepts and industry best practices covering all six domains of the (ISC)2 Common Body of Knowledge (CBK®)! During this Boot Camp you will:  gain knowledge in identifying the types of controls necessary to administer various levels of confidentiality, integrity, and availability, with regard to securing data in the cloud. identify the virtual and physical components of the cloud infrastructure with regard to risk management analysis, including tools and techniques necessary for maintaining a secure cloud infrastructure. gain an understanding in cloud software assurance and validation, utilizing secure software, and the controls necessary for developing secure cloud environments. identify privacy issues and audit processes utilized within a cloud environment, including auditing controls, assurance issues, and the specific reporting attributes. Course Format Lecture based, Self-Study & Classroom Discussions.   Learning Objectives In-depth coverage of the six domains required to pass the CCSP exam: Architectural concepts and design requirements Cloud data security Cloud platform and infrastructure security Cloud application security Operations Legal and compliance Course content The CCSP draws from a comprehensive, up-to-date, global common body of knowledge that ensures security leaders have a deep knowledge and understanding of new threats, technologies, regulations, standards, and practices relating to the security & protection of the cloud. The CCSP exam tests ones competence in the 6 domains of the CCSP CBK, which cover:  Domain 1: Architecture Concepts and Design Requirements Cloud Computing ConceptsCloud Reference ArchitectureSecurity Concepts Relevant to Cloud ComputingDesign Principles of Secure Cloud ComputingTrusted Cloud Services Domain 2: Cloud Data Security Cloud Data LifecycleDesign and Implement Cloud Data Storage ArchitecturesDesign and Apply Data Security Strategiesand Implement Data Discovery and Classification TechnologiesDesign and Implement Data Rights ManagementDesign and Implement Relevant Jurisdictional Data Protections for Personally Identifiable Information (PIN)Plan and Implement Data Retention, Deletion, and Archiving PoliciesDesign and Implement Auditability, Traceability, and Accountability of Data Events Domain 3: Cloud Platform and Infrastructure Security Cloud Infrastructure ComponentsRisks Associated to Cloud InfrastructureDesign and Plan Security ControlsPlan Disaster Recovery and Business Continuity Management Domain 4: Cloud Application Security Need for Training and Awareness in Application SecurityCloud Software Assurance and ValidationUse Verified Secure SoftwareSoftware Development Life-Cycle (SDLC) ProcessApply the Software Development Life-CycleSpecifics of Cloud Application ArchitectureDesign Appropriate Identity and Access Management (IAM) Solutions Domain 5: Operations Support the Planning Process for the Data Center DesignImplement and Build Physical Infrastructure for Cloud EnvironmentRun Physical Infrastructure for Cloud EnvironmentManage Physical Infrastructure for Cloud EnvironmentBuild Logical Infrastructure for Cloud EnvironmentRun Logical Infrastructure for Cloud EnvironmentManage Logical Infrastructure for Cloud EnvironmentEnsure Compliance with Regulations and Controls (ITIL, ISO/IEC 20000-I)Conduct Risk Assessment to Logical and Physical InfrastructureCollection, Acquisition, and Preservation of Digital EvidenceManage Communication with Relevant Parties Domain 6. Legal and Compliance Legal Requirements and Unique Risks within the Cloud EnvironmentPrivacy Issues, Including Jurisdictional VariationAudit Process, Methodologies, and Required Adaptions for a Cloud EnvironmentImplications of Cloud to Enterprise Risk ManagementOutsourcing and Cloud Contract DesignExecute Vendor ManagementLegal and compliance [-]