Certificate of Cloud Security Knowledge (CCSK v5) Study Guide

Chapter 4. Guide to Cloud Organization Management

Good order is the foundation of all things.

Edmund Burke

Multiple reports state that in 2024, the “average” company was using more than 300 SaaS applications. However, these numbers can be misleading. So let’s be conservative and cut that stated number in half. That leaves us with more than 150 different applications where data is stored and a lot of applications that need to be secured and managed.

Now consider IaaS and PaaS usage. How many applications and systems does an organization run in these service models? Does the organization use multiple clouds where it may have workloads in multiple IaaS providers? This adoption of multiple SaaS, PaaS, and IaaS services, either purposefully to meet business requirements, through mergers and acquisitions, or through the lack of governance, is commonly referred to as cloud sprawl.

Securing and managing all these different environments is what this chapter is about. Let’s get into it with a view of managing larger IaaS implementations with organizational management approaches. Subsequent sections of this chapter will address common security controls for SaaS, hybrid cloud security, and multicloud environments.

Organizational Hierarchy Models

Before we dive into the core material of this section, I’m going to provide some key definitions. All CSPs offer similar features. This is what the CSA calls feature parity. Providers will likely use different names for the same concept. How they ...