@hselmak wrote:
Wow! Thanks for sharing your story first of all. It’s an eye opener for other CISSPs too! I attended a skillsoft CCSP bootcamp recently and the instructor mentioned that “CCSP is more of a tweaked CISSP, and that it’s made by CISSPs for CISSPs”, but your experience is a game changer to that notion.
My sense is the CCSP is kind of a certification lost on the seas of security without a home port. Cloud security varies so much depending on the type of service (and, in some cases, service provider) that the CCSP content may feel too broad. While I haven't looked at the most recent CBK, I agree the prior versions really seemed to be built upon the foundation of the CISSP plus some more business focused concepts. As an example, you need to understand risk management well for cloud security due to the variation in pricing models across different service types. The CCSP CBK didn't really hit on that (again, I haven't looked at the most recent), but if you have that it may help you get the big picture that makes a lot of the CCSP content fall into place.
To me that is the big wrinkle that has come with the cloud is it really forces security folks to understand business drivers. Back in the on-premise days there weren't as many variables. Part and parcel with that is being able to communicate security to the business folks. To them, they think data and applications are just a box that you are moving from an on-premise closet to some "cloud." That move literally changes the security context of everything. I think that's the hard part of the CCSP. It's trying to certify a range of knowledge that typically is built up in steps (business, sense, security sense, and knowledge of particular providers).
