Pelatihan ini dirancang untuk membekali peserta dengan pemahaman mendalam mengenai keamanan cloud dan kepatuhan regulasi di sektor perbankan. Fokus utama adalah melindungi data nasabah, transaksi, dan layanan perbankan yang dioperasikan di cloud—baik private, hybrid, maupun public cloud—dari risiko siber, kebocoran data, maupun penyalahgunaan akses. Peserta akan mempelajari arsitektur cloud, model deployment, shared responsibility model, serta ancaman spesifik cloud seperti misconfiguration, account hijacking, insecure API, dan insider threat.
Selain itu, pelatihan membahas secara praktis integrasi keamanan cloud dengan kebijakan internal dan regulasi perbankan, seperti OJK, BI, ISO 27001, PCI DSS, dan GDPR (jika relevan). Peserta akan diajarkan cara merancang kebijakan cloud security yang efektif, melakukan audit kepatuhan, mengoperasikan cloud-native security tools, dan membangun strategi mitigasi risiko berbasis threat intelligence. Dengan pendekatan studi kasus, simulasi konfigurasi, dan evaluasi compliance checklist, peserta siap mengelola cloud bank secara aman, resilient, dan sesuai peraturan.
OBJECTIVE
- Memahami konsep cloud computing dan model deployment (public, private, hybrid) di sektor perbankan.
- Menguasai prinsip keamanan cloud, termasuk shared responsibility model dan kontrol akses.
- Mampu mengidentifikasi risiko cloud, seperti misconfiguration, insider threat, dan account hijacking.
- Menyusun kebijakan cloud security yang selaras dengan regulasi perbankan dan standar internasional.
- Mengoperasikan cloud-native security tools, termasuk monitoring, IAM, logging, dan enkripsi.
- Melakukan audit kepatuhan cloud (compliance audit) dan mitigasi risiko.
- Menyusun strategi incident response untuk insiden cloud security.
- Membuat roadmap keamanan cloud yang berkelanjutan dan terintegrasi ke arsitektur bank.
COURSE OUTLINE
A. Dasar-Dasar Cloud Computing untuk Perbankan
- Model deployment: Public, Private, Hybrid, Multi-cloud.
- Model layanan: IaaS, PaaS, SaaS, FaaS.
- Shared Responsibility Model: peran bank vs penyedia cloud.
- Perbedaan risiko antara cloud dan on-premise.
B. Landscape Ancaman & Risiko Cloud
- Misconfiguration: storage exposure, open ports, insecure APIs.
- Account hijacking: credential theft, phishing, brute force.
- Insider threat: misuse of privileged access.
- Advanced threats: ransomware in cloud, lateral movement, privilege escalation.
C. Cloud Security Architecture & Best Practices
- Identity & Access Management (IAM)
- Role-based access control (RBAC), least privilege, multi-factor authentication.
- Separation of duties dan audit trail.
- Data Protection
- Data encryption at rest & in transit, key management, tokenization, masking.
- Backup, retention, disaster recovery, and business continuity.
- Network & Perimeter Security
- Virtual network segmentation, firewalls, security groups, VPN.
- Monitoring traffic anomalies, intrusion detection in cloud.
- Application Security
- Secure coding practices, API security, vulnerability scanning.
- WAF deployment dan runtime protection.
D. Cloud Security Operations & Monitoring
- Logging & monitoring: CloudTrail, CloudWatch, SIEM integration.
- Threat detection: anomaly detection, behavior analytics, automated alerts.
- Security automation: auto-remediation, configuration enforcement, SOAR.
E. Compliance & Regulatory Framework
- Peraturan OJK dan BI terkait cloud banking.
- ISO 27001 Annex A, PCI DSS, NIST CSF terkait cloud controls.
- Audit cloud: konfigurasi, IAM, data residency, SLA compliance.
- Reporting & documentation untuk regulator.
F. Incident Response untuk Cloud Environment
- Identifikasi insiden: data breach, misconfiguration, compromised account.
- Containment & eradication: isolate affected instance, revoke access, patch vulnerabilities.
- Recovery & post-mortem: restore from backup, update policies, lessons learned.
- Integrasi IR cloud ke SOC bank.
G. Cloud Governance & Policy Management
- Definisi policy cloud security internal: data classification, access rules, approval workflow.
- Continuous compliance monitoring: automated policy checks, audit alerts.
- Vendor risk management: cloud service provider SLA, compliance assessment.
H. Cloud Security Tools & Automation
- CASB, Cloud-native firewalls, EDR for cloud endpoints.
- Configuration monitoring: AWS Config, Azure Policy, GCP Security Command Center.
- Infrastructure as Code (IaC) security: scanning Terraform, CloudFormation, ARM templates.
I. Security Awareness & Human Factor
- Training staff: phishing, secure access practices, privileged account handling.
- Insider threat prevention: monitoring, alerts, policy enforcement.
J. Roadmap & Maturity Model Cloud Security
- Short-term: baseline hardening, IAM control, basic monitoring.
- Mid-term: automation, policy enforcement, integrated logging/SIEM.
- Long-term: continuous compliance, proactive threat intelligence, multi-cloud governance.
