Unveiling the Dark Arts of Exploiting Trust
Blog Published: 05/14/2024
Originally published by CXO REvolutionaries. Written by Tony Fergusson, CISO in Residence, Zscaler.Trust is a fundamental aspect of human interaction, forming the foundation of relationships and societal harmony. However, trust can be deceptive, concealing hidden vulnerabilities that emerge when ...
The Importance of Securing Your Organization Against Insider and Offboarding Risks
Blog Published: 05/14/2024
Written by Wing Security.Offboarding employees may seem like a routine administrative task, but the security risks it poses are anything but ordinary. In today's interconnected digital landscape, failing to properly revoke access for departing employees can lead to catastrophic data breaches, com...
What is Management Plane (Metastructure) Security
Blog Published: 05/13/2024
Written by Ashwin Chaudhary, CEO, Accedere.Metastructure refers to the protocols and mechanisms that provide the interface between the infrastructure layer and the other layers. The glue that ties the technologies and enables management and configuration as per Cloud Security Alliance's Security ...
New SEC Rules: Material Incident Reporting Through Cybersecurity Disclosures
Blog Published: 05/13/2024
Originally published by Cyera.Written by Jonathan Sharabi.The Securities and Exchange Commission (SEC) rules set forth on July 26th, 2023, require that nearly all companies that file documents with the SEC (“registrants”) must describe the processes and management procedures they use to assess, i...
5 Best Practices to Secure Your Azure Resources
Blog Published: 05/13/2024
Originally published by CrowdStrike.Cloud computing has become the backbone for modern businesses due to its scalability, flexibility and cost-efficiency. As organizations choose cloud service providers to power their technological transformations, they must also properly secure their cloud envir...
Zero Trust & Identity and Access Management: Mitigating Shadow Access
Blog Published: 05/10/2024
Written by the CSA Identity and Access Management Working Group.In today's digitally interconnected landscape, understanding the intricacies of Identity and Access Management (IAM) is imperative for safeguarding organizational assets. A looming threat to IAM is Shadow Access. This insidious menac...
How Continuous Controls Monitoring Brings IT Unity & Agility
Blog Published: 05/10/2024
Originally published by RegScale.Written by Larry Whiteside Jr.Throughout my tenure as an operational CISO, there were countless moments when I yearned for things to unfold in a more streamlined manner. I had a clear vision for my team, which frequently grappled with being overburdened, understaf...
A Risk-Based Approach to Vulnerability Management
Blog Published: 05/10/2024
Written by Devin Maguire, ArmorCode.Security and risk are related but not synonymous. Security prevents, detects, and responds to attacks and is a key variable in the broader category of risk management. Risk management weighs the probability and impact of adverse events across the organization t...
Utah S.B. 149: Creating a Safe Space for Developers While Regulating Deceptive AI
Blog Published: 05/09/2024
Originally published by Truyo.Written by Dan Clarke.Utah’s foray into the realm of artificial intelligence (AI) regulation is marked by the passage of Senate Bill 149, the Artificial Intelligence Policy Act. While many states grapple with the complexities of AI governance, Utah’s rather fast and ...
Building Resilience Against Recurrence with Cloud Remediation
Blog Published: 05/09/2024
Originally published by Tamnoon.Written by Michael St.Onge, Principal Security Architect, Tamnoon.In the fast-evolving cloud security landscape, successful remediation isn’t just about fixing issues when they arise – it’s equally about preventing the recurrence of these issues.Prevention is the f...
CSA Community Spotlight: Educating the Security Industry with CISO Rick Doten
Blog Published: 05/08/2024
Can you believe that CSA has been defining and raising awareness of cloud security best practices for 15 years? Over the course of these several years, we’ve been educating the community with our volunteer-driven research publications, trainings, certificate programs, in-person and virtual events...
Cloud Security Alliance Announces Additional Mappings Between Cloud Controls Matrix (CCM) and National Institute of Standards and Technology’s (NIST) Cybersecurity Framework (CSF)
Press Release Published: 05/08/2024
Mapping identifies misalignment and gaps between updated CCM and CSFRSA Conference (San Francisco) – May 8, 2024 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing enviro...
Navigating Legacy Infrastructure: A CISO’s Strategy for Success
Blog Published: 05/08/2024
Originally published by Pentera.Every company has some level of tech debt. Unless you’re a brand new start-up, you most likely have a patchwork of solutions that have been implemented throughout the years, often under various leadership teams with different priorities and goals. As those technol...
Cloud Security Alliance Paper Addresses Challenges of Implementing Zero Trust in Environments Where Artificial Intelligence (AI)-induced Shadow Access Is Prevalent
Press Release Published: 05/07/2024
Traditional Zero Trust approaches must adapt to the nuances of Generative AI (GenAI) technology to strengthen cybersecurityRSA Conference (San Francisco) – May 7, 2024 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best p...
The Narrow Escape from the xz Disaster
Blog Published: 05/07/2024
Originally published by Dazz.Written by Tomer Schwartz, Co-founder & CTO, Dazz.In the intricate world of software supply chain, the recent near-miss incident with CVE-2024-3094–the xz/liblzma backdoor–serves as a potent reminder of our system's fragility and the constant vigilance required to...
Enterprise Management Associates Names Cloud Security Alliance as a Cutting-Edge Security Exhibitor in Its Vendor Vision 2024 Report for RSA
Press Release Published: 05/07/2024
CSA was the only nonprofit to be named in the reportSAN FRANCISCO (RSA Conference) – May 7, 2024 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, is please...
Is Managed Kubernetes the Right Choice for My Organization?
Blog Published: 05/07/2024
Originally published by Tenable. Written by Mark Beblow. Many enterprises have adopted container technology because it helps them to streamline the building, testing and deploying of applications. The benefits of container technology include better resource efficiency, portability, consistency ...
Cyber Defense Magazine Names Cloud Security Alliance’s Certificate of Competence in Zero Trust (CCZT) a 2024 Global InfoSec Award Winner for Cutting-Edge Cybersecurity Training
Press Release Published: 05/06/2024
CCZT helps security professionals build knowledge to drive the definition, implementation, and management of Zero TrustSAN FRANCISCO (RSA Conference) – May 6, 2024 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best pract...
The Anatomy of an ALPHA SPIDER Attack
Blog Published: 05/06/2024
Originally published by CrowdStrike.ALPHA SPIDER is the adversary behind the development and operation of the Alphv ransomware as a service (RaaS).Over the last year, ALPHA SPIDER affiliates have been leveraging a variety of novel techniques as part of their ransomware operations.CrowdStrike Serv...
Resource Constraints in Kubernetes and Security
Blog Published: 05/06/2024
A Practical GuideOriginally published by Sysdig.Written by Nigel Douglas.The Sysdig 2024 Cloud‑Native Security and Usage Report highlights the evolving threat landscape, but more importantly, as the adoption of cloud-native technologies such as container and Kubernetes continue to increase, not a...
