All Articles

All Articles
You Can’t Detect What You Can’t See – In Real-Time. The Modern Cloud Security Edition

Blog Published: 08/06/2021

This blog was originally published by Blue Hexagon here.Written by Arun Raman, Blue Hexagon.There is an old maxim in cybersecurity: “You cannot detect what you cannot see.” While we hold the need for security visibility as a self-evident truth, there are implications for a cloud security architec...

The Visionary CCM/CAIQ v4 Early Adopters

Blog Published: 08/06/2021

This blog was updated on 8/16/21 with the news that organizations can now submit CAIQ v4 to the STAR Registry.The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing aligned to CSA best practices and is considered the de-facto standard for cloud security and priva...

The Importance of Properly Scoping Cloud Environments

Blog Published: 08/05/2021

PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) recently released a joint industry threat bulletin highlighting the importance of properly scoping cloud environments. In this blog, the PCI SSC and CSA share guidance and best practices for properly scoping cloud envi...

Two Top Cybersecurity Organizations Issue Joint Bulletin on the Importance of Cloud Scoping

Press Release Published: 08/05/2021

PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) join forces to highlight properly scoping cloud environmentsWashington, D.C., August 5, 2021 – Today the PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) issued a joint bulletin to highlig...

Blue Team Diaries: Becoming ‘data-smart’

Blog Published: 08/05/2021

Written by Derek Wood, Open Raven“I can’t afford to not be data-smart.” - Doug Clendening, Principal Services Consultant at Open Raven (Previously Principal Cyber Incident Commander at Splunk) Blue teams aren’t quite the cape-wearing heroes featured in comics, but they aren't far off when it come...

Three Network Weaknesses that Zero Trust Addresses

Blog Published: 08/04/2021

Zero Trust is a network security concept that aims to protect enterprise assets. Under Zero Trust, organizations should not automatically trust anything inside or outside traditional perimeters. Before granting access to assets, organizations should require the verification of anything and everyt...

SECtember 2021: Why I’ll Be There

Blog Published: 08/03/2021

Written by Larry Hughes, Principal Compliance Consultant, LJH Compliance ConsultingI first got involved in the Seattle information security scene in 1996. I was busy building a security consulting practice for a startup. It wasn’t long before I met this affable fellow named Jim Reavis, who had al...

Secure Distributed Ledger Technology Framework for Financial Institutes

Blog Published: 08/03/2021

Last updated: August 3, 2021Distributed ledger technologies (DLT) introduce a multitude of value propositions for the financial services industry. The pace of innovation is aggressively picking up in use cases pertaining to finance such as digital assets, tokenization and cryptocurrency. However,...

How is CSA STAR Different From ISO 27001 and SOC 2?

Blog Published: 08/02/2021

The STAR Registry lists cloud solution providers and security providers that have earned a cloud compliance certification from CSA or submitted a cloud security self-assessment questionnaire. While STAR Level 1 is a basic Yes/No or N/A question set to self-declare your compliance with the Cloud C...

The Use of Blockchain in Healthcare: A Collaboration Between Two CSA Working Groups

Blog Published: 08/02/2021

The unique attributes of healthcare data make it a prime target for nefarious actors. Predictably, healthcare information is tightly regulated by privacy and security laws in the United States, the European Union and international rules governing cloud data storage. The data’s high value, coupled...

An Evolving Healthcare Cybersecurity Landscape

Blog Published: 07/30/2021

Cloud computing is still in its infancy in the healthcare industry, an industry that started experimenting with technology in the 1950s. But the pace of adoption is projected to continue to increase. With clinicians using mobility tools and the Internet of Things, the healthcare industry is colle...

Bad guys are watching for new openings in your cloud, are you?

Blog Published: 07/30/2021

This blog was originally published by Sysdig here.Written by Janet Matsuda, Sysdig CMO.You see the headlines, and perhaps, ‘thank goodness it wasn’t us’ flickers through your mind. An overly permissive web server exposes 100 million+ consumer credit applications, or an S3 bucket leaves hundreds o...

3 Key DevSecOps Trends for 2021

Blog Published: 07/29/2021

This blog was originally published by Blue Hexagon here.Written by Saumitra Das, Blue Hexagon.DevSecOps is a term that means different things to different people. I see it as primarily as an umbrella term for “continuous security” or security that is built into the process of building, shipping, ...

Cloud Security Alliance Releases Guide to Facilitate Cloud Threat Modeling

Press Release Published: 07/29/2021

Document provides tangible exercise for organizations to create their own cloud threat modelSEATTLE – July 29, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing envi...

Can Web Browsers be “Secure” as Required by Federal Cybersecurity Guidelines?

Blog Published: 07/28/2021

This blog was originally published by Ericom Software here.Written by Gerry Grealish, Ericom Software Chief Marketing Officer.The National Institute of Standards and Technology (NIST) issued its “Definition of Critical Software Under Executive Order,” one of the first items to be delivered in res...

Prepare for Passing the CCAK Exam

Blog Published: 07/27/2021

The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. Developed by CSA and ISACA, the CCAK credential and training program fills the need for v...

Deep Dive into the NSA Funded MITRE D3FEND Framework

Blog Published: 07/26/2021

This blog was originally published by Blue Hexagon here.Written by Saumitra Das, Blue Hexagon.MITRE released the D3FEND framework on 6/22/21, an effort funded by the National Security Agency to effectively create a knowledge graph of cybersecurity countermeasure techniques. The goal of this proje...

Detecting new crypto-mining attack targeting Kubeflow and TensorFlow

Blog Published: 07/23/2021

This blog was originally published by Sysdig hereWritten by Stefano Chierici, Security Researcher, SysdigMicrosoft has discovered a new large-scale attack targeting Kubeflow instances to deploy malicious TensorFlow pods, using them to mine Monero cryptocurrency in Kubernetes cluster environments....

Identity and PAM meet in the Cloud

Blog Published: 07/21/2021

By Ravi Erukulla, Sr. Director of Product Management, Saviynt, Inc and Shamun Mahmud, Sr. Research Analyst, CSAAt the end of 2020, CSA published The 2020 State of Identity Security in the Cloud.Goals of the study Determine the use and challenges of public cloud workloads today and 1 year from now...

Certificate of Cloud Security Knowledge (CCSK) Modules for Non-Tech Staff

Blog Published: 07/21/2021

The Certificate of Cloud Security Knowledge (CCSK) is a standard of expertise for cloud security. While this is a certificate that technical professionals typically strive to earn, the study materials can also offer valuable lessons to non-technical staff interested in gaining a general understan...

Looking for the CCM?

Start using the Cloud Controls Matrix to simplify compliance with multiple standards & regulations.