How we ended up with #log4shell aka CVE-2021-44228
Blog Published: 01/10/2022
Quick note: from now on I will refer to log4j version 2 as “log4j2” To learn how to deal with the critical vulnerability in log4j2, read the first blog in this series, Dealing with log4shell. To get a breakdown of the timeline of events, refer to the second blog, Keeping up with log4shell. So how...
Healthcare Cybersecurity: 8 Data Protection Best Practices
Blog Published: 01/07/2022
This blog was originally published by BigID here. Written by Kimberly Steele, BigID. Healthcare organizations need to look beyond compliance to reduce risk, implement robust data management, and achieve a data protection program that balances safeguarding patient data with providing the highest q...
Too Much of a Good Thing — Too Much Flexibility in Permission Management is Putting IAM Security at Risk
Blog Published: 01/06/2022
This blog was originally published by Authomize here. Written by Gabriel Avner, Authomize. As cloud services like Salesforce, AWS, and others have grown more robust over time, they have added more options for how IAM security teams can manage their organizations’ access policies.This increased fl...
Cloud Security Alliance Releases Guidance on Use of Artificial Intelligence (AI) in Healthcare
Press Release Published: 01/06/2022
Document shares the fundamentals and current challenges facing the use of AI in healthcare and offers guidance and predictions for its future useSEATTLE – Jan. 6, 2022 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best p...
How SSO and SaaS Make Spear-phishing Attacks More Dangerous
Blog Published: 01/05/2022
Written by Varonis If you watch in real-time the actual tools that hackers use to compromise services and leverage that access to devastating purpose much of the theoretical questions of “Could we really get hit by an attack?” and “How bad could it really be?” fly out the window. Reality hits par...
Deception as a Form of Defense
Blog Published: 01/04/2022
Written by Jordi Vilanova, Cloudtango With thousands of breaches occurring annually, organizations must get creative when it comes to building a comprehensive and adaptive security defense plan. Detecting threats early inside any environment is critical to prevent data exfiltration and other type...
Predictions 2022: Work-From-Anywhere Marks the Beginning of the End of On-Premises Security
Blog Published: 01/04/2022
This blog was originally published by Lookout here. Written by Sundaram Lakshmanan, CTO of SASE Products, Lookout. A decade ago, many were reluctant to move to the cloud. Many felt like they would have to relinquish controls they had within their perimeters. That sentiment has since reversed, whe...
Not All Visibility Is Created Equal – What Are You Looking For?
Blog Published: 01/03/2022
This blog was originally published by Valtix here. Written by Vishal Jain, Valtix. For enterprises, security-related visibility in the cloud is critical. For many, especially as they try to gain an understanding of what they have in the cloud, how it’s set up, and what’s happening, often across m...
SECtember 2021: Ransomware Isn’t Going Anywhere
Blog Published: 12/30/2021
This past September, CSA hosted SECtember 2021, the premier cloud security conference that features the best cloud security minds in the industry. If you missed it in person, we’ve got you covered. In our last recap blog, we discussed the Zero Trust sessions at the event. Now, here are some highl...
The Three Pillars of a CARTA-enabled CSPM Strategy
Blog Published: 12/28/2021
This blog was originally published by Secberus here. Written by Fausto Lendeborg, Secberus. The cloud has changed how enterprises operate today. It has allowed companies to more easily store and share data. And with all this new data, it's increasingly important to make sure your security strat...
Microservices Architecture Patterns: Working Together to Secure the Cloud
Blog Published: 12/27/2021
Written by the CSA Application Containers and Microservices Working GroupThe secure development of microservices relies on architecture patterns. In the following blog, review these microservices architecture patterns and note how many are able to work together to form a secure cloud system. The ...
Cloud Cost Optimization: A Pivotal Part of Cloud Strategy
Blog Published: 12/23/2021
Written by Gaurav Aggarwal, Avanade. This article was originally published on Forbes. It has also been previously published by Avanade. Cloud has undoubtedly been one of the clear winners in the Covid-19-induced digital transformation journey for most companies. However, managing costs is one of ...
Single-Tenant Versus Multitenant SaaS Solutions: When Does it Matter?
Blog Published: 12/22/2021
Written by Morey J. Haber, BeyondTrust Today, there are many cloud-native, software-as-a-service (SaaS) solutions, built and optimized for the cloud, from which to choose. Yet, many competing solutions continue to tout themselves as “cloud-based”, even though they really represent just a lift and...
The Quest for Multi-Party Recognition
Blog Published: 12/22/2021
The CSA Security Update podcast is hosted by John DiMaria, CSA Assurance Investigatory Fellow, and explores the STAR Program, CSA best practices, research, and associated technologies and tools. This blog is part of a series where we edit key CSA Security Update episodes into shorter Q&As. In...
Data Security is Physical Security
Blog Published: 12/21/2021
This blog was originally published by Authomize here. Written by Gabriel Avner, Authomize. Online streaming platform Twitch was hacked last week and the memes were fantastic.In case you missed it, a hacker reportedly stole 125 GB of valuable data from the Amazon-owned streaming service. The stole...
How to Use Kubernetes Audit Logs to Identify Potential Security Issues
Blog Published: 12/21/2021
This blog was originally published by ARMO here. Written by Amir Kaushansky, ARMO. Audit logging involves recording transactions and system events, making it an invaluable tool for regulatory compliance, digital forensics, and information security. In a typical Kubernetes ecosystem, auditing invo...
Capital One Breach: Is Your AWS Environment Just as Susceptible?
Blog Published: 12/20/2021
This blog was originally published on August 9, 2019 by JupiterOne. The Opportunity for Security Teams It’s been a little over a week since the coverage of the Capital One data breach. The impact of 100 million plus records that were compromised breathed gasoline onto the fiery debate as to w...
Top Tips for Ransomware Defense
Blog Published: 12/20/2021
This blog was originally published by Cisco here. Written by Angela Frechette Cannon, Cisco. Ransomware is wreaking havoc. What can we do?Ransomware is making its way outside the cybersecurity space. It’s popping up everywhere from the nightly news to the G7 Summit. Indeed ransomware has entered ...
Zero Trust in the Spotlight at SECtember 2021
Blog Published: 12/18/2021
This past September, CSA hosted SECtember 2021, the premier cloud security conference that features the best cloud security minds in the industry. If you missed it in person, we’ve got you covered. In our first recap blog, we discussed the presentations from the three keynote speakers at the even...
CSA 2022 Priorities: Cloud & Collaboration
Blog Published: 12/17/2021
This time of year I am often asked to make industry predictions, which I do – poorly. So this time around, I thought I would focus on making predictions about what Cloud Security Alliance will be working on in 2022, I should get at least 50% of it right. Let’s get started!Zero TrustThis is certai...
