How Legacy AST Tools Fail to Secure Cloud Native Applications
Blog Published: 12/17/2021
Written by Ron Vider, Co-Founder & CTO of Oxeye Organizations worldwide are building and deploying cloud native applications, where the architecture is quite different from yesterday’s monolithic counterparts. What used to be a custom code block installed on a single bare metal server or ...
What Did We Learn About Cyber Risk Management in 2021?
Blog Published: 12/17/2021
By Bob Maley, Chief Security Officer at Black Kite “The more things change, the more they stay the same.” Author Jean-Baptiste Alphonse Karr wrote this in 1849 and it still rings true today, especially in cybersecurity. The number of reported data breaches in 2021 have soared past the total for 2...
Keeping up with log4shell aka CVE-2021-44228 aka the log4j version 2
Blog Published: 12/16/2021
Quick note: from now on I will refer to log4j version 2 as “log4j2”If you use Java within your products or services and haven’t yet patched them, please see “Dealing with log4shell aka CVE-2021-44228 aka the log4j version 2”Trick question: Who helped coordinate the global response on CVE-2021-442...
What if We Saw an End to Alert Fatigue?
Blog Published: 12/16/2021
This blog was originally published by Secberus here. Written by Fausto Lendeborg, Secberus. When a violation occurs, the alert isn’t a warning to investigate, it’s a warning to remediate. The challenge is knowing which alerts are the true violations. Enterprises should be less concerned with ...
Cloud Security Alliance Releases Report on Corda Blockchain Framework and Security Controls
Press Release Published: 12/15/2021
Report offers security and risk management leaders and financial regulators ways to proactively prevent, detect, and respond to potential risksSEATTLE – Dec. 15, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best pr...
DevOps Security Tools for Enterprise DevSecOps Teams
Blog Published: 12/15/2021
This blog was originally published by Vulcan Cyber here. Written by Rhett Glauser, Vulcan Cyber. DevOps has revolutionized the pace at which new iterations of applications are released to meet the needs of customers. By nature, security teams are focused on securing company assets and data, which...
Evolving Zero Trust—Lessons Learned and Emerging Trends
Blog Published: 12/15/2021
This blog was originally published by Microsoft on November 3, 2021. Written by Alex Weinert, Director of Identity Security, Microsoft. Looking back at the last two years, to say that our security strategies have evolved would be an understatement. Organizations around the world made overnig...
Dealing with log4shell aka CVE-2021-44228 aka the log4j version 2
Blog Published: 12/14/2021
Quick note: from now on I will refer to log4j version 2 as “log4j2”Update note: This blog entry was updated Dec 17, 2021, to include a note about the second remote code execution vulnerability CVE-2021-45046 in log4jOkay if you haven’t heard about the critical vulnerability in log4j2 then I envy ...
Rethinking the Complex Economics of Cloud
Blog Published: 12/14/2021
This blog was originally published by Booz Allen here. Written by Dan Tucker, Booz Allen. How to optimize cloud for enterprise valueIT and mission leaders often spend numerous budget planning cycles weighing the economics of on-premises versus cloud operations, and that’s completely understandabl...
Blockchain Security and Legaltech
Blog Published: 12/14/2021
Written by Sebastian Soriano, TRATO Since its inception, the blockchain technology has shown promising application prospects. With the rise of technology many industry players are now digitizing and integrating new technologies to ensure cybersecurity in transactions. Among all solutions, t...
HTML Smuggling Evades Traditional Cybersecurity Solutions
Blog Published: 12/13/2021
This blog was originally published by ZTEdge here. Written by Nick Kael, Chief Technology Officer, ZTEdge. Microsoft’s 365 Defender Threat Intelligence Team recently issued a warning about a worrying increase in HTML smuggling attacks, in which hackers “smuggle” encoded malicious script via ema...
The CFO and Cloud Adoption: 101
Blog Published: 12/13/2021
Introduction to the Cloud I always find it interesting to ask people where their organization is at on their cloud journey. Everyone reading this post already has some cloud presence, but one question is where are you on this path to cloud adoption? The immediate follow-up to the first questio...
The Past, Present, and Future of Zero Trust
Blog Published: 12/12/2021
There has been a lot of discussion on the topic of Zero Trust (ZT). CSA has been involved in the realm of ZT since 2013, via the Software Defined Perimeter Working Group (now known as the SDP and Zero Trust Working Group). The first SDP Specification was published in 2014, encompassing the princi...
The Pros and Cons of Using SaaS Security Services
Blog Published: 12/11/2021
Written by the Security Guidance Working GroupIn this blog we discuss the benefits and concerns of security services delivered from the cloud. These services, which are typically SaaS or PaaS, aren’t necessarily used exclusively to protect cloud deployments; they are just as likely to help defend...
Cloud Applications Put Your Data at Risk. Here's How to Regain Control
Blog Published: 12/10/2021
Written by Yaki Faitelson, Co-Founder and CEO of Varonis. Cloud applications boost productivity and ease collaboration. But when it comes to keeping your organization safe from cyberattacks, they're also a big, growing risk. Your data is in more places than ever before. It lives in sanctioned ...
How to Adhere to the AWS Well Architected Framework
Blog Published: 12/10/2021
Originally Published on Fugue’s Website on November 24, 2021 By Becki Lee, Senior Technical Writer The Amazon Web Services Well-Architected Framework is a set of recommendations AWS provides for designing infrastructure for cloud applications and workloads. By following the guidance in the ...
Compliance: Cybersecurity Assurance OR How to Gain the Trust of Your Business Partners
Blog Published: 12/09/2021
By Mustapha Berrabaa – CTO at Fortica Information security is a concern for all organizations, including those that outsource key business operations to third-party vendors (examples: SaaS, cloud service providers). Poorly managed data can expose companies to attacks such as data theft, exto...
DNS-Layer Security: The Ultimate Guide to What It Is and Why You Need It
Blog Published: 12/09/2021
Originally Published by Cisco on March 10, 2020. Written by Lorraine Bellon, Cisco. If you’re like most people, you probably don’t pay much attention to the domain name system (DNS) or worry about investing in cloud-based DNS-layer security. After all, the hallmark of well-functioning DNS servers...
Cloud Security Alliance Releases New Cloud Controls Matrix Auditing Guidelines
Press Release Published: 12/08/2021
Document provides auditors a baseline understanding of the CCM audit areas, allowing them to better perform a CCM-related audit and assessmentSEATTLE – Dec. 8, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best prac...
Managing Partial Offboarding Risks and Other Bad Breakups
Blog Published: 12/08/2021
This blog was originally published by Authomize here. Written by Michael Sheinkman, Authomize. They say that breaking up is hard to do. You grow together, share secrets, and open up to each other. Maybe you even give them a key to your place. But then the relationship ends and all you want is a c...
