Two Top Cybersecurity Organizations Issue Joint Bulletin on the Importance of Cloud Scoping
Press Release Published: 08/05/2021
PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) join forces to highlight properly scoping cloud environmentsWashington, D.C., August 5, 2021 – Today the PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) issued a joint bulletin to highlig...
Blue Team Diaries: Becoming ‘data-smart’
Blog Published: 08/05/2021
Written by Derek Wood, Open Raven“I can’t afford to not be data-smart.” - Doug Clendening, Principal Services Consultant at Open Raven (Previously Principal Cyber Incident Commander at Splunk) Blue teams aren’t quite the cape-wearing heroes featured in comics, but they aren't far off when it come...
The Importance of Properly Scoping Cloud Environments
Blog Published: 08/05/2021
PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) recently released a joint industry threat bulletin highlighting the importance of properly scoping cloud environments. In this blog, the PCI SSC and CSA share guidance and best practices for properly scoping cloud envi...
Three Network Weaknesses that Zero Trust Addresses
Blog Published: 08/04/2021
Zero Trust is a network security concept that aims to protect enterprise assets. Under Zero Trust, organizations should not automatically trust anything inside or outside traditional perimeters. Before granting access to assets, organizations should require the verification of anything and everyt...
SECtember 2021: Why I’ll Be There
Blog Published: 08/03/2021
Written by Larry Hughes, Principal Compliance Consultant, LJH Compliance ConsultingI first got involved in the Seattle information security scene in 1996. I was busy building a security consulting practice for a startup. It wasn’t long before I met this affable fellow named Jim Reavis, who had al...
Secure Distributed Ledger Technology Framework for Financial Institutes
Blog Published: 08/03/2021
Last updated: February 25, 2022Distributed ledger technologies (DLT) introduce a multitude of value propositions for the financial services industry. The pace of innovation is aggressively picking up in use cases pertaining to finance such as digital assets, tokenization and cryptocurrency. Howev...
How is CSA STAR Different From ISO 27001 and SOC 2?
Blog Published: 08/02/2021
The STAR Registry lists cloud solution providers and security providers that have earned a cloud compliance certification from CSA or submitted a cloud security self-assessment questionnaire. While STAR Level 1 is a basic Yes/No or N/A question set to self-declare your compliance with the Cloud C...
The Use of Blockchain in Healthcare: A Collaboration Between Two CSA Working Groups
Blog Published: 08/02/2021
The unique attributes of healthcare data make it a prime target for nefarious actors. Predictably, healthcare information is tightly regulated by privacy and security laws in the United States, the European Union and international rules governing cloud data storage. The data’s high value, coupled...
An Evolving Healthcare Cybersecurity Landscape
Blog Published: 07/30/2021
Cloud computing is still in its infancy in the healthcare industry, an industry that started experimenting with technology in the 1950s. But the pace of adoption is projected to continue to increase. With clinicians using mobility tools and the Internet of Things, the healthcare industry is colle...
Bad guys are watching for new openings in your cloud, are you?
Blog Published: 07/30/2021
This blog was originally published by Sysdig here.Written by Janet Matsuda, Sysdig CMO.You see the headlines, and perhaps, ‘thank goodness it wasn’t us’ flickers through your mind. An overly permissive web server exposes 100 million+ consumer credit applications, or an S3 bucket leaves hundreds o...
3 Key DevSecOps Trends for 2021
Blog Published: 07/29/2021
This blog was originally published by Blue Hexagon here.Written by Saumitra Das, Blue Hexagon.DevSecOps is a term that means different things to different people. I see it as primarily as an umbrella term for “continuous security” or security that is built into the process of building, shipping, ...
Cloud Security Alliance Releases Guide to Facilitate Cloud Threat Modeling
Press Release Published: 07/29/2021
Document provides tangible exercise for organizations to create their own cloud threat modelSEATTLE – July 29, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing envi...
Can Web Browsers be “Secure” as Required by Federal Cybersecurity Guidelines?
Blog Published: 07/28/2021
This blog was originally published by Ericom Software here.Written by Gerry Grealish, Ericom Software Chief Marketing Officer.The National Institute of Standards and Technology (NIST) issued its “Definition of Critical Software Under Executive Order,” one of the first items to be delivered in res...
Prepare for Passing the CCAK Exam
Blog Published: 07/27/2021
The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. Developed by CSA and ISACA, the CCAK credential and training program fills the need for v...
Deep Dive into the NSA Funded MITRE D3FEND Framework
Blog Published: 07/26/2021
This blog was originally published by Blue Hexagon here.Written by Saumitra Das, Blue Hexagon.MITRE released the D3FEND framework on 6/22/21, an effort funded by the National Security Agency to effectively create a knowledge graph of cybersecurity countermeasure techniques. The goal of this proje...
Detecting new crypto-mining attack targeting Kubeflow and TensorFlow
Blog Published: 07/23/2021
This blog was originally published by Sysdig hereWritten by Stefano Chierici, Security Researcher, SysdigMicrosoft has discovered a new large-scale attack targeting Kubeflow instances to deploy malicious TensorFlow pods, using them to mine Monero cryptocurrency in Kubernetes cluster environments....
Identity and PAM meet in the Cloud
Blog Published: 07/21/2021
By Ravi Erukulla, Sr. Director of Product Management, Saviynt, Inc and Shamun Mahmud, Sr. Research Analyst, CSAAt the end of 2020, CSA published The 2020 State of Identity Security in the Cloud.Goals of the study Determine the use and challenges of public cloud workloads today and 1 year from now...
Building the Next Generation of Cybersecurity and Privacy Professionals
Blog Published: 07/20/2021
ContextIn the past two decades we have witnessed a dramatic evolution in the cyber domain; new technologies have revolutionized the world we live in, our habits, our behaviors and our way of thinking. Cloud Computing, Edge Computing, Internet of Things/Everything, Smart Environments, Artificial I...
Six Key Characteristics of a Modern ZTNA Solution
Blog Published: 07/20/2021
This blog was originally published by Bitglass hereWritten by Jeff Birnbaum, BitglassEven as organizations continue adoption of cloud technologies, the need for secure access to on-premises resources has not gone away. In fact, as many companies navigate a return to the office while simultaneousl...
Scaling GRC Programs: 5 Ways Security Leaders Enable the Business
Blog Published: 07/19/2021
This blog was originally published by OneTrust GRC here.The compliance landscape is in constant flux between external factors changing and businesses working toward scaling GRC programs. Managing compliance is difficult for organizations operating across multiple geographies with multiple sets of...
