Earning Trust in the 21st Century - Creating Trust Frameworks in a Zero Trust World
Blog Published: 01/26/2021
By: Anil Karmel, President, Cloud Security Alliance Washington DC Metro Area Chapter (CSA-DC)Our world is more connected and reliant on technology than ever before, yet we are more disconnected and trust each other less now than ever before. New attacks such as the SolarWinds hack have immense re...
Google Report Highlights Malware Targeting Browser Vulnerabilities
Blog Published: 01/25/2021
By Nick Kael, CTO at EricomThe browser is the targetLast week, Google’s Project Zero exploit research team published reports detailing a sophisticated cyber operation that targeted vulnerabilities in Chrome and Windows, installing malware to exploit weaknesses in the browser and operating system...
Help CSA Develop a New SDP Training - Join the SDP Expert Group
Blog Published: 01/24/2021
Join the Software Defined Perimeter Expert GroupCSA is looking for volunteers to join the CSA Software Defined Perimeter (SDP) Expert Group to help review and advise on the scope, curriculum, objectives, structure, go-to-market strategy and value proposition for an 8 hour CSA SDP Training.This gr...
Cloud Security Alliance’s New Cloud Controls Matrix v4 Adds New Log and Monitoring Domain and More Than 60 New Cloud Security Controls
Press Release Published: 01/21/2021
Represents significant increase in requirements resulting from new cloud technologiesSEATTLE – Jan. 21, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environmen...
The CSA Cloud Controls Matrix (CCM) V4: Raising the cloud security bar to the next level
Blog Published: 01/21/2021
Written by: Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance and Lefteris Skoutaris, CCM Program Manager, Cloud Security AllianceOver the course of the last decade since its first appearance in 2010, the Cloud Controls Matrix (CCM) has become a reference for any organization se...
NACHA Updates | Supplementing Data Security Requirements
Blog Published: 01/19/2021
Written by TokenExIn late 2019, NACHA supplemented its existing Security Framework for the ACH Network with a new rule applying to all merchants, billers, businesses, governments, and third parties that send 2 million or more ACH payments per year. The rule was expected to roll out in two phases,...
CCSK Success Stories: CSA Japan Chapter Executive Director
Blog Published: 01/13/2021
This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In these blogs we invite individuals to share some of the challenges they face in managing security for cloud computing and how they were able to leverage k...
SolarWinds, GitHub Leaks and Securing the Software Supply Chain
Blog Published: 01/11/2021
Written by BluBracketThe massive cybersecurity breach from SolarWinds by now has reached everyone in our industry’s attention. It’s a truly wide-spread and dangerous breach that, at least from what we know now, is an example of two trends in cybersecurity that frankly need more attention by any c...
Lessons Learned from GoDaddy’s Email Phishing Simulation Debacle
Blog Published: 01/08/2021
Written By: Omer Taran, Co-founder & CTO, CybeReadyCISOs and security teams know that running phishing simulations is a tricky business. As security professionals who deal with employee training, one thing we can do to avoid taking the wrong turn is learn from each other’s mistakes. Above any...
Cloud Workload Security: Part 3 - Explaining Azure’s Security Features
Blog Published: 01/07/2021
Written by IntezerCloud security management will always remain an ongoing journey, as threats keep evolving and organizations need to keep updating their cloud security strategy. A well-defined set of security controls and categories helps you set a strong baseline in this journey, irrespective o...
Tokenization vs. Encryption: Which is Better for Your Business?
Blog Published: 01/06/2021
Written by TokenExFinding the right security technology for your company's data can be difficult. There are myriad options and a lot of industry terms and jargon thrown around without much reliable information with which to make a smart business decision. To assist with this process, we're going ...
Cloud Workload Security: Part 2 - Security Features of AWS
Blog Published: 12/28/2020
Written by IntezerThis article is the second post in our five-part series on security in the cloud today. In Part 1, we discussed what you need to focus on when developing your cloud security strategy, along with some controls you should consider and the best approach for implementing them. The r...
Cloud Workload Security: What You Need to Know - Part 1
Blog Published: 12/21/2020
Written by IntezerCloud proliferation is on the rise, and more than ever before, security teams are on the lookout for solutions that align with evolving cloud security paradigms. Given the evolving threat landscapes and more sophisticated cyber attacks being reported daily, it’s clear that your ...
Using CSA STAR to Improve Cloud Governance and Compliance
Blog Published: 12/19/2020
By John DiMaria, Assurance Investigatory Fellow, Cloud Security AllianceThe more complex systems become, the less secure they are, even though security technologies improve. There are many reasons for this, but it can all be traced back to the problem of complexity. Why? Because we give a lot of ...
How Does PCI DSS Protect Cardholder Data?
Blog Published: 12/17/2020
By Branden Marrow from TokenEx The Payment Card Industry Data Security Standard (PCI DSS) is a payment industry security regulation developed, maintained, and enforced by the Payment Card Industry Security Standards Council (PCI SSC) to protect cardholder data (CHD). The council tasks organizatio...
SolarWinds - How Cybersecurity Teams Should Respond
Blog Published: 12/16/2020
By Paul Kurtz Co-founder and Executive Chairman, TruSTAR Technology SolarWinds perhaps represents the most severe hack of the digital age. The playbook of our adversaries continues to evolve, but defenders are losing, and the gap is widening. Discussion of imposing consequences on adversaries see...
Migrating to the Cloud: Compliance Issues When Transitioning from a Traditional Data Center
Blog Published: 12/16/2020
Written by IntezerFor traditional data center operations, security and compliance requirements have always been operational overhead. Traditional data centers are under unique stresses in today’s world. There are pressures to make data centers more flexible and adaptable to business needs—such as...
CCSK Success Stories: From the Managing Director of a Consulting Firm
Blog Published: 12/14/2020
This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In these blogs we invite individuals to share some of the challenges they face in managing security for cloud computing and how they were able to leverage k...
Are Containers More Secure Than VMs?
Blog Published: 12/11/2020
Contributed by IntezerStop and think for a moment. How many virtual machines (VMs) do you have running in your production cloud environment? How many containers? Can you easily formulate the percentage split for your workload mix? 50/50? 80/20?Here’s a better question: How secure do you think you...
Security Policies | Q&A with TokenEx Industry Experts
Blog Published: 12/10/2020
Contributed by TokenExSecurity Policies | What You Need to KnowWhat is a Security Policy?Security policies are internal frameworks that formally document an organization’s requirements for the safe handling of sensitive information and assets. Effective security policies tend to be developed for ...
