Cloud 101CircleEventsBlog
Master CSA’s Security, Trust, Assurance, and Risk program—download the STAR Prep Kit for essential tools to enhance your assurance!

All Articles

All Articles
The Way You Protect Your Customers' Data Is Fundamentally Changing

Blog Published: 11/10/2020

By WhisticAs an InfoSec professional, you’ve seen your fair share of growth and change in the industry. Information security presents an interesting challenge because the technology is actively solving for very real threats and risks. As the technology used by malicious forces grows and expands i...

What is cloud security? How is it different from traditional on-premises network security?

Blog Published: 11/09/2020

Cloud is also becoming the back end for all forms of computing, including the ubiquitous Internet of Things and is the foundation for the information security industry. New ways of organizing compute, such as containerization and DevOps are inseparable from cloud and accelerating the digital revo...

Cloud Security Alliance Releases Key Management in Cloud Services: Understanding Encryption's Desired Outcomes and Limitations

Press Release Published: 11/09/2020

Document illustrates use of four key management patterns with cloud services, provides usage recommendations for managing data privacy, security expectationsSEATTLE – Nov. 9, 2020 –The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of b...

SaaS Security Series: Salesforce Guest User Log Analysis

Blog Published: 11/05/2020

By Drew Gatchell, Senior Engineer at AppOmniIn early October, Security Researcher Aaron Costello published a blog detailing how to leverage Aura (aka Lightning) Controllers as an anonymous guest user to extract and manipulate data within a misconfigured Salesforce Community, Portal, or Site.This...

CCSK Success Stories: Cloud Security Education and the Digital Transformation

Blog Published: 11/04/2020

This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In these blogs we invite individuals to share some of the challenges they face in managing security for cloud computing and how they were able to leverage k...

The 10 Best Practices in Cloud Data Security

Blog Published: 11/03/2020

By Branden Morrow from TokenExCloud Data Security Best Practices OverviewWhat exactly is cloud data security?Cloud security is the culmination of technologies and procedures that secure cloud computing environments against cybersecurity threats originating externally and internally. With cloud co...

Why lions shouldn’t invest in DeFi Smart Contracts

Blog Published: 11/02/2020

By Kurt Seifried, Chief Blockchain Officer at Cloud Security AllianceThis article is not legal or investment advice, it covers some aspects of front running in DeFi, and potential security solutions. This article also assumes you have a relatively deep understanding of the following Blockchain/DL...

Five Actions to Mitigate the Financial Damage of Ransomware

Blog Published: 10/30/2020

By Eran Farajun, Executive Vice President at Asigra, Inc.Ransomware attacks have become a regular occurrence for organizations today, with events that are increasingly targeted, sophisticated, and costly. According to recent reports by the Federal Bureau of Investigation[1], cybercriminals are ta...

Cloud Security: The Necessity of Threat Hunting

Blog Published: 10/28/2020

By the CSA Minnesota Chapter What is threat hunting? Threat hunting is the proactive search for real and potential threats that may be hidden in a network’s environment. These threats are tricky and malicious and are designed to pass through endpoint defenses undetected. If unfound, these attack...

6 Data Governance Best Practices in 2020

Blog Published: 10/27/2020

By Dillon Phillips from TokenExData governance is an essential practice in today’s digital landscape, but it's a broad topic that needs to be deeply understood in order to be implemented efficiently and effectively. Building on the information we introduced in our previous post (“What is Data Gov...

Over 200 Documented Blockchain Attacks, Vulnerabilities and Weaknesses

Blog Published: 10/26/2020

Blockchain attacks are very hot right now for one simple reason: it’s where the money is. If you attack and compromise a database you need to take that data and then sell it to monetize your attack. If you compromise a web server you need to install some malware to harvest credit card details, an...

​Vendor Management Software Evaluation: How to Get Executive Buy-In

Blog Published: 10/23/2020

Written by WhisticFor most InfoSec teams, the benefits of a vendor risk management platform are well defined. From making it easier to mitigate third-party risk to ensuring your internal team and external vendors are on the same page, vendor management software is a must-have in today’s open-sour...

​Mitigation Measures for Risks, Threats, and Vulnerabilities in Hybrid Cloud Environment

Blog Published: 10/22/2020

Hybrid clouds are often the starting point for organizations in their cloud journey. However, any cloud model consists of risks, threats, and vulnerabilities. Earlier this year, the Hybrid Cloud Security Working Group examined hybrid cloud model risks, threats, and vulnerabilities in its ‘Hybrid ...

Data Privacy vs. Data Security: What is the Core Difference?

Blog Published: 10/20/2020

This blog was originally published on TokenEx.Written by Dillon Phillips from TokenExFor organizations that collect or manage data—and individuals who own it—private data and the security of that data should not be taken lightly. They are primary concerns when undertaking the process of protectin...

How secure are your SaaS applications?

Blog Published: 10/19/2020

Written by Ian Sharpe, Product Leader at AppOmni The dynamic nature of protecting the enterprise technology stack has always been a challenge for security teams. The complexities of this year, however, have forced teams to consider a new set of paradigms and additional risks given the abrupt shif...

What is the Cloud Controls Matrix (CCM)?

Blog Published: 10/16/2020

What is the Cloud Controls Matrix?The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing. It is a spreadsheet that lists 16 domains covering all key aspects of cloud technology. Each domain is broken up into 133 control objectives. It can be used as a tool to...

How to Address the Security Risks of Cloud OS

Blog Published: 10/15/2020

Written by: Xiaoyu Ge, co-chair of the Cloud Component Specifications Working GroupFrom a user perspective, the cloud is a service. However, for cloud service providers, integrators, and channel partners who construct or build the cloud, it is a system that may comprise many separate components. ...

AWS Cloud Security Report 2020 for Management: Managing the Rapid Shift to Cloud

Blog Published: 10/14/2020

By CloudPassageNew cloud technologies, including infrastructure as code, containers, and machine learning help organizations increase efficiency and scalability, but also introduce the potential for new security vulnerabilities. As more companies rapidly migrate toward flexible cloud solutions th...

​Thinking Like a Cloud Hacker: Part 1

Blog Published: 10/13/2020

Originally Published September 30, 2020 on Fugue’s websiteBy Josh Stella Co-Founder and CTO, FugueIn writing this, my objective is to examine some real world, published cloud exploits and examine both the motivations and techniques of the hackers responsible for them so that you can understand wh...

​CCSK Success Stories: From a Security Consultant

Blog Published: 10/12/2020

This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In these blogs we invite individuals to share some of the challenges they face in managing security for cloud computing and how they were able to leverage k...

Looking for the CCM?

Start using the Cloud Controls Matrix to simplify compliance with multiple standards & regulations.