The Future of Identity Security: Lessons from the Change Health Breach
Blog Published: 07/29/2024
Originally published by Oasis Security.UnitedHealth Group confirmed that in February, the BlackCat/ALPHV ransomware group breached Change Healthcare by exploiting compromised credentials for a Citrix remote access portal that lacked multi-factor authentication (MFA)."On February 12, criminals use...
Determining the Potential Data Attack Surface and Reducing the Blast Radius in Light of the Snowflake News
Blog Published: 07/29/2024
Originally published by Cyera on June 5, 2024.Written by Chris Hines.Earlier this week, the industry learned of the recent increase in attacks against customers of the DBaaS platform Snowflake.In a community post issued by Snowflake on Monday, the company stated that they “believe this is the res...
Modern Terms and Concepts for a Zero Trust Mindset
Blog Published: 07/26/2024
When Zero Trust was first coined by John Kindervag in 2009, it challenged the “trust but verify” approach of traditional security models. At the time, Zero Trust required us to challenge the assumption that trust is implicit. Especially with the complex networks, systems, and services that we see...
Top 4 Use Cases of Non-Human Identity Security: Live Event Recap
Blog Published: 07/26/2024
Originally published by Astrix on June 13, 2024.Last week we held an insightful live event featuring our solutions engineer, Michael Silva, and our CISO in Residence, Tim Youngblood. The event focused on the top four non-human identity (NHI) use cases that are crucial for security teams. Here’s a...
Navigating Data Privacy in the Age of AI: How to Chart a Course for Your Organization
Blog Published: 07/26/2024
Originally published by BARR Advisory.Artificial intelligence (AI) raises significant data privacy concerns due to its ability to collect, analyze, and utilize vast amounts of personal information. So what role do companies that have implemented AI play in keeping user data secured? Let’s dive in...
The Cybersecurity Tower of Babel Requires Focus on Business Fundamentals: Part 2
Blog Published: 07/25/2024
Written by Elad Yoran & Patricia Schouker. Enterprises are facing a great deal of change driven by the recent proliferation of security tools. With so many solutions needed to cover different portions of the environment, the result has been the fragmentation of enterprise security into a chao...
Adding a Twist to the Epic of Vulnerability Management
Blog Published: 07/25/2024
Originally published by CXO REvolutionaries.Written by Sam Curry, VP & CISO in Residence, Zscaler.“History doesn’t repeat itself, but it often rhymes.”–Mark TwainWe are in our fourth decade since the Security Administrator Tool for Analyzing Networks (SATAN) hit the scene and we have to ask o...
Incident Response in Cloud Security
Blog Published: 07/25/2024
Written by Ashwin Chaudhary, CEO, Accedere. Computer security incident response has become an important component of information technology (IT) programs. Cybersecurity-related attacks have become not only more numerous and diverse but also more damaging and disruptive. New types of security-rel...
Asking the Right Questions About ASPM
Blog Published: 07/24/2024
Originally published by Dazz.You may have heard this Gartner stat: 40% of organizations developing proprietary applications will adopt ASPM by 2026. In the next two years do you have a plan in place for adopting an ASPM solution? Noah Simon, Head of Product Marketing at Dazz recently hosted a ses...
Cloud Security Alliance Issues Artificial Intelligence (AI) Model Risk Management Framework
Press Release Published: 07/24/2024
Paper emphasizes importance of model risk management (MRM) for harnessing full potential of AI and machine learning (ML) modelsSEATTLE – July 24, 2024 – The latest set of AI guidance from the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certific...
Need a Penetration Test? Here’s What to Do Next
Blog Published: 07/24/2024
Originally published by Schellman.In our experience, there are typically three reasons why you may move forward with a penetration test and start looking around for a provider. Making that initial decision to move forward with an assessment like this is a big step, but what should you do after yo...
Cybersecurity Training for Employees: Upskill the Easy Way with CSA Team Training Programs
Blog Published: 07/23/2024
The cost and challenge of finding cybersecurity talent is nothing new. Equally challenging is ensuring all stakeholders across your organization have the knowledge they need to stay safe online. The best solution we’ve found is to train up your existing teams, providing:Solid security foundations...
Integrating PSO with AI: The Future of Adaptive Cybersecurity
Blog Published: 07/23/2024
Written by Sayali Paseband, Senior Security Consultant, Verisk.In the ever-evolving landscape of cybersecurity, where threats are becoming more sophisticated, advanced, and pervasive, conventional defense mechanisms are no longer sufficient. We need to develop new technologies and innovations to ...
How Continuous Controls Monitoring Solves Traditional GRC Challenges
Blog Published: 07/23/2024
Originally published by RegScale.Addressing compliance and ensuring strong security measures are increasingly complex tasks for organizations. How can you effectively manage these challenges? Continuous Controls Monitoring (CCM) offers a robust solution, leveraging automation, AI, and real-time d...
CSA Working Group Interview: Zero Trust Research with Solutions Architect Vaibhav Malik
Blog Published: 07/22/2024
Zero Trust is one of the most widely talked about cybersecurity trends today and is instrumental for raising the cybersecurity baseline and eliminating risk. Through the Zero Trust Advancement Center and Zero Trust Working Group, CSA aims to develop consistent Zero Trust standards. The Zero Trust...
The Anatomy of Cloud Identity Security
Blog Published: 07/22/2024
Originally published by CyberArk.Written by Alyssa Miles.There’s currently a cybersecurity adage with varying verbiage and claimed origins – the point, however, is unmistakable:“Attackers don’t break in. They log in.“This saying underscores the strategic shift associated with cloud adoption’s pro...
Enhancing AI Reliability: Introducing the LLM Observability & Trust API
Blog Published: 07/19/2024
Written by CSA Research Analysts Marina Bregkou and Josh Buker.Based on the idea presented by Nico Popp in ‘A trust API to enable large language models observability & security (LLMs)’.IntroductionLarge Language Models (LLMs) are becoming integral to numerous applications, from chatbots to c...
NHI Attacks Making Waves: Insights on Latest 5 Incidents
Blog Published: 07/19/2024
Originally published by Astrix.Non-human identity (NHI) attacks are making waves in the cybersecurity landscape, with five high-profile incidents reported in the past few weeks alone. To help you stay on top of this threat vector, our research team provides insights on the latest incidents in thi...
Assessment, Remediation, and Certification Framework for Anything as a Service (XaaS) Products
Blog Published: 07/19/2024
Written by the CSA Enterprise Authority to Operate (EATO) Working Group.Introduction by Jim Reavis, CEO of the Cloud Security AllianceI would say that a lesson learned from spending many years in the cybersecurity industry is that one-size-fits-all solutions are rarely the approach we need to tak...
10 Important Questions to Add to Your Security Questionnaire
Blog Published: 07/18/2024
Originally published by Vanta.The technology your organization uses is integral to its success. When selecting vendors, security should be at the forefront of your decision. A strong vendor review process is crucial for selecting partners that align with your company's security goals, and securit...
