NIST FIPS 203, 204, and 205 Finalized: An Important Step Towards a Quantum-Safe Future
Blog Published: 08/15/2024
Written by Mehak Kalsi, Co-Chair, CSA Quantum-Safe Security Working Group.Reviewed by Bruno Huttner, Co-Chair, CSA Quantum-Safe Security Working Group.The Quantum Computing ecosystem has been waiting with bated breath for this moment and it’s finally here. The National Institute of Standards and ...
StateRAMP FAQ
Blog Published: 08/15/2024
Originally published by Schellman.For those wanting to acquaint themselves with StateRAMP, we’ve put together answers to some of the most frequently asked questions we receive as a Third-Party Assessment Organization (3PAO). These important points of interest regarding this framework are divided ...
Email Security Threats in Europe: Insights into Attack Trends
Blog Published: 08/15/2024
Originally published by Abnormal Security.The data doesn’t lie: cybercriminals launch email attacks targeting every organization—regardless of size, industry, or location. However, while these threats are geographically agnostic and our research has revealed that the volume of nearly all attack t...
CISOs Should Brace for Massive Context, Coverage, and Communication Upgrade, Says CSA AI Leader
Blog Published: 08/14/2024
Originally published by CXO REvolutionaries.Written by Christopher Jablonski, Director, CXO REvolutionaries & Community.During his keynote at the CSA AI Summit (part of RSA Conference) last week in San Francisco, Caleb Sima, the Chair of the Cloud Security Alliance AI Safety Initiative, posed...
Apple Intelligence Private Cloud Compute (PCC) Initial Threat Modeling
Blog Published: 08/14/2024
Originally published on LinkedIn.Written by Ken Huang, CISSP.Apple has introduced a groundbreaking system called Private Cloud Compute (PCC) to enable secure and private AI processing in the cloud for its Apple Intelligence platform. While PCC represents a giant step forward in privacy-preserving...
Cloud Security Alliance Issues Paper Detailing Unique Challenges and Risks Presented by Use of Large Language Models (LLMs)
Press Release Published: 08/14/2024
Guide details general design principles and best practices related to authorization concernsSEATTLE – Aug. 14, 2024 – Securing LLM Backed Systems: Essential Authorization Practices, the latest report from the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining st...
Unmasking the Cyber Threat Within: Federal Government and DOD Grapple with Sleeper Cells
Blog Published: 08/14/2024
Originally published by Synack.Written by Ed Zaleski, Director of Federal Sales for the Department of Defense, Synack.The federal government and the Department of Defense (DOD) wage a constant battle against an elusive enemy. Behind the scenes, sleeper cells of adversaries lurk inside the wire, w...
What are Service Accounts, and Why are They Important to Secure?
Blog Published: 08/13/2024
Originally published by Astrix.What are service accounts?Service Accounts are Non-Human Identity accounts used by machines or apps to communicate with one another within a system, unlike user or human accounts.Service Accounts, using machine credentials, provide privileged identities and permissi...
Understanding the Shared Responsibility Model in SaaS
Blog Published: 08/13/2024
Originally published by Valence.Written by Jason Silberman.The recent attacks targeting data in customers of Snowflake, a SaaS application focused on data storage, serve as a critical reminder of the importance of understanding the Shared Responsibility Model in SaaS security. While initial repor...
An Organisation’s Guide for Building a Resilient Cloud Security Posture
Blog Published: 08/12/2024
Written by Gagan Koneru, Cyber Security Manager, GRC, FICO.Discover practical strategies for organisations and their teams to fortify cloud security posture, overcome cloud security posture management (CSPM) challenges, and build resilience while balancing budget constraints and compliance requir...
PCI 4.0 Simplified
Blog Published: 08/12/2024
Originally published by CyberGuard Compliance.Challenges in Implementing PCI 4.0Implementing PCI 4.0 comes with its fair share of challenges. The new standard introduces stricter requirements and more complex security measures to protect sensitive data. It may require significant changes to your ...
Who Needs a vCISO and Why?
Blog Published: 08/12/2024
Originally published by BARR Advisory.A virtual Chief Information Security Officer (vCISO) is essential for organizations that lack the resources or expertise to manage cybersecurity in-house. Typically, small to mid-sized businesses, startups, or companies undergoing rapid growth benefit the mos...
A Cybersecurity Expert's Perspective on the CrowdStrike Incident
Blog Published: 08/09/2024
Editorial Note: The lessons learned and changes that may result from this incident may take quite some time to fully understand. CSA is providing a platform for individual experts to weigh in on this issue. The opinions of this article represent those of the author, not those of CSA.Written by Ke...
ISO 27001: Auditing “Themes” in the 2022 Revision
Blog Published: 08/09/2024
The CSA Security Update podcast is hosted by John DiMaria, Director of Operations Excellence at CSA. The podcast explores the CSA STAR program, cloud security best practices, and associated technologies. In this blog series, we edit key podcast episodes into shorter Q&As.Today’s post features...
Cloud Migration Simplified: SaaS Secrets and PAM Strategy
Blog Published: 08/09/2024
Originally published by CyberArk.Written by John Walsh. In the era of rapid digital transformation, organizations are prioritizing cloud transformation projects to enhance their operational agility, scalability and cost efficiency. However, this shift takes time and brings significant challeng...
How to Scale Your GRC Program with Automation
Blog Published: 08/08/2024
Originally published by Vanta.According to Vanta’s 2023 State of Trust Report, respondents spend an average of nine working weeks per year on security compliance. Some security teams have accepted that governance, risk, and compliance (GRC) will inevitably take tons of time and effort. And many c...
Best Practices to Secure Data Access in Snowflake
Blog Published: 08/08/2024
Originally published by Oasis Security.In the last few days, there has been a lot of noise about an alleged Snowflake breach that impacted several companies' supply chains. While the details remain unconfirmed, it appears that the attack is once more identity-based. It is important to remain vigi...
Transforming Data Security: How AI and ML is Shaping the Next Generation of Data Security Tools
Blog Published: 08/08/2024
Originally published by Cyera.Written by Yana Fesh.Learn how AI-powered classification is transforming legacy Data Security Posture Management (DSPM) and providing accurate, autonomous insight into your data risk. Understand the limitations of traditional rules-based DSPM and why organizations ne...
CSA Community Spotlight: Contributing Something Meaningful with Head of Security Partha Chakraborty
Blog Published: 08/07/2024
For the last 15 years, CSA has been contributing to the cybersecurity community with our many research publications, trainings, blogs, in-person and virtual webinars and events, and many other initiatives based on top-of-mind security concerns. This thought leadership and event content is produce...
Navigating the Shadows: Safeguarding AI Infrastructure Amidst CVE-2023-48022
Blog Published: 08/07/2024
Originally published by Truyo.We all want to leverage AI, but models are only as good as the data used to train them. Often, training data is comprised of confidential information. How do you balance the need to make an AI run effectively without exposing PII? It’s not only the initial training t...
