Understanding the Ransomware Wave of 2023
Blog Published: 02/28/2024
Originally published by Skyhigh Security on December 8, 2023. Written by Nick Graham, Solution Architect, Public Sector, Skyhigh Security. As we near the end of 2023, Skyhigh Security has observed a concerning surge in ransomware attacks that have significantly reshaped the cybersecurity lands...
Jenkins Vulnerability Estimated to Affect 43% of Cloud Environments
Blog Published: 03/04/2024
Originally published by Orca Security.Written by Bar Kaduri and Deborah Galea. On January 24th, Jenkins, a widely used open source CI/CD automation tool, released a security advisory regarding a new critical vulnerability that could allow arbitrary file read, possibly leading to Remote Code Ex...
Departing Thoughts of the STAR Program Director
Blog Published: 02/27/2024
As I prepare to transition from my role as the STAR Program Director to embark on a new journey as the Director of Operations Excellence at CSA, I find myself reflecting on the incredible journey we've embarked on together. Leading the STAR program has been one of the most fulfilling chapters ...
Implementing DevSecOps: Some Practical Considerations for CISOs
Blog Published: 03/06/2024
Originally published by CXO REvolutionaries. Written by Sam Curry, VP & CISO in Residence, Zscaler. “The perfect is the enemy of the good.” – VoltaireIn early development models like Waterfall – where all processes were performed sequentially – a high wall separated build teams and run tea...
Cloudflare Hacked Following Okta Compromise
Blog Published: 02/29/2024
Originally published by Valence Security.Cloudflare disclosed that the Okta breach that occurred several months ago led to a suspected ‘nation state attacker’ gaining unauthorized access to their Atlassian servers. According to Cloudflare, the attackers that gained their initial access due to ...
How To Secure Your AWS Environment: Six Best Practices
Blog Published: 03/01/2024
Originally published by Tenable Cloud Security.Even for those experienced with AWS, securing your AWS environment can be a difficult process. In this article, we outline six best practices that can help those involved with protecting your AWS environment keep it secure.Recommendation #1 - Mana...
Checklist for Designing Cloud-Native Applications – Part 1: Introduction
Blog Published: 03/04/2024
Written by Eyal Estrin.When organizations used to build legacy applications in the past, they used to align infrastructure and application layers to business requirements, reviewing hardware requirements and limitations, team knowledge, security, legal considerations, and more. In this series...
Latest DevSecOps Guidance from Cloud Security Alliance and SAFECode Emphasizes Value of Collaboration, Integration in DevSecOps Landscape
Press Release Published: 02/21/2024
Document provides practical insights for seamlessly embedding security in DevOps processes and workflow and examines convergence of DevSecOps with Zero Trust, MLSecOps, and AIOps SEATTLE – Feb. 21, 2024 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining...
What is Azure Policy: All You Need to Know
Blog Published: 02/27/2024
Originally published by Sonrai Security.Written by Tally Shea. What is Azure Policy? Azure Policy is a service within Microsoft Azure that allows organizations to create, assign, and manage policies. These policies define rules and effects over resources, identities, and groups, in an effort t...
An Explanation of the Guidelines for Secure AI System Development
Blog Published: 02/28/2024
Originally published by Schellman & Co.Recently, the UK National Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)—along with other groups from around the world—released the Guidelines for Secure AI System Development. A new resource for developers a...
Looking Forward, Looking Back: A Quarter Century as a CISO
Blog Published: 03/01/2024
Originally published by F5.Gail Coury explores how cybersecurity has evolved and what the future holds, after a distinguished career as a CISO.IntroductionThe first Chief Information Security Officer, or CISO, was named 29 years ago: After Russian hackers infiltrated financial services giant C...
To Meet Bold Ambitions and Combat Mounting Threats, Australia Endorses Zero Trust
Blog Published: 02/28/2024
Originally published by CXO REvolutionaries.Written by Heng Mok, CISO in Residence, Zscaler. If Australia is to become the most cyber-secure nation in the world by 2030, as Cyber Security Minister Clare O'Neill has said it can be, it has a ways to go. The Australian government’s recognition of...
Cybersecurity Advisory: Apache Struts Vulnerability CVE-2023-50164
Blog Published: 03/06/2024
Originally published by Uptycs. The Apache Struts vulnerability CVE-2023-50164, with a critical CVSS score of 9.8, poses a significant threat to a wide range of industries. This newly reported vulnerability enables remote code execution, and its exploitation is already evident in the wild.Apac...
QR Codes, Audio Notes, and Voicemail - Clever Tricks Up a Phisher’s Sleeve
Blog Published: 03/07/2024
Written by David Balaban.Cybercriminals are increasingly cashing in on human gullibility rather than the security flaws of software architecture. It comes as no surprise that phishing, the dominating vector of social engineering attacks targeting individuals and businesses alike, is on a stead...
Fuzzing and Bypassing the AWS WAF
Blog Published: 03/07/2024
Originally published by Sysdig. Written by Daniele Linguaglossa. The Sysdig Threat Research Team discovered techniques that allowed the AWS WAF to be bypassed using a specialized DOM event. Web Application Firewalls (WAFs) serve as the first line of defense for your web applications, acting a...
HijackLoader Expands Techniques to Improve Defense Evasion
Blog Published: 03/08/2024
Originally published by CrowdStrike. HijackLoader continues to become increasingly popular among adversaries for deploying additional payloads and toolingA recent HijackLoader variant employs sophisticated techniques to enhance its complexity and defense evasionCrowdStrike detects this new Hij...
Checklist for Designing Cloud-Native Applications – Part 2: Security Aspects
Blog Published: 03/12/2024
Written by Eyal Estrin.In Chapter 1 of this series about considerations when building cloud-native applications, we introduced various topics such as business requirements, infrastructure considerations, automation, resiliency, and more. In this chapter, we will review security considerations...
A Guide to GCP Organization Policy: Managing Access
Blog Published: 03/12/2024
Originally published by Sonrai Security. Written by Tally Shea.Governance, security and compliance become difficult projects at scale. If you’re an enterprise operating out of Google Cloud, you’re likely looking for ways to manage access, enforce guardrails, and make configuration constraints ...
A New Era of Data Protection: CSA’s Strategic Partnership with the EU Cloud CoC for GDPR Compliance
Blog Published: 02/29/2024
Read the full FAQ here.In an era where data protection has become a vital concern for cloud service providers (CSPs) and their clients, the Cloud Security Alliance (CSA) has partnered with the EU Cloud Code of Conduct (EU Cloud CoC) to disseminate privacy standards across the cloud sector. Thi...
Why Compliance is a Roadmap to Security
Blog Published: 03/01/2024
Originally published by RegScale.In the realm of cybersecurity, compliance is often perceived as a necessary but sometimes challenging aspect of safeguarding data and systems. As we celebrate Cybersecurity Awareness Month, let’s delve into the evolving role of compliance in the cybersecurity l...
