CSA STAR Level 2: All About STAR Attestations and Certifications
Blog Published: 03/23/2024
Any organization providing cloud services can benefit from completing the STAR program’s cloud security and privacy assessments. These assessments are based on the Cloud Controls Matrix (CCM), as well as the privacy requirements for GDPR compliance. STAR assessments fall under two levels of as...
10 Essential Identity and Access Management (IAM) Terms
Blog Published: 03/30/2024
Identity and access management is kind of a big deal. People are working from anywhere and everywhere on all kinds of devices, so it's essential to know who's who in the digital world and to confirm that our digital communications are secure. If you’re just starting out on your IAM journey, do...
How We Can Help Corporate Boards with Cybersecurity
Blog Published: 04/02/2024
Originally published by RegScale. Recently the Wall Street Journal featured an article titled Why Corporate Boards Need More Cybersecurity Experience, and it got me thinking about what we can do to help them; we can do a lot. What’s the situation you ask? According to the WSJ, “Directors curre...
Key Findings from the 2024 State of Application Security Report
Blog Published: 04/03/2024
Originally published by CrowdStrike. As organizations shift their applications and operations to the cloud and increasingly drive revenues through software, cloud-native applications and APIs have emerged among the greatest areas of modern security risk. According to publicly available data, e...
Runtime is the Way
Blog Published: 04/04/2024
Originally published by Sysdig. Written by James Berthoty. The cloud security market has been totally bizarre ever since it started. Why are we being given a python script to count our workloads? How do we handle sending alerts like “new unencrypted database” to a SOC? What’s the difference be...
CISOs, Sewers, and Unsolvable Problems
Blog Published: 03/21/2024
Originally published by CXO REvolutionaries.Written by Daniel Ballmer, Senior Transformation Analyst, Zscaler.CISOs and sewer engineers face similar challenges, and it goes beyond keeping the contents of their systems moving fast and smooth. There is a mathematical exercise that has many names...
Recommendations for Self-Managed FedRAMP Red Team Exercises
Blog Published: 03/22/2024
Originally published by Schellman & Co.When FedRAMP issued Revision 5 in May 2023, the changes included a new requirement for a red team exercise in addition to the already-mandated penetration test. Now that Rev 5 is officially being enforced as of 2024, organizations pursuing FedRAMP Aut...
How Attackers Exploit Non-Human Identities: Workshop Recap
Blog Published: 03/22/2024
Originally published by Astrix.Written by Tal Skverer and Danielle Guetta. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an established securi...
How the Sys:All Loophole Allowed Us to Penetrate GKE Clusters in Production
Blog Published: 04/05/2024
Originally published by Orca Security. Written by Ofir Yakobi. Following our discovery of a critical loophole in Google Kubernetes Engine (GKE) dubbed Sys:All, we decided to conduct research into the real-world impacts of this issue. Our initial probe already revealed over a thousand vulnerabl...
Salesforce Data Security Challenges in Wake of the Recent Breach
Blog Published: 03/26/2024
Originally published by Adaptive Shield.Written by Hananel Livneh. Recent incidents continue to shed light on vulnerabilities that organizations face. A notable case involves a networking products company whose support website inadvertently exposed sensitive customer information, as reported b...
Powerful Cloud Permissions You Should Know: Part 1
Blog Published: 03/26/2024
Originally published by Sonrai Security.Written by Deirdre Hennigar and Tally Shea.MITRE ATT&CK Framework: Initial AccessA cloud permission is never a dangerous thing by nature. In fact, their power is solely defined by the context in which they are used. Whether a permission falls into th...
5 Security Questions to Ask About AI-Powered SaaS Applications
Blog Published: 03/26/2024
Written by Wing Security.Artificial intelligence (AI) has emerged as a disruptive force, reshaping the way organizations operate, innovate, and compete. With enhanced efficiency, productivity, and personalized user experiences, AI-powered SaaS applications have become integral to modern busine...
Everything You Need to Know About the EU AI Act
Blog Published: 03/27/2024
Originally published by BARR Advisory.Written by Claire McKenna.We’ve recently witnessed the rapid expansion of artificial intelligence (AI)—and we can expect its continued integration into our daily lives. As our use and reliance on AI grows, so do the potential security risks that come along...
Beyond the Black Box: How XAI is Building Confidence
Blog Published: 03/28/2024
Written by Dr. Chantal Spleiss, Co-Chair for the CSA AI Governance & Compliance Working Group.While "AI" has become a broadly used word, there are key distinctions within AI to keep in mind. Narrow AI systems excel at specific tasks, like playing chess or recognizing objects in images. Gen...
6 Surprising Findings from the CSA State of Security Remediation Report
Blog Published: 03/28/2024
Originally published by Dazz.Written by Julie O’Brien, CMO, Dazz.As more companies shift left and embrace hybrid cloud operations, the need for security visibility across the entire code-to-cloud environment is critical for staying on top of vulnerabilities and reducing exposure.The CSA State ...
More Than Half of Organizations Plan to Adopt Artificial Intelligence (AI) Solutions in Coming Year, According to Report from Cloud Security Alliance and Google Cloud
Press Release Published: 04/03/2024
Significant Generative AI (GenAI) adoption expected in 2024, driven by C-suite prioritizationSEATTLE – April 3, 2024 – A new survey from the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secu...
CSA Community Spotlight: Establishing Cloud Security Standards with Dr. Ricci Ieong
Blog Published: 04/03/2024
CSA began establishing standards for cloud security assurance and compliance back in 2009, when the company was officially incorporated and we released the first version of our cloud security best practices. The following year, we developed the Cloud Controls Matrix (CCM), and in 2012, the CSA...
CSA Turns 15: Kicking Off the Next 85 Years of Cloud Security Excellence
Blog Published: 04/04/2024
As we celebrate the 15th anniversary of the Cloud Security Alliance (CSA), I'm compelled to marvel at our journey from ambitious upstarts to a critical global stakeholder for cybersecurity. Our goal, audacious as it may sound, is not just to leave a mark on the cloud security landscape, but to...
Why Cyber Defenders Should Embrace a Hacker Mindset
Blog Published: 04/10/2024
Originally published by Pentera. Written by Nelson Santos. Today’s security leaders must manage a constantly evolving attack surface and a dynamic threat environment due to interconnected devices, cloud services, IoT technologies, and hybrid work environments. Adversaries are constantly introd...
Securing Non-Human Identities: Lessons from the Cloudflare Breach
Blog Published: 04/10/2024
Originally published by Oasis Security. Written by Roey Rozi, Director of Solutions Architecture, Oasis Security. Cloudflare disclosed on February 2nd that it had been breached by a suspected nation-state attacker. This breach exploited multiple unrotated and exposed secrets. The chain of even...
