11 Months to DORA: EU's New Framework For BFSI
Blog Published: 03/04/2024
Written by [email protected], AuditCue.In September 2020, the European Commission unveiled a landmark proposal - the Digital Operational Resilience Act (DORA) - as part of its sweeping Digital Finance Package aimed at fortifying cybersecurity across EU financial institutions. Once finalized, DORA...
Jenkins Vulnerability Estimated to Affect 43% of Cloud Environments
Blog Published: 03/04/2024
Originally published by Orca Security.Written by Bar Kaduri and Deborah Galea. On January 24th, Jenkins, a widely used open source CI/CD automation tool, released a security advisory regarding a new critical vulnerability that could allow arbitrary file read, possibly leading to Remote Code Execu...
Checklist for Designing Cloud-Native Applications – Part 1: Introduction
Blog Published: 03/04/2024
Written by Eyal Estrin.When organizations used to build legacy applications in the past, they used to align infrastructure and application layers to business requirements, reviewing hardware requirements and limitations, team knowledge, security, legal considerations, and more. In this series of...
Looking Forward, Looking Back: A Quarter Century as a CISO
Blog Published: 03/01/2024
Originally published by F5.Gail Coury explores how cybersecurity has evolved and what the future holds, after a distinguished career as a CISO.IntroductionThe first Chief Information Security Officer, or CISO, was named 29 years ago: After Russian hackers infiltrated financial services giant Citi...
Why Compliance is a Roadmap to Security
Blog Published: 03/01/2024
Originally published by RegScale.In the realm of cybersecurity, compliance is often perceived as a necessary but sometimes challenging aspect of safeguarding data and systems. As we celebrate Cybersecurity Awareness Month, let’s delve into the evolving role of compliance in the cybersecurity land...
How To Secure Your AWS Environment: Six Best Practices
Blog Published: 03/01/2024
Originally published by Tenable Cloud Security.Even for those experienced with AWS, securing your AWS environment can be a difficult process. In this article, we outline six best practices that can help those involved with protecting your AWS environment keep it secure.Recommendation #1 - Manage ...
A New Era of Data Protection: CSA’s Strategic Partnership with the EU Cloud CoC for GDPR Compliance
Blog Published: 02/29/2024
Read the full FAQ here.In an era where data protection has become a vital concern for cloud service providers (CSPs) and their clients, the Cloud Security Alliance (CSA) has partnered with the EU Cloud Code of Conduct (EU Cloud CoC) to disseminate privacy standards across the cloud sector. This i...
Cloudflare Hacked Following Okta Compromise
Blog Published: 02/29/2024
Originally published by Valence Security.Cloudflare disclosed that the Okta breach that occurred several months ago led to a suspected ‘nation state attacker’ gaining unauthorized access to their Atlassian servers. According to Cloudflare, the attackers that gained their initial access due to the...
To Meet Bold Ambitions and Combat Mounting Threats, Australia Endorses Zero Trust
Blog Published: 02/28/2024
Originally published by CXO REvolutionaries.Written by Heng Mok, CISO in Residence, Zscaler. If Australia is to become the most cyber-secure nation in the world by 2030, as Cyber Security Minister Clare O'Neill has said it can be, it has a ways to go. The Australian government’s recognition of th...
Understanding the Ransomware Wave of 2023
Blog Published: 02/28/2024
Originally published by Skyhigh Security on December 8, 2023. Written by Nick Graham, Solution Architect, Public Sector, Skyhigh Security. As we near the end of 2023, Skyhigh Security has observed a concerning surge in ransomware attacks that have significantly reshaped the cybersecurity landscap...
An Explanation of the Guidelines for Secure AI System Development
Blog Published: 02/28/2024
Originally published by Schellman & Co.Recently, the UK National Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA)—along with other groups from around the world—released the Guidelines for Secure AI System Development. A new resource for developers as o...
Securing Your Microsoft Environment After the Midnight Blizzard Attack
Blog Published: 02/27/2024
Originally published by Reco. Written by Oz Wasserman. IntroductionThe attack on Microsoft's SaaS-based Entra environment by Midnight Blizzard (aka Nobelium, Cozy Bear or APT29) was notably one of the most sophisticated attacks seen on similar platforms. This incident, spanning from November 2023...
Departing Thoughts of the STAR Program Director
Blog Published: 02/27/2024
As I prepare to transition from my role as the STAR Program Director to embark on a new journey as the Director of Operations Excellence at CSA, I find myself reflecting on the incredible journey we've embarked on together. Leading the STAR program has been one of the most fulfilling chapters of ...
What is Azure Policy: All You Need to Know
Blog Published: 02/27/2024
Originally published by Sonrai Security.Written by Tally Shea. What is Azure Policy? Azure Policy is a service within Microsoft Azure that allows organizations to create, assign, and manage policies. These policies define rules and effects over resources, identities, and groups, in an effort to e...
5 Steps to Fortify Your Organization Against Cyber Liabilities
Blog Published: 02/26/2024
Originally published by Diligent. Written by Nithya B. Das, Chief Legal & Administrative Officer, Diligent. Cybersecurity is a business issue. This was one of the key takeaways from a recent panel discussion I moderated on key strategies to guide CISOs, general counsels and other legal and in...
The Hidden Certificates in Your Organization: How to Find Them
Blog Published: 02/26/2024
Originally published by DigiCert. Written by Robyn Weisman. It should be clear by now why centralizing visibility over your cryptographic assets is essential to digital trust. If for some reason you’re unmoved by the parade of damaging outages and data breaches caused by expired or improperly sec...
Understanding PCI DSS: A Guide to the Payment Card Industry Data Security Standard
Blog Published: 02/26/2024
Originally published by BARR Advisory.Written by Kyle Cohlmia. According to a report by The Ascent, credit card fraud remained the most common type of identity theft in 2023. In today’s digital age, where online transactions have become an integral part of our daily lives, the security of payment...
Who Owns Information in the Era of AI?
Blog Published: 02/23/2024
Originally published by CXO REvolutionaries. Written by Tony Fergusson, CISO in Residence and Sam Curry, VP & CISO in Residence, Zscaler.Mark Twain, the distinguished American author, once wrote, “The kernel, the soul, let us go further and say the substance, the bulk, the actual and valuable...
Part 3: The Anatomy of Supply Chain Attacks: Non-Human Identities & TPRM Failure
Blog Published: 02/23/2024
Originally published by Astrix.Written by Alex Flores, Danielle Guetta, and Tal Skverer. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an establi...
3 Critical Steps for Application Security Teams in 2024
Blog Published: 02/23/2024
Originally published by CrowdStrike. As application security teams head into a new year, these are the key issues they should keep in mind and steps they must take to defend their custom software applications. Software development practices are rapidly changing, and so are the methods adversaries...
