Cloud 101CircleEventsBlog
Register for CSA’s free Virtual Cloud Trust Summit to tackle enterprise challenges in cloud assurance.

All Articles

All Articles
The 2023 State of SaaS Security Report

Blog Published: 03/27/2024

Originally published by Valence. Written by Adrian Sanabria. There’s something I love about putting together a big annual security report. The combination of data insights and industry trends is an opportunity to present a snapshot of the big picture. There’s the luxury of time we don’t have with...

Everything You Need to Know About the EU AI Act

Blog Published: 03/27/2024

Originally published by BARR Advisory.Written by Claire McKenna.We’ve recently witnessed the rapid expansion of artificial intelligence (AI)—and we can expect its continued integration into our daily lives. As our use and reliance on AI grows, so do the potential security risks that come along wi...

5 Security Questions to Ask About AI-Powered SaaS Applications

Blog Published: 03/26/2024

Written by Wing Security.Artificial intelligence (AI) has emerged as a disruptive force, reshaping the way organizations operate, innovate, and compete. With enhanced efficiency, productivity, and personalized user experiences, AI-powered SaaS applications have become integral to modern businesse...

Powerful Cloud Permissions You Should Know: Part 1

Blog Published: 03/26/2024

Originally published by Sonrai Security.Written by Deirdre Hennigar and Tally Shea.MITRE ATT&CK Framework: Initial AccessA cloud permission is never a dangerous thing by nature. In fact, their power is solely defined by the context in which they are used. Whether a permission falls into the w...

Google Cloud’s CISO Phil Venables and Mandiant CEO Kevin Mandia to Headline Cloud Security Alliance AI Summit at 2024 RSA Conference

Press Release Published: 03/26/2024

Session will explore priorities for CXOs and Boards of Directors and offer actionable steps to implementing emerging technologiesSEATTLE – March 26, 2024 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to he...

Salesforce Data Security Challenges in Wake of the Recent Breach

Blog Published: 03/26/2024

Originally published by Adaptive Shield.Written by Hananel Livneh. Recent incidents continue to shed light on vulnerabilities that organizations face. A notable case involves a networking products company whose support website inadvertently exposed sensitive customer information, as reported by K...

Cybersecurity Frontiers: Unveiling CTI's Role in Mitigating Dark Web Risks

Blog Published: 03/25/2024

Written by Cetark. The dark web in the digital age presents a significant cybersecurity challenge. This secretive section of the internet, renowned for its anonymity, acts as a breeding ground for cyber threats. Nonetheless, Cyber Threat Intelligence (CTI) stands out as a beacon of hope, providin...

What Should the Scope Period Be for My SOC 2 Type 2 Report?

Blog Published: 03/25/2024

Originally published by MJD.Written by Mike DeKock, CPA, CEO, MJD.Q: What should the scope period be for my SOC 2 Type 2 report?A: MJD AnswerBefore I jump into the scope period for a SOC 2 Type 2, I wanted to quickly note the difference between a SOC 2 Type 1 report and a SOC 2 Type 2 report. Typ...

What's Broken with Identity Management?

Blog Published: 03/25/2024

Originally published by Oasis Security. Written by Danny Brickman, Co-founder & CEO, Oasis Security. Identity management is a critical component of enterprise security. Identities are the key construct through which we control how authorized entities (individuals, software or devices) can acc...

CSA STAR Level 2: All About STAR Attestations and Certifications

Blog Published: 03/23/2024

Any organization providing cloud services can benefit from completing the STAR program’s cloud security and privacy assessments. These assessments are based on the Cloud Controls Matrix (CCM), as well as the privacy requirements for GDPR compliance. STAR assessments fall under two levels of assur...

How Attackers Exploit Non-Human Identities: Workshop Recap

Blog Published: 03/22/2024

Originally published by Astrix.Written by Tal Skverer and Danielle Guetta. “Identity is the new perimeter.” This catch phrase is present in almost every website of identity security vendors, and for a good reason. Human access, more commonly referred to as user access, is an established security ...

Recommendations for Self-Managed FedRAMP Red Team Exercises

Blog Published: 03/22/2024

Originally published by Schellman & Co.When FedRAMP issued Revision 5 in May 2023, the changes included a new requirement for a red team exercise in addition to the already-mandated penetration test. Now that Rev 5 is officially being enforced as of 2024, organizations pursuing FedRAMP Author...

Architecture Drift: What It Is and How It Leads to Breaches

Blog Published: 03/22/2024

Mitigate the risks of architecture drift with application security posture managementOriginally published by CrowdStrike. Cybercriminals work around the clock to discover new tactics to breach systems. Each time a digital ecosystem changes, it can introduce a weakness for a threat actor to quickl...

CSA Community Spotlight: Being a Force for Good with Risk Manager Heinrich Smit

Blog Published: 03/21/2024

In 2009, CSA was officially incorporated and we released the first version of our Security Guidance. The following year, CSA launched the industry’s first cloud security user certificate, the Certificate of Cloud Security Knowledge (CCSK), now the benchmark for professional competency in cloud se...

Pro-Active Approaches to Prepare Your Board of Directors for New SEC Cyber Security Rules

Blog Published: 03/21/2024

Originally published by RegScale. In March 2022, the Security and Exchange Commission (SEC) issued a proposed rule titled Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. In it, the SEC describes its intention to require public companies to disclose whether their boar...

CISOs, Sewers, and Unsolvable Problems

Blog Published: 03/21/2024

Originally published by CXO REvolutionaries.Written by Daniel Ballmer, Senior Transformation Analyst, Zscaler.CISOs and sewer engineers face similar challenges, and it goes beyond keeping the contents of their systems moving fast and smooth. There is a mathematical exercise that has many names, b...

Cloud Security: The Fundamental Role of Identities

Blog Published: 03/20/2024

Originally published by Tenable. Written by Christopher Edson, Senior Cloud Solutions Architect, Tenable. In the ever-expanding realm of the cloud, one thing is certain: vulnerabilities and misconfigurations are lurking just around the corner, waiting for attackers to exploit them and expose se...

Threat Detection on a Cloud-Native Attack Surface

Blog Published: 03/20/2024

Originally published by Sysdig.Written by Anna Belak. Public cloud infrastructure is, by now, the default approach to both spinning up a new venture from scratch and rapidly scaling your business. From a security perspective, this is a brand new (well, by now more than a decade old) attack surfac...

Quarterly Threat Bulletin Q4 2023: Current Cybersecurity Trends

Blog Published: 03/20/2024

Originally published by Uptycs.Uptycs’ Threat Research Team has released its final Quarterly Threat Bulletin for 2023, detailing cybersecurity trends and the cybersecurity threat landscape: the tactics, techniques, and procedures (TTPs) of the most active malware and prominent threat actor groups...

Zero Trust: Win Friends, Influence People, and Improve Your Organizational Maturity

Blog Published: 03/19/2024

Written by the CSA Zero Trust Working Group Co-Chairs: Jason Garbis, Jerry Chapman, and Christopher Steffen. In our roles as co-chairs, we spend a lot of time and energy talking with enterprises and promoting the idea that Zero Trust needs to be more than just a security initiative – it has to de...

Looking for the CCM?

Start using the Cloud Controls Matrix to simplify compliance with multiple standards & regulations.