Data Security is Physical Security
Blog Published: 12/21/2021
This blog was originally published by Authomize here. Written by Gabriel Avner, Authomize. Online streaming platform Twitch was hacked last week and the memes were fantastic.In case you missed it, a hacker reportedly stole 125 GB of valuable data from the Amazon-owned streaming service. The st...
Cloud Cost Optimization: A Pivotal Part of Cloud Strategy
Blog Published: 12/23/2021
Written by Gaurav Aggarwal, Avanade. This article was originally published on Forbes. It has also been previously published by Avanade. Cloud has undoubtedly been one of the clear winners in the Covid-19-induced digital transformation journey for most companies. However, managing costs is one ...
Dealing with log4shell aka CVE-2021-44228 aka the log4j version 2
Blog Published: 12/14/2021
Quick note: from now on I will refer to log4j version 2 as “log4j2”Update note: This blog entry was updated Dec 17, 2021, to include a note about the second remote code execution vulnerability CVE-2021-45046 in log4jOkay if you haven’t heard about the critical vulnerability in log4j2 then I en...
Cloud Security Alliance Releases Report on Corda Blockchain Framework and Security Controls
Press Release Published: 12/15/2021
Report offers security and risk management leaders and financial regulators ways to proactively prevent, detect, and respond to potential risksSEATTLE – Dec. 15, 2021 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best...
Keeping up with log4shell aka CVE-2021-44228 aka the log4j version 2
Blog Published: 12/16/2021
Quick note: from now on I will refer to log4j version 2 as “log4j2”If you use Java within your products or services and haven’t yet patched them, please see “Dealing with log4shell aka CVE-2021-44228 aka the log4j version 2”Trick question: Who helped coordinate the global response on CVE-2021-...
CSA 2022 Priorities: Cloud & Collaboration
Blog Published: 12/17/2021
This time of year I am often asked to make industry predictions, which I do – poorly. So this time around, I thought I would focus on making predictions about what Cloud Security Alliance will be working on in 2022, I should get at least 50% of it right. Let’s get started!Zero TrustThis is cer...
The Quest for Multi-Party Recognition
Blog Published: 12/22/2021
The CSA Security Update podcast is hosted by John DiMaria, CSA Assurance Investigatory Fellow, and explores the STAR Program, CSA best practices, research, and associated technologies and tools. This blog is part of a series where we edit key CSA Security Update episodes into shorter Q&As....
Single-Tenant Versus Multitenant SaaS Solutions: When Does it Matter?
Blog Published: 12/22/2021
Written by Morey J. Haber, BeyondTrust Today, there are many cloud-native, software-as-a-service (SaaS) solutions, built and optimized for the cloud, from which to choose. Yet, many competing solutions continue to tout themselves as “cloud-based”, even though they really represent just a lift ...
Microservices Architecture Patterns: Working Together to Secure the Cloud
Blog Published: 12/27/2021
Written by the CSA Application Containers and Microservices Working GroupThe secure development of microservices relies on architecture patterns. In the following blog, review these microservices architecture patterns and note how many are able to work together to form a secure cloud system. T...
The Three Pillars of a CARTA-enabled CSPM Strategy
Blog Published: 12/28/2021
This blog was originally published by Secberus here. Written by Fausto Lendeborg, Secberus. The cloud has changed how enterprises operate today. It has allowed companies to more easily store and share data. And with all this new data, it's increasingly important to make sure your security st...
SECtember 2021: Ransomware Isn’t Going Anywhere
Blog Published: 12/30/2021
This past September, CSA hosted SECtember 2021, the premier cloud security conference that features the best cloud security minds in the industry. If you missed it in person, we’ve got you covered. In our last recap blog, we discussed the Zero Trust sessions at the event. Now, here are some hi...
Not All Visibility Is Created Equal – What Are You Looking For?
Blog Published: 01/03/2022
This blog was originally published by Valtix here. Written by Vishal Jain, Valtix. For enterprises, security-related visibility in the cloud is critical. For many, especially as they try to gain an understanding of what they have in the cloud, how it’s set up, and what’s happening, often acros...
Deception as a Form of Defense
Blog Published: 01/04/2022
Written by Jordi Vilanova, Cloudtango With thousands of breaches occurring annually, organizations must get creative when it comes to building a comprehensive and adaptive security defense plan. Detecting threats early inside any environment is critical to prevent data exfiltration and other t...
How SSO and SaaS Make Spear-phishing Attacks More Dangerous
Blog Published: 01/05/2022
Written by Varonis If you watch in real-time the actual tools that hackers use to compromise services and leverage that access to devastating purpose much of the theoretical questions of “Could we really get hit by an attack?” and “How bad could it really be?” fly out the window. Reality hits ...
Predictions 2022: Work-From-Anywhere Marks the Beginning of the End of On-Premises Security
Blog Published: 01/04/2022
This blog was originally published by Lookout here. Written by Sundaram Lakshmanan, CTO of SASE Products, Lookout. A decade ago, many were reluctant to move to the cloud. Many felt like they would have to relinquish controls they had within their perimeters. That sentiment has since reversed, ...
Too Much of a Good Thing — Too Much Flexibility in Permission Management is Putting IAM Security at Risk
Blog Published: 01/06/2022
This blog was originally published by Authomize here. Written by Gabriel Avner, Authomize. As cloud services like Salesforce, AWS, and others have grown more robust over time, they have added more options for how IAM security teams can manage their organizations’ access policies.This increased...
Healthcare Cybersecurity: 8 Data Protection Best Practices
Blog Published: 01/07/2022
This blog was originally published by BigID here. Written by Kimberly Steele, BigID. Healthcare organizations need to look beyond compliance to reduce risk, implement robust data management, and achieve a data protection program that balances safeguarding patient data with providing the highes...
Application Security Best Practices
Blog Published: 01/10/2022
This blog was originally published by Vulcan Cyber here. Written by Tal Morgenstern, Vulcan Cyber. Forget whatever business you think you’re in. As Microsoft CEO Satya Nadella announced in 2019, every company is a software company, creating digital assets like applications and websites. That m...
Step up Your GDPR Compliance Program
Blog Published: 01/12/2022
This blog was originally published by CAS Assurance here. Overview The General Data Protection Regulation (GDPR) lays down rules relating to the protection of natural persons regarding the processing of personal data and rules relating to the free movement of personal data. The GDPR protects f...
Focus on People, Process, and Technology to Secure Your Shadow IT
Blog Published: 01/13/2022
Written by David Golding, AppOmni. Anyone in IT is familiar with shadow IT. How many times has an IT manager been surprised by the number of unknown applications that connect to their network? Shadow IT isn’t a new challenge, but the ability to keep track of unsanctioned IT has become more dif...
