Focus on People, Process, and Technology to Secure Your Shadow IT
Blog Published: 01/13/2022
Written by David Golding, AppOmni. Anyone in IT is familiar with shadow IT. How many times has an IT manager been surprised by the number of unknown applications that connect to their network? Shadow IT isn’t a new challenge, but the ability to keep track of unsanctioned IT has become more diffic...
What is a Vulnerability?
Blog Published: 01/13/2022
A philosophical but practical exploration of technical vulnerabilitiesLet’s check Merriam-Webster:open to attack or damageThis doesn’t feel complete. What’s missing? Let’s check Wikipedia:In computer security, a vulnerability is a weakness which can be exploited by a threat actor, such as an atta...
Step up Your GDPR Compliance Program
Blog Published: 01/12/2022
This blog was originally published by CAS Assurance here. Overview The General Data Protection Regulation (GDPR) lays down rules relating to the protection of natural persons regarding the processing of personal data and rules relating to the free movement of personal data. The GDPR protects fund...
Transitioning to the Cloud in 2022: Recommended Resources from CSA
Blog Published: 01/11/2022
How can your organization improve how it approaches the cloud? In this blog we put together a list of research created by the Cloud Security Alliance’s working groups and other resources created by our community that will be helpful to you if you are considering transitioning your organization to...
Application Security Best Practices
Blog Published: 01/10/2022
This blog was originally published by Vulcan Cyber here. Written by Tal Morgenstern, Vulcan Cyber. Forget whatever business you think you’re in. As Microsoft CEO Satya Nadella announced in 2019, every company is a software company, creating digital assets like applications and websites. That mean...
How we ended up with #log4shell aka CVE-2021-44228
Blog Published: 01/10/2022
Quick note: from now on I will refer to log4j version 2 as “log4j2” To learn how to deal with the critical vulnerability in log4j2, read the first blog in this series, Dealing with log4shell. To get a breakdown of the timeline of events, refer to the second blog, Keeping up with log4shell. So how...
Healthcare Cybersecurity: 8 Data Protection Best Practices
Blog Published: 01/07/2022
This blog was originally published by BigID here. Written by Kimberly Steele, BigID. Healthcare organizations need to look beyond compliance to reduce risk, implement robust data management, and achieve a data protection program that balances safeguarding patient data with providing the highest q...
Too Much of a Good Thing — Too Much Flexibility in Permission Management is Putting IAM Security at Risk
Blog Published: 01/06/2022
This blog was originally published by Authomize here. Written by Gabriel Avner, Authomize. As cloud services like Salesforce, AWS, and others have grown more robust over time, they have added more options for how IAM security teams can manage their organizations’ access policies.This increased fl...
Cloud Security Alliance Releases Guidance on Use of Artificial Intelligence (AI) in Healthcare
Press Release Published: 01/06/2022
Document shares the fundamentals and current challenges facing the use of AI in healthcare and offers guidance and predictions for its future useSEATTLE – Jan. 6, 2022 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best p...
How SSO and SaaS Make Spear-phishing Attacks More Dangerous
Blog Published: 01/05/2022
Written by Varonis If you watch in real-time the actual tools that hackers use to compromise services and leverage that access to devastating purpose much of the theoretical questions of “Could we really get hit by an attack?” and “How bad could it really be?” fly out the window. Reality hits par...
Deception as a Form of Defense
Blog Published: 01/04/2022
Written by Jordi Vilanova, Cloudtango With thousands of breaches occurring annually, organizations must get creative when it comes to building a comprehensive and adaptive security defense plan. Detecting threats early inside any environment is critical to prevent data exfiltration and other type...
Predictions 2022: Work-From-Anywhere Marks the Beginning of the End of On-Premises Security
Blog Published: 01/04/2022
This blog was originally published by Lookout here. Written by Sundaram Lakshmanan, CTO of SASE Products, Lookout. A decade ago, many were reluctant to move to the cloud. Many felt like they would have to relinquish controls they had within their perimeters. That sentiment has since reversed, whe...
Not All Visibility Is Created Equal – What Are You Looking For?
Blog Published: 01/03/2022
This blog was originally published by Valtix here. Written by Vishal Jain, Valtix. For enterprises, security-related visibility in the cloud is critical. For many, especially as they try to gain an understanding of what they have in the cloud, how it’s set up, and what’s happening, often across m...
SECtember 2021: Ransomware Isn’t Going Anywhere
Blog Published: 12/30/2021
This past September, CSA hosted SECtember 2021, the premier cloud security conference that features the best cloud security minds in the industry. If you missed it in person, we’ve got you covered. In our last recap blog, we discussed the Zero Trust sessions at the event. Now, here are some highl...
The Three Pillars of a CARTA-enabled CSPM Strategy
Blog Published: 12/28/2021
This blog was originally published by Secberus here. Written by Fausto Lendeborg, Secberus. The cloud has changed how enterprises operate today. It has allowed companies to more easily store and share data. And with all this new data, it's increasingly important to make sure your security strat...
Microservices Architecture Patterns: Working Together to Secure the Cloud
Blog Published: 12/27/2021
Written by the CSA Application Containers and Microservices Working GroupThe secure development of microservices relies on architecture patterns. In the following blog, review these microservices architecture patterns and note how many are able to work together to form a secure cloud system. The ...
Cloud Cost Optimization: A Pivotal Part of Cloud Strategy
Blog Published: 12/23/2021
Written by Gaurav Aggarwal, Avanade. This article was originally published on Forbes. It has also been previously published by Avanade. Cloud has undoubtedly been one of the clear winners in the Covid-19-induced digital transformation journey for most companies. However, managing costs is one of ...
Single-Tenant Versus Multitenant SaaS Solutions: When Does it Matter?
Blog Published: 12/22/2021
Written by Morey J. Haber, BeyondTrust Today, there are many cloud-native, software-as-a-service (SaaS) solutions, built and optimized for the cloud, from which to choose. Yet, many competing solutions continue to tout themselves as “cloud-based”, even though they really represent just a lift and...
The Quest for Multi-Party Recognition
Blog Published: 12/22/2021
The CSA Security Update podcast is hosted by John DiMaria, CSA Assurance Investigatory Fellow, and explores the STAR Program, CSA best practices, research, and associated technologies and tools. This blog is part of a series where we edit key CSA Security Update episodes into shorter Q&As. In...
Data Security is Physical Security
Blog Published: 12/21/2021
This blog was originally published by Authomize here. Written by Gabriel Avner, Authomize. Online streaming platform Twitch was hacked last week and the memes were fantastic.In case you missed it, a hacker reportedly stole 125 GB of valuable data from the Amazon-owned streaming service. The stole...
