Industry Insights

Read the latest cloud security news, trends, and thought leadership from subject matter experts.

Industry Insights
CCM Testimonial: The Advantages and Future of the Cloud Controls Matrix
Published: 08/12/2021

The Cloud Controls Matrix (CCM) is composed of 197 control objectives that cover all key aspects of cloud technology. It can be used as a tool for the systematic assessment of cloud implementation and provides guidance on which security controls should be implemented by which actor within the clo...

How Can 3DS Authentication Enhance My Payments Flow?
Published: 08/11/2021

This blog was originally published by TokenEx here. Written by Jessica Titsworth, TokenEx. As the rapid growth of ecommerce platforms and digital payments continue, the amount of card-not-present (CNP) transactions has increased. While this can provide extra convenience for the cardholder, mercha...

Top 20 Dockerfile Best Practices
Published: 08/10/2021

This blog was originally published by Sysdig here.Written by Álvaro Iradier, Sysdig.Learn how to prevent security issues and optimize containerized applications by applying a quick set of Dockerfile best practices in your image builds.If you are familiar with containerized applications and micros...

Understanding Cloud Drift Enables Zero Trust Cloud Management
Published: 08/09/2021

This blog was originally published by OpsCompass here.Written by John Grange, OpsCompass.True Insight into Your Security Posture and Drift is Key to Zero-TrustIn the cloud everything is configurable software. This sounds a little obvious, if not trite, but it actually represents an important insi...

You Can’t Detect What You Can’t See – In Real-Time. The Modern Cloud Security Edition
Published: 08/06/2021

This blog was originally published by Blue Hexagon here.Written by Arun Raman, Blue Hexagon.There is an old maxim in cybersecurity: “You cannot detect what you cannot see.” While we hold the need for security visibility as a self-evident truth, there are implications for a cloud security architec...

The Visionary CCM/CAIQ v4 Early Adopters
Published: 08/06/2021
Author: John DiMaria

This blog was updated on 8/16/21 with the news that organizations can now submit CAIQ v4 to the STAR Registry.The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing aligned to CSA best practices and is considered the de-facto standard for cloud security and priva...

The Importance of Properly Scoping Cloud Environments
Published: 08/05/2021

PCI Security Standards Council (PCI SSC) and the Cloud Security Alliance (CSA) recently released a joint industry threat bulletin highlighting the importance of properly scoping cloud environments. In this blog, the PCI SSC and CSA share guidance and best practices for properly scoping cloud envi...

Blue Team Diaries: Becoming ‘data-smart’
Published: 08/05/2021

Written by Derek Wood, Open Raven“I can’t afford to not be data-smart.” - Doug Clendening, Principal Services Consultant at Open Raven (Previously Principal Cyber Incident Commander at Splunk) Blue teams aren’t quite the cape-wearing heroes featured in comics, but they aren't far off when it come...

Three Network Weaknesses that Zero Trust Addresses
Published: 08/04/2021

Zero Trust is a network security concept that aims to protect enterprise assets. Under Zero Trust, organizations should not automatically trust anything inside or outside traditional perimeters. Before granting access to assets, organizations should require the verification of anything and everyt...

SECtember 2021: Why I’ll Be There
Published: 08/03/2021

Written by Larry Hughes, Principal Compliance Consultant, LJH Compliance ConsultingI first got involved in the Seattle information security scene in 1996. I was busy building a security consulting practice for a startup. It wasn’t long before I met this affable fellow named Jim Reavis, who had al...

Secure Distributed Ledger Technology Framework for Financial Institutes
Published: 08/03/2021

Last updated: August 3, 2021Distributed ledger technologies (DLT) introduce a multitude of value propositions for the financial services industry. The pace of innovation is aggressively picking up in use cases pertaining to finance such as digital assets, tokenization and cryptocurrency. However,...

How is CSA STAR Different From ISO 27001 and SOC 2?
Published: 08/02/2021

The STAR Registry lists cloud solution providers and security providers that have earned a cloud compliance certification from CSA or submitted a cloud security self-assessment questionnaire. While STAR Level 1 is a basic Yes/No or N/A question set to self-declare your compliance with the Cloud C...

The Use of Blockchain in Healthcare: A Collaboration Between Two CSA Working Groups
Published: 08/02/2021

The unique attributes of healthcare data make it a prime target for nefarious actors. Predictably, healthcare information is tightly regulated by privacy and security laws in the United States, the European Union and international rules governing cloud data storage. The data’s high value, coupled...

An Evolving Healthcare Cybersecurity Landscape
Published: 07/30/2021
Author: John DiMaria

Cloud computing is still in its infancy in the healthcare industry, an industry that started experimenting with technology in the 1950s. But the pace of adoption is projected to continue to increase. With clinicians using mobility tools and the Internet of Things, the healthcare industry is colle...

Bad guys are watching for new openings in your cloud, are you?
Published: 07/30/2021

This blog was originally published by Sysdig here.Written by Janet Matsuda, Sysdig CMO.You see the headlines, and perhaps, ‘thank goodness it wasn’t us’ flickers through your mind. An overly permissive web server exposes 100 million+ consumer credit applications, or an S3 bucket leaves hundreds o...

3 Key DevSecOps Trends for 2021
Published: 07/29/2021

This blog was originally published by Blue Hexagon here.Written by Saumitra Das, Blue Hexagon.DevSecOps is a term that means different things to different people. I see it as primarily as an umbrella term for “continuous security” or security that is built into the process of building, shipping, ...

Can Web Browsers be “Secure” as Required by Federal Cybersecurity Guidelines?
Published: 07/28/2021

This blog was originally published by Ericom Software here.Written by Gerry Grealish, Ericom Software Chief Marketing Officer.The National Institute of Standards and Technology (NIST) issued its “Definition of Critical Software Under Executive Order,” one of the first items to be delivered in res...

Prepare for Passing the CCAK Exam
Published: 07/27/2021

The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. Developed by CSA and ISACA, the CCAK credential and training program fills the need for v...

Deep Dive into the NSA Funded MITRE D3FEND Framework
Published: 07/26/2021

This blog was originally published by Blue Hexagon here.Written by Saumitra Das, Blue Hexagon.MITRE released the D3FEND framework on 6/22/21, an effort funded by the National Security Agency to effectively create a knowledge graph of cybersecurity countermeasure techniques. The goal of this proje...

Detecting new crypto-mining attack targeting Kubeflow and TensorFlow
Published: 07/23/2021

This blog was originally published by Sysdig hereWritten by Stefano Chierici, Security Researcher, SysdigMicrosoft has discovered a new large-scale attack targeting Kubeflow instances to deploy malicious TensorFlow pods, using them to mine Monero cryptocurrency in Kubernetes cluster environments....

Browse by Topic
Write for the CSA blog
Submit your blog proposal