Industry Insights
Read the latest cloud security news, trends, and thought leadership from subject matter experts.
President Biden’s Cybersecurity Executive Order: What will it mean for you?
This blog was originally published by OneTrust here.On May 12, US President Joe Biden issued an executive order on cybersecurity seeking to improve the state of national cybersecurity in the US and to increase protection of government networks following incidents involving SolarWinds and more rec...
.jpg)
With Great Power Comes Great Responsibility: The Challenge of Managing Healthcare Data in the Cloud
By Jon Moore, MS, JD, HCISSP, Chief Risk Officer and Head of Consulting Services, Clearwater Seeking flexibility, scalability, and cost savings, an increasing number of healthcare organizations are moving systems and data to the Cloud. This trend is accelerating, fueled by increased adoption of ...
Cloud lateral movement: Breaking in through a vulnerable container
This blog was originally published by Sysdig hereWritten By Stefano Chierici, SysdigLateral movement is a growing concern with cloud security. That is, once a piece of your cloud infrastructure is compromised, how far can an attacker reach?What often happens in famous attacks to Cloud environment...
Application Security is Getting Worse, not Better
This blog was originally published by CyberCrypt here.There’s an app for everything, and hackers and thieves are taking advantage. What are enterprises doing about it? Not enough.Web and mobile application use has exploded in recent years as businesses have digitized and moved more of their opera...
Unified threat detection for AWS cloud and containers
This blog was originally published by Sysdig here.Written by Vicente Herrera García, SysdigImplementing effective threat detection for AWS requires visibility into all of your cloud services and containers. An application is composed of a number of elements: hosts, virtual machines, containers, c...
Understanding the OWASP API Security Top 10
By Sekhar Chintaginjala (This blog originally appeared on CloudVector) As organizations embrace digital transformation initiatives, they are increasingly consuming and exposing APIs that increase their risk surface. The OWASP API Security Top 10 focuses on the strategies and solutions to un...
Security Spotlight: US Government Agencies Take Action Against Exchange Vulnerabilities and Social Media Giants Leak Data
This article was originally published by Bitglass hereWritten by Jeff Birnbaum, BitglassHere are the top security stories from recent weeks. FBI Removes Web Shells from Compromised Exchange Servers Without Notifying OwnersCISA Requires Federal Agencies to Patch Exchange Servers for Vulnerabilitie...
How to avoid the biggest mistakes with your SaaS security
This blog was originally published on Wandera.comWritten by Alex Powell at WanderaThe biggest mistakes in SaaS securityThe popularity of SaaS applications for businesses continues to grow with 95% of businesses hosting sensitive information in the cloud. Traditional security models and boundary-f...
Google Report Highlights Malware Targeting Browser Vulnerabilities
By Nick Kael, CTO at EricomThe browser is the targetLast week, Google’s Project Zero exploit research team published reports detailing a sophisticated cyber operation that targeted vulnerabilities in Chrome and Windows, installing malware to exploit weaknesses in the browser and operating system...
Five Actions to Mitigate the Financial Damage of Ransomware
By Eran Farajun, Executive Vice President at Asigra, Inc.Ransomware attacks have become a regular occurrence for organizations today, with events that are increasingly targeted, sophisticated, and costly. According to recent reports by the Federal Bureau of Investigation[1], cybercriminals are ta...
How secure are your SaaS applications?
Written by Ian Sharpe, Product Leader at AppOmni The dynamic nature of protecting the enterprise technology stack has always been a challenge for security teams. The complexities of this year, however, have forced teams to consider a new set of paradigms and additional risks given the abrupt shif...
How Hackers Changed Strategy with Cloud
By Drew Wright, Co-Founder of FugueOriginally published June 30, 2020 on https://www.fugue.co/blogIf you’re running a workload in the cloud, take a moment to look at the activity logs for your public-facing resources. There’s bad guys there, and they’re probing your cloud infrastructure looking f...
Abusing Privilege Escalation in Salesforce Using APEX
By Nitay Bachrach, Senior Security Researcher, PolyrizeThis article describes in detail a Salesforce privilege escalation scenario whereby a malicious insider exploits Author Apex permission to take over an organization’s Salesforce account and all data within it. The user abuses the fact that so...
3 Big Amazon S3 Vulnerabilities You May Be Missing
By Drew Wright, Co-Founder Fugue, Inc. When there’s a data breach involving Amazon Web Services (AWS), more often than not it involves the Amazon S3 object storage service. The service is incredibly popular. Introduced way back in 2006 when few knew what the cloud was, S3 is highly scalable, reli...
Pen Testing in the Age of Cloud
By Josh Stella, CTO and co-founder of FugueLately, we at Fugue have been demonstrating live hacks against cloud infrastructure based on real events in the news. We often walk through a theft of data from Amazon S3 by exploiting little-known misconfigurations of Security Groups, EC2, IAM, and S3 i...
Better Vulnerability Management: How to Master Container Security in Three Steps
By Nate Dyer, Product Marketing Director, TenableApplication containers like Docker have exploded in popularity among IT and development teams across the world. Since its inception in 2013, Docker software has been downloaded 80 billion times and more than 3.5 million applications have been “dock...
CVE and Cloud Services, Part 2: Impacts on Cloud Vulnerability and Risk Management
By Victor Chin, Research Analyst, Cloud Security Alliance, and Kurt Seifried, Director of IT, Cloud Security AllianceThis is the second post in a series, where we’ll discuss cloud service vulnerability and risk management trends in relation to the Common Vulnerability and Exposures (CVE) system. ...
CVE and Cloud Services, Part 1: The Exclusion of Cloud Service Vulnerabilities
By Kurt Seifried, Director of IT, Cloud Security Alliance and Victor Chin, Research Analyst, Cloud Security AllianceThe vulnerability management process has traditionally been supported by a finely balanced ecosystem, which includes such stakeholders as security researchers, enterprises, and vend...
Browse by Topic
Write for the CSA blog
Submit your blog proposalSign up to receive CSA's latest blogs
This list receives 1-2 emails a month.