CSA Research
Best practices, guidance, frameworks and tools to help the industry secure the cloud. Read our research to get your questions around cloud security answered.
CSA Research is created by the industry for the industry and is both vendor-neutral and consensus driven. Our research is created by subject matter experts who volunteer for our working groups. Each working group focuses on a unique topic or aspect of cloud security, from IoT, DevSecOps, Serverless and more, we have working groups for over 20 areas of cloud computing. You can view a list of all active research working groups. To find out more about how our research is created and the process we follow you can view the CSA Research Lifecycle.
Join a Working Group Meeting
Contribute to CSA Research
Peer reviews allow security professionals from around the world to collaborate on CSA research. Provide your feedback on the following documents in progress.
Latest Research
Secure DevOps and Misconfigurations Survey Report
Release Date: 11/18/2021
Secure DevOps, DevSecOps, and “shifting left” have become increasingly popular terms in cybersecurity. With the rapid increase both in volume and speed to delivery of applications, attacks on applications have also increased in both volume and complexity. Combine this with the shortage of cybersecurity professionals and lacking security skillsets, cybersecurity teams are already stretched to their limits. This has given rise to a DevSecOps approach, however, DevSecOps isn’t a silver bullet, organizations still face misconfigurations and other security challenges, struggle with implementing DevSecOps approach, and insufficient security skillsets
CSA Medical Device Incident Response Playbook
Release Date: 11/08/2021
This document presents a best-practices medical device incident response playbook that incorporates clinical aspects of medical device IR. As such, this guidance should be reviewed and adapted by clinical leadership to ensure it is acceptable from a patient care standpoint. This document should be viewed as a starting point for medical device incident response and not a prescriptive end goal.Key Takeaways: Example use cases to aid understanding of the role clinical considerations will play in the context of incident response Process for responding to incidents with medical devices including how to prepare, detect/analyze th...
Secure Connection Requirements of Hybrid Cloud
Release Date: 11/05/2021
The National Institute of Standards and Technology (NIST) defines hybrid cloud infrastructure as a composition of distinct cloud infrastructures (private, community, and/or public) that remain unique entities. These infrastructures are bound together by standardized or proprietary technology that enables data and application portability.Hybrid cloud is becoming an essential enterprise cloud model that allows the best of both worlds, providing customers with diverse resources to run different workloads depending on their needs. To successfully