Cloud 101CircleEventsBlog
Register for CSA’s free Virtual Cloud Trust Summit to tackle enterprise challenges in cloud assurance.

Working Group

Confidential Computing

This group aims to represent a radically more secure way to isolate and attest computing workloads through confidential computing.
Confidential Computing
Working Group Overview

The industry has strived for many years to protect data and avoid unauthorized access through many layers of controls that also manifest in regulations today. Through the use of modern Confidential Computing-enabled processors and services, sensitive workloads can be protected while resident in memory and in use, attack surfaces are dramatically reduced, and controls minimized. In addition, Confidential Computing delivers hardware-based roots of trust to enable digitally signed guarantees of trust and application identity to be established.
What do we discuss?

Confidential computing digitally guarantees code integrity, so the code that is built has assured integrity to be the code that executes. With very strong trust, new ways of computing are also possible, including multi-party computation between untrusted parties, and potentially simpler compliance controls.

Working Group Co-Chairs

Mark Novak
Mark Novak

Mark Novak

Mark has been involved in Confidential Computing since mid-2000’s – longer than the term itself has been in existence. Mark moonlights as the chair of the Confidential Computing Consortium’s Governance, Risk and Compliance SIG. His day job involves practicing enterprise security architecture for a multinational financial institution. In his previous job Mark was the architect for some of Microsoft’s Azure services and before that – worked a...

Read more

Alec Fernandez
Alec Fernandez

Alec Fernandez

Principal Program Manager at Microsoft

Alec spent several decades working with SAS Institute, a pioneering data analytics software company as a security architect. He worked to develop a framework for encrypting all network traffic.

Currently Alec works as a program manage at Microsoft where he helps drive features to improve the security posture of Confidential Computing products that prevent unauthorized individuals, including Microsoft operators, from being able to a...

Read more

Mark Bower
Mark Bower

Mark Bower

VP, Product Management at Anjuna

Mark Bower has two decades of experience at leading security companies in the U.S., Australia, U.K., and Germany. He is a noted expert in data protection, data privacy, and information risk reduction. Before joining Anjuna, where he owns product strategy for advanced confidential computing, he headed product and business strategy for Comforte AG, Voltage Security (acquired by HPE) and the Atalla HSM business at Hewlett Packard Enterprise. ...

Read more

Publications in ReviewOpen Until
CSA Large Language Model (LLM) Threats TaxonomyApr 19, 2024
Data Security - CCSK v5 Study GuideApr 22, 2024
Information Technology Governance, Risk, and Compliance in Healthcare v2Apr 26, 2024
Enterprise Authority To Operate (EATO) Controls FrameworkMay 12, 2024
View all
Who can join?

Anyone can join a working group, whether you have years of experience or want to just participate as a fly on the wall.

What is the time commitment?

The time commitment for this group varies depending on the project. You can spend a 15 minutes helping review a publication that's nearly finished or help author a publication from start to finish.

Open Peer Reviews

Peer reviews allow security professionals from around the world to provide feedback on CSA research before it is published.

Learn how to participate in a peer review here.

CSA Large Language Model (LLM) Threats Taxonomy

Open Until: 04/19/2024

This document establishes a common taxonomy and definitions for key terms related to AI risk scenarios, threats, and contro...

Data Security - CCSK v5 Study Guide

Open Until: 04/22/2024

Data security stands as a cornerstone of maintaining organizational integrity and confidentiality. The rapid expansion of c...

Information Technology Governance, Risk, and Compliance in Healthcare v2

Open Until: 04/26/2024

Cloud GRC is an effective means for organizations to gather important risk data, validate compliance, and report results. O...

Enterprise Authority To Operate (EATO) Controls Framework

Open Until: 05/12/2024

The Enterprise Authority To Operate (EATO) working group is opening their Controls Framework for open peer review.<...