What is CSA doing to help address threats to cloud computing?
CSA created a bi-annual survey report to help the industry stay up to date on the latest threats, risks, and vulnerabilities in the cloud. Such issues are often the result of the shared, on-demand nature of cloud computing. In these reports we survey industry experts on security issues in the cloud industry and they rate salient threats, risks and vulnerabilities in their cloud environments. These reports allow cybersecurity managers to better communicate with executives and peers and provide context for discussions with technical staff.
How can your organization address these threats?
How have organizations dealt with these cloud threats in real life? CSA’s series of case studies help identify where and how those threats fit in a greater security analysis, while providing a clear understanding of how lessons and mitigation concepts can be applied in real-world scenarios. This group has also created a playbook for penetration testing in cloud environments and as well as guidance for how to approach threat modeling for cloud systems.
This group aims to provide organizations with an up-to-date, expert-informed understanding of cloud security risks, threats and vulnerabilities in order to make educated risk-management decisions regarding cloud adoption strategies.
Dec 09, 2021, 07:00AM PST
Join the Meeting
Working Group Leadership
Jon-Michael C. Brook, Principal at Guide Holdings, LLC, has 20 years of experience in Information Security with such organizations as Raytheon, Northrop Grumman, Booz Allen Hamilton, Optiv Security and Symantec. Mr. Brook's work traverses the government, financial, healthcare, gaming, oil and gas and pharmaceutical industries. Mr. Brook obtained a number of industry certifications, including CISSP and CCSK, has patents and trade secrets in...
This person does not have a biography listed with CSA.
This person does not have a biography listed with CSA.
Alexander Getsin is an information security leader with particular expertise and interest in cloud security, secure application design and security governance. Alex is lead or co-author of industry cloud security best practices, particularly with the CSA Top Threats research group. He has experience in finance, military, technology and cyber intelligence sectors, currently responsible for cyber security in a fintech company. He is an alumnu...
Research for Cloud Security Threats
CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.
Top Threats to Cloud Computing: Egregious Eleven
Read an up-to-date, expert-informed understanding of the top cloud security concerns facing the industry in order to make educated risk-management decisions regarding cloud adoption strategies. In this fourth installment of the Top Threats Report, we again surveyed 241 industry experts on security issues in the cloud industry. This year our respondents rated 11 salient threats, risks and vulnerabilities in their cloud environments. After analyzing the responses in this survey, we noticed a drop in the ranking of traditional cloud security issues under the responsibility of cloud service providers (CSPs). Concerns such as denial of service, shared technology vulnerabilities and CSP data loss and system vulnerabilities—which all featured in the previous Treacherous 12—were now rated so low they have been excluded in this report. These omissions suggest that traditional security issues under the responsibility of the CSP seem to be less of a concern. Instea...
Top Threats to Cloud Computing: Egregious Eleven Deep Dive
This report provides case study analyses for last year’s The Egregious 11: Top Threats to Cloud Computing and a relative security industry breach analysis. Using nine actual attacks and breaches, including a major financial services company, a leading enterprise video communications firm, and a multinational grocery chain for its foundation, the paper connects the dots between the CSA Top Threats in terms of security analysis. Each of the nine examples are presented in the form of (1) a reference chart and (2) a detailed narrative. The reference chart’s format provides an attack-style synopsis of the actor spanning from threats and vulnerabilities to end controls and mitigations. These anecdotes will let cybersecurity managers, cloud architects, and cloud engineers better communicate with executives and peers in addition to pro...
Cloud Penetration Testing Playbook
As cloud services continue to enable new technologies and see massive adoption there is a need to extend the scope of penetration testing into public cloud systems and components. The process described here aims to provide the foundation for a public cloud penetration testing methodology and is designed for current and future technologies that are hosted on public cloud environments or services. In particular, this document focuses on penetration testing of applications and services hosted in the cloud. It addresses the methodological and knowledge gaps in security testing of information systems and applications in public cloud environments.This work focuses on testing systems and services hosted in public cloud environments. This refers to customer-controlled or customer-managed systems and services. For example, a custom virtual machine, managed and controlled by the cloud customer, in an IaaS environment would be in-scope whereas the hypervisor of an ...
|CSA Report Surfaces Cloud Attack Patterns||Security Boulevard||September 25, 2020|
|Cloud Security Alliance Releases Top Threats to Cloud Computing: Egregious 11 Deep Dive; Articulates Cloud Computing’s Most Significant Issues||Container Journal||September 23, 2020|
|Analysis of attacks reveals the top threats to cloud computing||Beta News||September 23, 2020|
|Cloud Security Alliance Releases 11 Top Threats to Cloud Computing||MeriTalk||September 30, 2020|
|Cloud computing threats||Professional Security||September 30, 2020|