CSA Security Update

Security is not simply a CIO, CSO, or IT department issue. It is critical that organizations have a system in place that can prove the all important "Standard of Care" was deployed and maintained.

Breaches, leaked documents, and cybersecurity attacks impact stock prices and competitive edge. It is a responsibility that must be shared amongst all employees. It is a matter of resilience and survival of the company.

How should CEOs and board members get proactively involved in mitigating future challenges and get involved in the decision making process in an industry where there is so much "noise".

As CEOs technical knowledge and security experience can vary quite a bit, what should they do when the vendors start crowding the door?

Listen as Phillip Merrick; CEO of Fugue provides advice from the boardroom and how CEOs think and approach security VS the IT department.

https://cloudsecurityalliance.org/star/

Ribose has achieved STAR Attestation, Certification and C-STAR along with being one of the first adopters of STAR Continuous. What was the main driver? What was the approach to implementation and how did they weave the STAR controls into their current management system to build one holistic integrated process?

Listen as Ron Tse; Founder and CEO of Ribose as he addresses these questions along with discussing what challenges STAR addressed and predictions on what can be expected in the global compliance landscape. 

https://cloudsecurityalliance.org/star/

CSA research is such a big part of what CSA does, providing high quality relevant papers, studies and data free for all to take advantage of, yet in some cases is one of the best kept secrets on the amount of effort that goes into the output that has produced over 400 artifacts and to ensure its value and relevance.

Collaborating with industry  and harnessing the right subject matter expertise to ensure good cross-functionality is critical when it comes to producing valuable  research. 
 
Listen as John Yeoh: Global V.P. of Research for CSA provides insight to the research process, the people behind the scenes, some common pain points that have been identified and some of the great research coming down the pipeline to address tomorrow's problems today.

https://cloudsecurityalliance.org/star/

Business email compromise (BEC) scams are not going away anytime soon. For such a relatively low-tech type of financial fraud, it has proved to be a high-yield and lucrative enterprise for scammers. But the prevention measures are not expensive and not technology dependent.

Listen as Ken Dunham;Senior Technical Director, Cyber Operations for Optiv discusses this growing issue, the process hackers use, the root cause and prevention recommendations you can use for cloud security when adopting the cloud and why transparency is so important.

Episode is Not Live

Publish: Aug. 14, 2019 @ 6AM Edit

Publish

Amplify this Episode

Add Chapter Markers

$.10/minute

Transcribe this Episode

Promote this Episode

Create a Video Soundbite

Share on Facebook

Share on Twitter

Share on LinkedIn

Email Link to Episode

Direct Link to MP3

Embed this ONE Episode

https://cloudsecurityalliance.org/star/

Information sharing activities when combined  with other threat intelligence activities  can be seen as important part of the arrangements of human and non‐human activities that, together, form a critical part to achieving organizational resilience. 

There is a reciprocal relationship between all processes within an organization and the ways in which information is used and shared. 

Join us as we talk to Paul Kurtz; Former white house senior member relating to critical infrastructure and counterterrorism on the White House's National Security and Homeland Security Councils under Presidents Clinton and Bush and internationally recognized expert on cybersecurity and the co-founder and CEO of TruSTAR Technology. 

We discuss how to get the most out of your intelligence involving all applicable stakeholders to build this preventive culture that is weaved into the day-to-day way of operation incorporating more threat intelligence into every stage of the workflow. 

https://cloudsecurityalliance.org/star/

Continuous Monitoring enables automation of the current security practices of cloud providers. Providers publish their security practices according to CSA formatting and specifications, which customers and tool vendors can then retrieve and present in a variety of contexts.
 
Continuous monitoring/auditing improves on the traditional point-in-time certification in both trust and transparency.
 
Point-in-time audits while the foundation of many respected certifications, often contain a considerable time gap between audits, and by adopting continuous monitoring/auditing with an increased audit frequency, chances of deviation of the security posture becomes less. This empowers cloud service providers to make precise statements on compliance status of their cloud services covered by the continuous audit process, achieving an “always up-to-date” compliance status.
 
There has been considerable amount of research and science that has gone into proving the business case for continuous monitoring and its effectiveness. Listen as we discuss the data in detail with Stephen Boyer, Founder and CTO of BitSight Technologies along with use cases that show how the paradigm is changing once again on how industry defines risk and security.

https://cloudsecurityalliance.org/star/

CSA and Whistic identified the need for a lighter-weight assessment questionnaire in order to accommodate the shift to cloud procurement models, and to enable cybersecurity professionals to more easily engage with cloud vendors. CAIQ-Lite was developed to meet the demands of an increasingly fast-paced cybersecurity environment where adoption is becoming paramount when selecting a vendor security questionnaire. CAIQ-Lite contains 73 questions compared to the 295 found in the CAIQ, while maintaining representation of 100% of the original 16 control domains present in The Cloud Controls Matrix (CCM) 3.0.1.

Listen as we talk with our guest Nick Sorensen, CEO of Whistic and discuss the research and statistical analysis that went into the creation of the CAIQ-Lite along with some use cases of how and when it should be used.

https://cloudsecurityalliance.org/star/

Dr. Ron Ross, Fellow and Senior Computer Scientist and Information Security Researcher in the computer security division at the National Institute of Standards and Technology (NIST) joins us to discuss the growing problem of too much complexity and the associated security issues that are growing because of it. 
 In this episode we discuss the problem, the root cause and the proven best practice solutions that will facilitate moving from a reactive to proactive culture providing organizational resilie

https://cloudsecurityalliance.org/star/

https://cloudsecurityalliance.org/star/

https://cloudsecurityalliance.org/star/