CSA Security Update

In this episode of CSA Security Update, host John DiMaria and guest Scott Furman of Invary discuss the evolving landscape of cloud security, focusing on the critical vulnerabilities posed by implicit trust in foundational components like kernels and hypervisors. They explore the limitations of traditional security tools and the necessity of continuous integrity measurement as a proactive defense against modern threats, including zero-day attacks. The conversation underscores the importance of integrating integrity validation into existing security frameworks, while striking a balance between performance and security. Real-world use cases demonstrate the effectiveness of these measures, particularly in critical infrastructure. The episode concludes with insights into the future of cloud security, emphasizing the need for continuous verifiable proof to enhance trust and security in cloud environments. https://cloudsecurityalliance.org/star/

Summary In this episode, John DiMaria and John Earle discuss the rapid rise of AI in cybersecurity, drawing parallels to the early adoption of cloud security. They explore the importance of organizational culture, change management, and team dynamics in shaping security initiatives. The conversation emphasizes the need for effective communication and the role of security champions in overcoming resistance to change. Looking ahead, they highlight the qualities that will define successful security leaders in the evolving landscape of technology. Key takeaways AI is transforming cybersecurity at an unprecedented pace. Organizational culture significantly impacts security performance. Change management is essential for security leaders. Understanding team dynamics can enhance security initiatives. Building security champions is crucial for program success. Effective communication fosters collaboration and trust. Resistance to change is a natural reaction that needs addressing. Security leaders must empathize with team concerns. Data engineering knowledge will be vital for future leaders. Proactive security measures are more effective than reactive ones. https://cloudsecurityalliance.org/star/

As organizations embrace generative AI, ensuring applications align with safeguards is critical. Today, we are here to explore how proper Guardrails can enable responsible AI by filtering harmful content, enforcing policies, and supporting compliance—all without slowing innovation. Join us as we interview Saptarshi Banerjee, Senior Solutions Architect at Amazon Web Services (AWS  Listeners will hear real-world use cases, governance best practices, and how to build AI solutions that are powerful, secure, and aligned with enterprise values.  https://cloudsecurityalliance.org/star/

In this insightful episode, we explore the intricate world of GDPR compliance and how tools like codes of conduct can support cloud service providers. Our special guest, Gabriela Mercuri, Managing Director of SCOPE Europe, shares her expertise on the EU Cloud Code of Conduct (EU Cloud CoC), a pivotal GDPR compliance tool designed specifically for the cloud industry. Join us as we discuss the significance of these codes of conduct, their role in ensuring data protection, and how they offer a practical framework for companies striving to meet GDPR requirements. We will also delve into the ongoing collaboration between the EU Cloud CoC and the CSA, highlighting how this partnership enhances transparency, trust, and compliance across the cloud services landscape. Whether you’re a cloud service provider, a data protection professional, or simply interested in GDPR compliance, this episode will provide valuable insights into the evolving landscape of data protection and the practical steps companies can take to ensure compliance. https://cloudsecurityalliance.org/star/

The attack surface has expanded and evolved dramatically in an era where the industry is investing nearly a trillion dollars in cloud infrastructure, operations, and applications. Modern cloud development enables faster application building and introduces complex security challenges. As generative AI becomes increasingly integrated into our tools and processes, it promises to transform how we approach cybersecurity. But what does that mean for security and development teams today? Join us in this episode as we interview Tomer Schwartz, CTO and Co-founder, Dazz, and explore how AI can be a game-changer for security teams, especially resource-constrained teams, offering the ability to automatically discover and resolve cloud vulnerabilities at their root. We'll discuss whether human oversight will still be necessary before changes go live and when the true potential of GenAI is realized. We will also discuss how we can use AI to outsmart adversaries using it for malicious purposes. This is a must-listen for anyone interested in leveraging AI to enhance their security posture and protect against the next generation of cyber threats. https://cloudsecurityalliance.org/star/

In our latest episode, we delve into the innovative approach of auditing "themes" as introduced in the ISO/IEC 27001:2022 revision. This reorganization of domains marks a significant shift in how we think about and implement information security management. By centering our conversation on auditing themes, we explore how this new structure enhances the alignment of security practices with organizational goals and risks. We'll discuss the rationale behind this change, practical insights on transitioning to the new model, and the benefits it brings to ensuring a robust and comprehensive security audit. Join us as we interview David Forman, founder of Mastermind, as we unpack the implications of this pivotal update and provide guidance on how to prepare for your next certification body audit.   https://cloudsecurityalliance.org/star/

In this exclusive interview, we have the honor of speaking with a representative from the Cloud Security Alliance (CSA), the esteemed recipient of the 2024 Global InfoSec Award for Cutting-Edge Cybersecurity Training. This award acknowledges CSA's groundbreaking Certificate of Competence in Zero Trust (CCZT), the industry's first authoritative training and certification program dedicated to Zero Trust architecture, components, and best practices. During this session, we will delve into the development and significance of the CCZT, exploring the motivations behind its creation and the goals CSA aimed to achieve. Our discussion will highlight the unique features of the CCZT program, its impact on professionals and organizations, and the feedback received from those who have completed the training. We will also examine the broader implications of Zero Trust in the current cybersecurity landscape, the challenges organizations face in adopting Zero Trust principles, and how the CCZT addresses these challenges. Join us as we uncover the reasons behind CSA's commitment to creating a trusted cloud ecosystem and its vision for the future of cybersecurity training. This conversation will provide valuable insights for professionals and organizations seeking to enhance their cybersecurity strategies and achieve excellence in the field. https://cloudsecurityalliance.org/star/

In the ever-expanding digital world, securing applications and the infrastructure they rely on is critical. This episode tackles three key security field acronyms: Application Security Posture Management (ASPM), Cloud Security Posture Management (CSPM), and Cloud-Native Application Protection Platform (CNAPP). While all focused on bolstering security posture, these target different aspects of one's security program. Listen as we interview Karthik Swarnam, Chief Security and Trust Officer at Armorcode, a CSA member, and take a deep dive into this subject. We discuss: Distinguishing between ASPM, CSPM, and CNAPP: Understand their functionalities, target areas, and how they differ in safeguarding your digital assets. Navigating the ever-changing security landscape of security solutions and making informed decisions toward building a mature software security program and maintaining a robust security posture. How these solutions integrate with the Cloud Control Matrix and the CSA STAR Program best practices to facilitate better security and reduce risk. https://cloudsecurityalliance.org/star/

In this episode, John DiMaria & Cameron Kline, Director of Attest Services at BARR Advisory delve into the relationship between CSA STAR Level 2 and ISO 27001 standards, emphasizing the significant overlap in best practices, procedures, and controls for cloud service providers (CSPs) operating in medium- to high-risk environments. They highlight how collaboration with an auditing firm certified in both frameworks can expedite the compliance process, offering practical tips for streamlining attestations.  Discover why dual compliance against CSA STAR Level 2 and ISO 27001 is paramount for CSPs to demonstrate their commitment to robust security practices and gain a competitive advantage. Cameron also discusses the strategic benefits of integrating CSA STAR Level 2 certification into existing compliance programs post-ISO 27001 audit, providing actionable insights for organizations considering this journey.  Whether you're navigating compliance complexities or seeking optimization strategies, this episode equips you with the knowledge to leverage the synergy between CSA STAR Level 2 and ISO 27001 standards effectively. https://cloudsecurityalliance.org/star/

In a world where the speed of business is only outpaced by the speed of regulatory changes, staying compliant without slowing down has become the new competitive edge. In this episode, we delve into the heart of agile compliance with a special guest Travis Howerton; Co-Founder and Chief Executive Officer of RegScale, a pioneering company at the forefront of compliance automation. Discover how automated technology and continuous monitoring is revolutionizing the way organizations approach compliance, risk management, and governance in both the private and government sectors. Our guest will share insights into the challenges businesses face in today's regulatory environment and how these innovative solutions are helping to navigate these complexities with greater ease and efficiency. In this interview, we explore: The evolving landscape of regulatory compliance and its impact on businesses across sectors. How technological advances allow organizations leverage automation to streamline compliance processes, reduce risks, and enhance operational agility as well as resilience. Success stories of organizations that have transformed their compliance journey. Tips and strategies for organizations looking to adopt a more proactive and automated approach to compliance. The future of compliance management: trends to watch and predictions for the evolving role of technology in governance and risk management. Listen to an enlightening conversation that sheds light on the future of compliance and how the latest technology is not just enabling businesses to keep up but to get ahead. Whether you're a business leader, a compliance professional, or just curious about the intersection of technology and regulation, this episode will provide valuable insights into making compliance a driver for innovation and growth. https://cloudsecurityalliance.org/star/

In the latest CSA Security Update Podcast episode, we delve into the fascinating world of cybersecurity attestations and explore why CPA firms are increasingly leading the charge in this domain. Host John DiMaria is joined by Pawel Wilczynski, Cybersecurity Manager at Baker Newman Noyes (BNN), a top-ranked tax, assurance, and advisory firm and an accredited CSA STAR Assessment Firm. The episode delves into why CPA firms, traditionally known for financial audits, are exceptionally well-suited for cybersecurity attestations and how they apply their expertise in ensuring rigorous processes and adherence to standards like CSA STAR when performing cybersecurity assurance over cloud systems. This episode is a must-listen for anyone interested in understanding the critical role of CPA firms in the evolving landscape of cybersecurity attestations. https://cloudsecurityalliance.org/star/

In today's digital landscape, cloud security and governance are paramount. But how do we measure and attest to the security controls of cloud service providers? Enter the Cloud Security Alliance STAR Attestation and SOC2 - two prominent frameworks for assessing and ensuring cloud security. In this episode, we dive deep into the intricacies of CSA STAR Attestation, its relationship with SOC2, and their collective impact on cloud governance and cybersecurity. Join the CSA and our guests, Pat Nester and Michael Nouguier, as they shed light on these intertwined topics, helping businesses navigate the cloudy (pun intended) waters of modern IT infrastructure.

In our enlightening interview with Steve Orrin, Federal CTO at Intel, we delve into the intricate world of government cloud technologies, the key role of FEDRAMP, and the future of CCM/STAR integration. Orrin provides an insider's perspective on how these powerful tools are shaping the landscape of data security and regulatory compliance in the digital age. We also explore the challenges and opportunities presented by these technologies, offering valuable insights for stakeholders navigating the complex government cloud infrastructure. This engaging conversation promises to deepen your understanding of these critical domains and their transformative impact on today's digital governance landscape.

In this podcast interview, we sit down with Nandor Csonka, the global practice lead for cloud security services at NCC Group, to explore their adoption and implementation of the CSA Cloud Control Matrix (CCM). Nandor shares the initial process of why NCC Group adopted the CCM and the challenges they encountered as a non CSP (Cloud Service Provider), along with their strategies for overcoming them.  He also highlights the specific benefits and improvements that resulted from the adoption within NCC Group. Furthermore, Nandor delves into the common challenges faced by clients when implementing the CSA CCM and provides insights on successful adoption strategies.  We discuss the transition from older versions to CSA CCM V4 and its associated challenges. Lastly, Nandor sheds light on NCC Group's future involvement with the CSA CCM, including their journey to become an accredited CB (Certification Body) and CSA STAR (Security, Trust & Assurance Registry) auditing firm. He also shares his perspective on areas where organizations may need to focus more attention and allocate resources in the coming years. Join us for an insightful discussion on securing cloud technology and reducing risk with NCC Group's cloud security expert.

This case study highlights Dell Technologies' journey towards adopting the Cloud Security Alliance's (CSA) Security, Trust, and Assurance Registry (STAR) program to enhance its cloud security.  Dell Technologies addressed the continued challenges of the cloud by adopting the CSA STAR program, which provided a framework for assessing and documenting cloud providers' security and compliance posture.    Join us as we talk to Andrea Doherty; Technical lead for the Dell Technologies Security and Resiliency Organization's Trusted Cloud and Services program where she discusses Dell's challenges, objectives, and implementation outcomes. Find out how they were able to enhance their comprehensive security and compliance program, gain a competitive advantage, and enhance customer trust.

This case study highlights Dell Technologies' journey towards adopting the Cloud Security Alliance's (CSA) Security, Trust, and Assurance Registry (STAR) program to enhance its cloud security.  Dell Technologies addressed the continued challenges of the cloud by adopting the CSA STAR program, which provided a framework for assessing and documenting cloud providers' security and compliance posture.    Join us as we talk to Andrea Doherty; Technical lead for the Dell Technologies Security and Resiliency Organization's Trusted Cloud and Services program where she discusses Dell's challenges, objectives, and implementation outcomes. Find out how they were able to enhance their comprehensive security and compliance program, gain a competitive advantage, and enhance customer trust.

Private cloud computing refers to a computing infrastructure setup where an organization operates its own cloud environment within its data center. What are the unique information security challenges faced day to day. VS other types of cloud, and how does one use the CSA Cloud Control Matrix to mitigate the risks? Due to heightened security issues over the last few years, are companies considering moving to a private cloud? What are the pros and cons and what is the best advise from those doing it? Listen as we interview Balasubramanian (Bala) Krishnamurthy; Head of Cloud Security & Cloud Automation Services at Nokia. Bala will take us on a virtual case study concerning the private cloud, its advantages, challenges, and their journey to achieving CSA STAR Certification, along with advice to all CSPs in the process of considering STAR Certification.

As organizations look to cloud services to process more sensitive and critical data, security and risk management teams require tools to quickly assess and understand the types and rigor of security controls applied by cloud service providers. CSA STAR Attestation is the first cloud-specific attestation program designed to meet this need. CSA STAR Attestation is a collaboration between CSA and the AICPA to provide guidelines for CPAs to conduct SOC 2 engagements using criteria from the AICPA (Trust Service Principles,AT 101) and the CSA Cloud Controls Matrix. Requirements for the cloud can be quite different than non-cloud environments, so a generic approach to security compliance is not a viable solution for providing evidence of assurance in the cloud.Unique considerations must be given to: • Understanding the scope of the cloud computing environment. • Do the current security controls cover the unique aspects of the cloud environment? • Can the current risk assessment capture the risks correctly? • Audit trails that prove the effectiveness Join me as I interview one of two Principles from Schellman, Ryan Mackie and Gary Nelson as they take you on a journey down the road to Cloud Attestation and provide details of the audit,  advice on implementation and the value proposition. 

As we’re seeing more cyber attacks in software, open-source software, etc., there is a crucial need for businesses to future-proof against emerging threats.  - How  can companies take preventative (vs reactive) measures, including embedding security into the software as it’s being built (security by design) - Urgency for daily scans - How the CCM and STAR Program can facilitate reducing risk and understanding the Shared Responsibility Model. - What to expect in 2022 (more supply chain attacks expected) Get the answers to all these topics and more as we interview Farshad Abasi, Founder and Chief Security Officer of Forward Security. In this episode, we discuss software design and development, network and system architecture and cybersecurity, management. 

STAR Certification is the internationally recognized cloud security certification program from CSA that specifies comprehensive and stringent cloud security requirements on CSPs. The CSA Cloud Controls Matrix (CCM) is the de-facto standard for cloud security assurance and compliance, widely used in assessing cloud security performance of cloud implementations. Ribose Achieved the world’s first STAR Certification with CSA Cloud Controls Matrix v4 that was released in January 2021.  Recorded live from Hong Kong, Ronald Tse; CEO and founder of RIBOSE, takes us through their journey with STAR over the years and discusses the value, ROI and future of STAR and the work being done to increase the value of the auditing and compliance landscape.