Study provides a deeper understanding of public cloud adoption and risk management practices within the enterprise
Download
June 22, 2022 08:00 AM Eastern Daylight Time
SEATTLE--( BUSINESS WIRE )--The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released Measuring Risk and Risk Governance . CSA collaborated with Google Cloud on the survey, which was designed to assess the maturity of public cloud and risk management within the enterprise and provides a deeper understanding of public cloud adoption and risk management practices within the enterprise. The process of digital transformation involves adopting technologies that enhance operational and customer experiences. With an eye toward improving overall business risk management, the cloud is increasingly seen as a means to strengthen an enterprise’s risk posture, a move that is often accompanied by an upgraded approach to application, data, and infrastructure security. Accordingly, enterprise risk assessment processes must adapt the cloud model and take into consideration the implications of shared responsibility, where both the cloud service provider and customers have ownership in the delivery of services. Evaluating cloud and business risk together provides a better understanding of IT's impact on an enterprise's overall risk maturity, including adopting a shared fate partnership between CSP and customers. “With enterprises continuing to add production in the cloud and the growing use of cloud services, managing cloud and digital assets will be critical in risk management and measurement,” said Jim Reavis, co-founder and CEO, Cloud Security Alliance. “While there is still work to be done as organizations mature their ability to manage cloud and multi-cloud security and risk mitigations, these issues are improved in the cloud when compared to current on-premise and legacy IT environments. This study confirms that an organization's best path to viable risk management involves IT modernization into the cloud or cloud-like on-premise infrastructure.”
Among the survey’s key findings:
As organizations adopt cloud, they are challenged to evaluate risk. There is no consistency of data classification across the use of cloud platforms and services — only 21 percent of users are utilizing cloud service data classification, and only 65 percent of those users are aligning with internal data classification schemes. Cloud risk evaluation faces challenges with growing business adoption of cloud. With cloud adoption numbers increasing, more than half (52%) of organizations reported that they did not evaluate the risk of their cloud services being used after procurement as product features or business environments changed. Tools for quantifying and measuring risk need to improve. Seventy percent of organizations reported less effective processes for assigning risk to cloud assets, with only 4 percent reporting having highly effective practices. Monitoring, measuring, and reporting is difficult. Thirty percent of enterprises reported that risk scoring systems are used as a directional guide to risk improvement for certain cloud solutions as opposed to measurements that can be relied on for comparison across all cloud services. “Increasingly, cloud is becoming less of a risk to manage and more of a means to manage these risks. Continuously evaluating your risk status allows enterprises to properly configure and maximize the effectiveness of their security solutions, which in turn, protects their assets and improves business productivity,” said Phil Venables, Chief Information Security Officer and Vice President of Google Cloud. “This study has shone a light on the opportunities enterprises can take to manage and measure their risk, and will hopefully lead to improved risk management practices. And, whereas these practices impact many areas in the enterprise, modernizing the approach helps both businesses and providers improve their cloud adoption.”
The survey was created to add to the industry’s knowledge about enterprise risk, and was conducted in two phases. The data gathered in the first round of interviews, which were conducted by CSA, were analyzed and used to refine the question set for the second part, an online survey that received responses from more than 600 IT and security professionals from a variety of organization sizes and locations. About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org , and follow us on Twitter @cloudsa . Contacts

New Survey from Cloud Security Alliance and Google Finds Cloud Adoption Improves Risk Management and Mitigation

Help Net Security
Cloud computing top concerns: The focus is shifting
The Cloud Security Alliance (CSA) released the Top Threats to Cloud Computing: The Pandemic 11 report, which found a marked change in what cloud security provider (CSP) security issues are seen as concerning. New, more nuanced items, such as configuration and authentication, suggest both that consumers’ understanding of the cloud has matured, and signals a technology landscape where consumers are actively considering cloud migration. Respondents indicated topics such as control plane weaknesses, metastructure (i.e., mechanisms that provide the interface between the infrastructure and other layers) and applistructure (applications deployed in the cloud and the services used to build them) failures, and limited cloud visibility as top concerns – a marked departure from more generic threats, risks, and vulnerabilities (i.e. data loss, denial of service) that featured more strongly in previous Top Threats reports. Other top threats in this year’s survey highlight lack-of-control type hurdles that users may experience with CSPs, such as limited cloud usage visibility and a weak control plane, which can lead to data breaches or leaks beyond the traditional landscape. “Collectively, these security issues are a call to action for developing and enhancing cloud security awareness , configuration, and identity management. As cloud business models and security tactics evolve, there is an even greater need to address security issues that are situated higher up the technology stack and are the result of senior management decisions,” said Jon-Michael C. Brook , co-chair, Top Threats Working Group, and one of the paper’s lead authors. Cloud security concerns ranked
The report ranked the following concerns in order of significance (with applicable previous rankings) and provides control (Cloud Controls Matrix v4) recommendations and real-world reference examples to assist compliance, risk, and technology staff. Of note is the fact that traditional cloud security issues were found to be less of a concern, with some (e.g., shared technology vulnerabilities, and CSP system vulnerabilities) rated so low that they were excluded in this report:
Insufficient identity, credential, access and key management (#4)
Insecure interfaces and APIs (#7)
Misconfiguration and inadequate change control (#2)
Lack of cloud security architecture and strategy (#3)
Insecure software development
Organized crime/hackers/APT
Cloud storage data exfiltration
“Considering that user interfaces and APIs are the modern way to consume services, it’s concerning that there are still significant challenges when it comes to securing these features. The cloud – with its complexity – is also the perfect place for attackers to hide and an ideal launchpad for attacks. Add to that the fact that insider threats make it more challenging to protect organizations from data loss and it becomes clear that more industry attention and research is required,” said John Yeoh , Global Vice President of Research, Cloud Security Alliance . Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours
Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days
(IN)SECURE Magazine - E-mail sent when a new issue is released

Cloud computing top concerns: The focus is shifting

The Cloud Security Alliance…Cloud computing… read more

Cybersecurity Professionals Identify Top Cloud Computing Security Risks

Paper shares fundamental governance practices for SaaS environments that enumerate and consider risks during evaluation, adoption, usage, termination
Download
June 09, 2022 08:00 AM Eastern Daylight Time
SEATTLE & SAN FRANCISCO--( BUSINESS WIRE )--RSA Conference -- The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released Software-as-a-Service (SaaS) Governance Best Practices for Cloud Customers . Drafted by the SaaS Governance Working Group , the paper provides a baseline set of SaaS governance best practices for protecting data within SaaS environments, enumerates and considers risks according to the SaaS adoption and usage lifecycles, and finally, provides potential mitigation measures from the SaaS customer’s perspective. The SaaS environment ultimately presents a shift in the way organizations handle cybersecurity that introduces a shared responsibility between producers and consumers. While the domain of cloud adoption and security continues to evolve, not much guidance is available regarding SaaS governance and security. This, despite the reality that increasingly, different departments within an organization (Shadow IT) are occasionally utilizing SaaS offerings to power their critical business processes and functions and often storing sensitive data in SaaS environments. “SaaS requires a different security governance mindset. Because SaaS apps allow businesses to quickly and easily optimize business operations, adoption has come at the price of security. Few recognize how complex the configuration and permission settings of SaaS apps can be, which results in numerous misconfigurations, giving attackers the potential to access sensitive data,” said Amir Ofek, CEO of AxoniusX, the new innovation unit of Axonius, which sponsored the paper. “By following a widely adopted security framework, such as NIST CSF, coupled with the best-practices and recommendations in this document, organizations will be able to better establish SaaS governance and security processes to mitigate risk associated with SaaS usage, eliminate misconfigurations, and gain full control over their entire SaaS environment.”
“While SaaS offers tremendous opportunities for organizations to change the way they operate, consume innovative capabilities, and offload many of the operational burdens associated with both creating and maintaining applications, it isn’t without its concerns. As organizations continue to adopt SaaS-based applications and solutions, traditional organizational cybersecurity must be updated to reflect this new operating model. Failing to do so can increase the potential risk and ramifications of security incidents associated with the consumption of SaaS,” said Chris Hughes, co-founder and CISO at Aquia and project lead/lead author of the paper. The guide defines three necessary components that, when combined into a cohesive strategy, can provide integrated security for SaaS systems and solutions:
Process security. Protects the integrity of procedural activities to ensure the input and output of processes aren’t easily compromised. These are the managerial aspects, including policies and procedures, to ensure that an organization’s processes are consistent. Platform security. Deals with the security strength of the platform and the underlying dependencies of a SaaS service. These include the SaaS infrastructure, operating systems, and its potential suppliers. Application security. Deals with the security of the SaaS application itself. A SaaS application can only stay secure if it does not contain exploitable vulnerabilities and has implemented hardened configurations aligned with organizational and vendor security best practices, as well as compliance requirements. The Software-as-a-Service (SaaS) Governance Working Group aims to benefit all parties in the SaaS ecosystem by supporting a common understanding of SaaS related risks from the perspectives of the cloud customer and cloud service provider. Individuals interested in becoming involved in future research and initiatives are invited to join the working group . SaaS Governance Best Practices for Cloud Customers was sponsored by Axonius, a leader in cybersecurity asset management and SaaS management . CSA research prides itself on vendor neutrality, agility, and integrity of results. Sponsors are CSA Corporate Members who support the findings of the research project but have no added influence on the content development or editing rights to CSA research. About Axonius
Axonius gives customers the confidence to control complexity by mitigating threats, navigating risk, automating response actions, and informing business-level strategy. With solutions for both cyber asset attack surface management (CAASM) and SaaS management, Axonius is deployed in minutes and integrates with hundreds of data sources to provide a comprehensive asset inventory, uncover gaps, and automatically validate and enforce policies. Cited as one of the fastest-growing cybersecurity startups, with accolades from CNBC, Forbes, and Fortune, Axonius covers millions of assets, including devices and cloud assets, user accounts, and SaaS applications, for customers around the world. For more, visit Axonius.com . About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org , and follow us on Twitter @cloudsa . Contacts

Cloud Security Alliance Offers Governance Best Practices for Protecting Data Throughout Software-as-a-Service (SaaS) Lifecycle

Study reveals shift in cloud security focus from information security to configuration and authentication
Download
June 07, 2022 08:00 AM Eastern Daylight Time
SEATTLE & SAN FRANCISCO--( BUSINESS WIRE )--RSA Conference – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released Top Threats to Cloud Computing: The Pandemic 11 . The report, the sixth in the Top Threats to Cloud Computing series , found a marked change in what cloud security provider (CSP) security issues are seen as concerning. New, more nuanced items, such as configuration and authentication, suggest both that consumers’ understanding of the cloud has matured, and signals a technology landscape where consumers are actively considering cloud migration. Respondents indicated topics such as control plane weaknesses, metastructure (i.e., mechanisms that provide the interface between the infrastructure and other layers) and applistructure (applications deployed in the cloud and the services used to build them) failures, and limited cloud visibility as top concerns – a marked departure from more generic threats, risks, and vulnerabilities (i.e. data loss, denial of service) that featured more strongly in previous Top Threats reports. Other top threats in this year’s survey highlight lack-of-control type hurdles that users may experience with CSPs, such as limited cloud usage visibility and a weak control plane, which can lead to data breaches or leaks beyond the traditional landscape. “Collectively, these security issues are a call to action for developing and enhancing cloud security awareness, configuration, and identity management. As cloud business models and security tactics evolve, there is an even greater need to address security issues that are situated higher up the technology stack and are the result of senior management decisions,” said Jon-Michael C. Brook, co-chair, Top Threats Working Group , and one of the paper’s lead authors. The Pandemic 11 ranked the following concerns in order of significance (with applicable previous rankings ) and provides control ( Cloud Controls Matrix v4 ) recommendations and real-world reference examples to assist compliance, risk, and technology staff. Of note is the fact that traditional cloud security issues were found to be less of a concern, with some (e.g., shared technology vulnerabilities, and CSP system vulnerabilities), which featured in the previous Treacherous 12 , rated so low that they were excluded in this report:
Insufficient identity, credential, access and key management (#4)
Insecure interfaces and APIs (#7)
Misconfiguration and inadequate change control (#2)
Lack of cloud security architecture and strategy (#3)
Insecure software development
Organized crime/hackers/APT
Cloud storage data exfiltration
“Considering that user interfaces and APIs are the modern way to consume services, it’s concerning that there are still significant challenges when it comes to securing these features. The cloud – with its complexity – is also the perfect place for attackers to hide and an ideal launchpad for attacks. Add to that the fact that insider threats make it more challenging to protect organizations from data loss and it becomes clear that more industry attention and research is required,” said John Yeoh, Global Vice President of Research, Cloud Security Alliance. The CSA Top Threats Working Group aims to provide organizations with an up-to-date, expert-informed understanding of cloud security risks, threats and vulnerabilities in order to make educated risk-management decisions regarding cloud adoption strategies. Individuals interested in becoming involved in the future research and initiatives of this group are invited to do so by visiting the Join page . Top Threats to Cloud Computing: Pandemic 11, which was sponsored by cybersecurity company ExtraHop , surveyed 703 industry experts on security issues in the cloud industry. CSA research prides itself on vendor neutrality, agility, and integrity of results. Sponsors are CSA Corporate Members who support the findings of the research project but have no added influence on the content development or editing rights to CSA research. About ExtraHop
Cyberattackers have the advantage. ExtraHop is on a mission to help you take it back with security that can’t be undermined, outsmarted, or compromised. Our dynamic cyber defense platform, Reveal(x) 360, helps organizations detect and respond to advanced threats––before they compromise your business. We apply cloud-scale AI to petabytes of traffic per day, performing line-rate decryption and behavioral analysis across all infrastructure, workloads, and data-in-flight. With complete visibility from ExtraHop, enterprises can detect malicious behavior, hunt advanced threats, and forensically investigate any incident with confidence. ExtraHop has been recognized as a market leader in network detection and response by IDC, Gartner, Forbes, SC Media, and numerous others. When you don’t have to choose between protecting your business and moving it forward, that’s security uncompromised. Learn more at www.extrahop.com . About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org , and follow us on Twitter @cloudsa . Contacts

Cloud Security Alliance’s Top Threats to Cloud Computing: Pandemic 11 Report Finds Traditional Cloud Security Issues Becoming Less Concerning

Thales Group (Euronext: HO) is a multinational company that designs and builds electrical systems and provides services for the aerospace, defense, transportation, and security markets. It was founded in 1932 and is based in Paris, France.

Thales Group

The value proposition of the joint Cloud Security Alliance -- Thales collaboration .

Cloud Security Adoption in Italy

SECBERUS creates cloud security technology to help organizations stay secure and compliant in the public cloud. The company provides Cloud Security Posture Management (CSPM) through its flagship product, CUMULUS CYBER-IQ. Security leads can now manage multi-cloud misconfiguration risk with real-time risk visibility, intelligent remediation plans, and custom security & compliance reporting.

SECBERUS

ISACA is an international professional association that provides knowledge, standards, networking, credentialing, and career development to IT and cybersecurity professionals. Through its guidance and services, ISACA defines the roles of information system governance, security, risk, and assurance to professionals worldwide.

ISACA

`` This is an exciting next step in the ISACA and Cloud Security Alliance partnership because it will equip IT professionals for success in navigating the unique challenges of auditing for the cloud , '' said David Samuelson , ISACA CEO .

Cloud Security Alliance and ISACA Announce Availability of Industry&apos;s First Cloud Auditing Credential, the Certificate of Cloud Auditing Knowledge (CCAK)

tiro security

Cloud Security Alliance

TripActions

CNBC

Twilio

Endgame

Zynga

Qualys

Electronic Arts

Robert Half

Adobe Systems

Nortel Networks

Pacific Crest Securities

Huxley

SThree

Whitebox Advisors

Hanley Wood

SECNAP Network Security

Cloud Security Alliance is a non-profit organization formed to promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.

Wells Fargo Success Story

3M Success Story

Platform Overview

Cloud Security Alliance

Cloud Security Alliance’s customers

Work for Cloud Security Alliance?

Compete with Cloud Security Alliance?

Work for Cloud Security Alliance?

Discover the right solution for your team