Vår oppgave

Å fremme god praksis for å sikre skytjenester, og gi opplæring i bruk av skytjenester for å sikre alle andre former for databehandling.

De vanligste sikkerhetsfeilene i AWS S3

S3 er blant de eldste tjenestene på AWS og også blant de mest brukte for å lagre store mengder data - fra privatpersoner til noen av verdens største selskapene. Sikkerhetsfunksjonene er omfattende og mangfoldige - såpass mangfoldige at det kan være lett å miste...

US CLOUD Act øker bruken av kryptering

Clarifying Lawful Overseas Use of Data (CLOUD) Act ble i all stillhet vedtatt som lov i USA 23. mars 2018. Den gjør det kort fortalt mye enklere for amerikanske myndigheter å be om utlevering av data fra amerikanske tjenesteleverandører - uansett om tjenesten fysisk...

CCSK workshop med 36 deltakere på ISF Høstkonferansen!

Mandag 27. august gjennomførte Cloud Security Alliance Norway (CSAN) en CCSK workshop med 36 deltagere(!) som en del av programmet på ISF Høstkonferansen CCSK - Certificate of Cloud Security Knowledge - workshop er en del av et større opplegg med elæringskomponenter,...

Devoteam og Basefarm inn som sponsorer av Cloud Security Alliance Norway

Cloud Security Alliance Norway ønsker Devoteam Fornebu Consulting og Basefarm velkommen som sponsorer for 2018 og 2019! Cloud Security Alliance (CSA) er en organisasjon med over 80 000 medlemmer på verdensbasis dedikert til å definere og øke bevisstheten rundt god...

Samarbeidspartnere

Bedriftsmedlemmer

De vanligste sikkerhetsfeilene i AWS S3

10. sep 2018

US CLOUD Act øker bruken av kryptering

7. sep 2018

CCSK workshop med 36 deltakere på ISF Høstkonferansen!

28. aug 2018

Devoteam og Basefarm inn som sponsorer av Cloud Security Alliance Norway

25. aug 2018

Top Threats to Cloud Computing: Deep Dive

25. aug 2018

Denne casestudien forsøker å konkretisere sikkerhetsanalyse ved å ved å bruke ni anekdoter sitert i "Top Threats"-grunnlaget. Hver av de ni eksemplene presenteres i form av (1) et referansediagram og (2) en detaljert fortelling. Referansediagrammets beskriver...

CSA Code of Conduct for GDPR Compliance

20. aug 2018

Hva er CSAs retningslinjer for GDPR? Uansett om du er bedriftens personvernombud eller selv er en leverandør av skytjenester, gir CSA Code of Conduct for GDPR Compliance et konsekvent og omfattende rammeverk for å overholde EUs GDPR lovverk. Code of Conduct for GDPR...

State of Cloud Security 2018

5. mai 2018

Rapporten, forfattet av CSA Global Enterprise Advisory Board, undersøker det økende omfanget i bruk av skytjenester og relatert teknologier, hva både bedrifter og skyleverandører gjør for å sikre at sikkerhetskravene er oppfylt, hvordan de fungerer best med...

Imagine a Day Without Safe Cryptography

4. mai 2018

Every security professional, at one time or another (or at many times), confronts executive opposition to changing technology. We all know that every innovation in technology requires adaptations in the security services, introducing new costs tied to shifts in...

Recommendations for IoT Firmware Update Processes: Addressing complexities in a vast ecosystem of connected devices

By Sabri Khemissa, IT-OT-Cloud Cybersecurity Strategist,Thales Traditionally, updating software for IT assets involves three stages: analysis, staging, and distribution of the update—a process that usually occurs during off-hours for the business. Typically, these updates apply cryptographic controls (digital signatures) to safeguard the integrity and authenticity of the software. However, the Internet of Things (IoT), with its […] The post Recommendations for IoT...
PCI Compliance for Cloud Environments: Tackle FIM and Other Requirements with a Host-Based Approach

By Patrick Flanders, Director of Marketing, Lacework Compliance frameworks and security standards are necessary, but they can be a burden on IT and security teams. They provide structure, process, and management guidelines that enable businesses to serve customers and interoperate with other organizations, all according to accepted guidelines that facilitate a better experience for end […] The post PCI Compliance for...
Pwned Passwords – Have Your Credentials Been Stolen?

By Paul Sullivan, Software Engineer, Bitglass Data breaches now seem to be a daily occurrence. In recent months, Have I Been Pwned (HIBP) introduced Pwned Passwords, which allows you to securely check your password against a database of breach data. There are over 280 breaches in the database, and that’s only the tip of the iceberg. Breaches aren’t just a problem for the users who lose their data, but for […] The post Pwned Passwords –...
Software-Defined Perimeter Architecture Guide Preview: Part 3

Part 3 in a four-part series By Jason Garbis, Vice President/Secure Access Products, Cyxtera Technologies Inc. Thanks for returning for our third blog posting, providing a preview of the forthcoming Software-Defined Perimeter (SDP) Architecture Guide. In this article, we’re focusing on the “Core SDP Concepts” section of the document, which introduces the underlying principles of SDP, […] The post Software-Defined Perimeter Architecture...
Join CSA’s New DC Metro Area Chapter

The Cloud Security Alliance (CSA) is pleased to announce that its DC Metro Area chapter has been chartered to serve the DC metro area CSA membership. The chapter’s region includes a diverse range of businesses, government organizations and academic institutions who all have an interest in well-engineered, secure IT systems, including many heavily regulated industries such as […] The post Join CSA’s New...
Avoiding Holes in Your AWS Buckets

By Sanjay Kalra, CPO & Co-Founder, Lacework Enterprises are moving to the cloud at a breathtaking pace, and they’re taking valuable data with them. Hackers are right behind them, hot on the trail of as much data as they can steal. The cloud upends traditional notions of networks and hosts, and it topples security practices that […] The post Avoiding Holes in...
US CLOUD Act Drives Adoption of Cloud Encryption

By Rich Campagna, Chief Marketing Officer, Bitglass The US Clarifying Lawful Overseas Use of Data (CLOUD) Act was quietly enacted into law on March 23, 2018. I say quietly due to the controversial nature of how it was passed—snuck into the back of a 2,300 page Federal spending bill on the eve of Congress’ vote. While debate […] The post US CLOUD Act...
California’s CCPA Brings EU Data Privacy to the US

By Rich Campagna, Chief Marketing Officer, Bitglass Over the summer a new data privacy law, the California Consumer Privacy Act of 2018 (CCPA), was passed. Assembly Bill 375 is scheduled to go into effect on Jan 1, 2020, which means there will likely be a lot of change before we see the final, enforced version of the […] The post California’s CCPA Brings...

How to Phish Your Employees For Functional Security

More than 90% of reported data breaches and security incidents in 2016 involved a successful phishing attack*. Attackers rely on phishing as a primary strategy because it continues to be both effective and efficient, as users remain the most vulnerable attack vector. The best defense against phishing is proactively educating your users, through a shame-free campaign that prepares them for real-world...
How Identity Fits Into a Security-First Approach

Securing your workforce and users, in the cloud, and on the go can be difficult. A recent Enterprise Strategy Group (ESG) survey discovered that for nearly 75% of organizations, a username and password was the only barrier between a determined attacker and access to your critical resources. Identity Access Management (IAM) can help you drive a security-first approach with usability that...
Discovering a Competitive Advantage with ISO 27001 Certification

Organizations with mature, enterprise-wide information security risk management programs enjoy a competitive advantage, thanks to ISO 27001 certification that signifies an international standard for safeguarding information. In this webinar, Lockpath's Jason Eubanks, a governance, risk management, and compliance (GRC) consultant and former ISO auditor, will share the business case for earning ISO 27001 certification and the critical role of technology...
Crypto Conflagration and Securing the Cryptocurrency Ecosystem

Not only do cryptocurrencies rely on blockchain for their security, but they also rely on an ecosystem of software that runs exchanges, wallets, smart contracts and more. This software ecosystem, as well as the infrastructure on which it runs are required to be secure. Whether you are a builder, investor, or consumer- this webinar will help you learn how...
Cloud–delivered Security: Why It’s Your Best Bet

On-prem vs Cloud-based security? It’s an ongoing debate that SecOps teams face daily. With cloud adoption continuing to be a top business initiative, SecOps teams must adapt or risk falling behind. As most on-prem security tools don’t work in the cloud and suffer limitations, SecOps teams are faced with a myriad of new technologies and tools to implement to protect their...
Can the Maturity of Your Cloud Security Strategy Make or Break Your Organization

New research from Enterprise Strategy Group and Netskope shows that there are business ramifications when it comes to your approach to cloud security. Join senior ESG cybersecurity analyst Doug Cahill and Netskope VP Marketing Scott Hogrefe for this webinar to get a deep dive into this research and understand how being a cloud "Discoverer," "Controler," or "Enabler" can make a difference...
Past the Perimeter: Earned Access Through A Zero-Trust Model

Users whose digital lives are increasingly mobile don’t want to be tied to their desks, and an effective security strategy must be flexible enough to protect access from boardrooms and bars, cubicles and coffee shops alike. To do this, companies must ensure that users and their devices meet the same security controls, whether they’re outside or inside the network perimeter....
Improving Cloud Hygiene

As one of the first companies to commit wholly to the cloud, we have learned a lot about how to keep our security hygiene levels up even as we support rapid development and deployment cycles. Part of this effort is the development of an internal tool called MAVLink. MAVLink enables us to collect and analyze security data from our cloud...