Name: How to Negotiate a Proper SLA
Start: 2015-05-19T12:00:00Z
End: 2015-05-19T13:00:28.000Z
Location: BrightTALK

CSA CloudBytes was launched as a webinar series to help us educate the industry on all matters related to the cloud. Our channel is designed to inform our audience about trending topics, new technologies, and latest research. Learn more at cloudsecurityalliance.org.  Join the Cloud Security Alliance on LinkedIn and follow us on twitter: @cloudsa

As you move to the cloud, your security teams often feel a loss of control in this new world. Traditional tools and processes are not working in the cloud and visibility is limited. How do you identify and get your arms around the “real” risks in the cloud?

Getting security right starts with a first-principles approach to finding, focusing, and fixing risks across clouds and containers.

Join this webinar to learn:
• How to map security controls when moving from on-premise to the cloud?
• How innovative organizations eliminate blind spots and prioritize what matters 
• Leveraging open standards (ex. Falco) for runtime threat detection and cloud security monitoring  
• Key areas to cover when implementing cloud security from source to run

Hunting Suspicious Events with AWS CloudTrail: Fundamentals and Best Practices

Even with the best security people deploying the best security scanners, businesses today experience stubbornly long time-to-remediation.

Why? The reality today is that, before any security findings can be fixed, security teams are often forced to play air traffic controller – deduplicating, sorting, and prioritizing findings coming in from multiple siloed tools, then routing and following up with developers all across the organization to make sure problems get fixed. This leads to the ultimate irony - security teams become the main bottleneck for remediation.

But, does it have to be that way? Can security be removed as the middleman between findings and fixers and instead become a guiding and enabling function?

Is the security team the bottleneck to remediation?

The digital transformation of companies is well underway, and as enterprise increasingly adopt cloud-native approaches, attackers have also identified this as the weakest link in companies security posture. The result is a steep rise in attacks that target cloud-native applications, some hitting during development and others targeting production environments and live applications. The only way to combat this is by deploying strong and purpose-built security from code to runtime. But in order to be effective, it cannot be in siloes and it cannot affect development speed and agility. Join this webinar to hear about how you can seamlessly approach this challenge.

The real way to secure from code to runtime (without breaking development)

The explosion in the number and variety of SaaS apps used by enterprises has created both opportunities and a wider attack surface. Examine today's SaaS security landscape and threats with Maor Bin, CEO and co-founder of Adaptive Shield as he reveals the new attack method called "the SaaS Rootkit" as well as perspectives gleaned from security leaders in the 2022 SSPM Survey Report (completed in conjunction with CSA).

Examining 2022’s SaaS Security Landscape and Threats

A variety of threats affect your cloud security ranging from misconfigurations, network exploitation, brute-forcing, container malware, and account takeover to stolen credentials. These threats can affect your entire cloud estate - across multiple clouds, multiple regions, and multiple accounts with each having its own specific attack surface and active attack patterns. 

SecOps and DevOps teams are inundated with alerts on misconfigurations, CVEs, and active threats and it is a real challenge to prioritize what are the 10 next most critical things to do.

In this talk, we will discuss potential strategies to prioritize which security findings need to be resolved and which can be snoozed for a later time. An ideal burn-down chart to resolve any cloud security alerts should provide optimal additional risk reduction, for every ticket created for an issue to be resolved. 

We will also discuss how coupling runtime monitoring and configuration checking intelligently can help you fix your cloud security in the right order.

How to Prioritize Fixing Your Cloud Security

Digital transformation and application modernization are exponentially driving up the use of APIs. We’re using more APIs than ever, and they’re more functional than ever. They’re also more attractive to hackers than ever, but lots of organizations are hanging onto old ways of thinking about API security.

Join our lively discussion on the top five common industry myths surrounding API security. You’ll learn the pitfalls of some misguided API security approaches, cut through the hype around a few security trends, and get recommendations on how to improve your organization’s API security strategy.

Key takeaways:
• The impact trends such as zero trust, cloud migration, containerization, and shift-left are having on API security
• The role of traditional security controls in API security – what they deliver and where they fall short
• The value of a full lifecycle approach in grappling with API security
• How to deploy dedicated API security that fits today’s automated, agile, and cloud-first environments

API MythBusters: Crushing Five Security Myths that are Crushing Your Safety

Conducting forensics and incident response for containers and Kubernetes helps you better understand security breaches, meet compliance requirements and recover quickly. On average, containers live less than 5 minutes, so having a cloud-native incident response plan is critical.

In this webinar we’ll cover:

• Detecting threats using security frameworks like MITRE ATT&CK
• Best practices to streamline your incident response workflow in container and Kubernetes environments
• A live demo of conducting threat investigation using open source Sysdig Inspect

Container and Kubernetes Security Best Practices: Forensics & Incident Response

Cloud is at the center of an expanding IT ecosystem giving organizations the ability to scale, innovate and enhance business objectives securely. The rise of cloud and today’s remote workforce requires that measures be put in place across IT systems to protect the layers, components and people of the IT ecosystem. Zero Trust, arguably the most widely discussed trend in cybersecurity, challenges the barriers of IT systems by ensuring that implicit trust is verified, limited and continuously monitored.

CSA launched the Zero Trust Advancement Center (ZTAC) to create a consolidated resource center of curated Zero Trust content, providing easy access to research, training and professional credentialing. ZTAC delivers a community driven approach to eliminate market confusion and guide the public on a Zero Trust philosophy to cybersecurity based on strategies and methodologies for cloud customers. In this webinar, CSA’s Global Vice President of Research, John Yeoh, will highlight the evolution of Zero Trust, the goals of the ZTAC initiatives, and the components that make it the most trusted source on Zero Trust today.

The Zero Trust Advancement Center is hosting free monthly webinars about one of the most widely talked about cybersecurity trends today. Zero Trust experts will guide you through the ins and outs of this increasingly popular approach to cybersecurity, helping you come to an understanding of why Zero Trust is needed today, what the key principles are, and how to implement it into your business planning, enterprise architectures, and technology deployments. Learn more at https://csaurl.org/zeroinseries.

Advancing Zero Trust Principles

How do you manage your security portfolio? Do you use regulatory frameworks as a basis? As a target? Experience shows that these frameworks are an important starting-off point but should not be considered the targeted end-state.How confident are you that your controls will function correctly during a real attack? Time and time again, we see that having the controls does not mean they will work in a real emergency. If they don’t work as intended, is it because they’re not configured correctly? Or do you have a gap? Congratulations! You invested in getting the best of breed controls and the best talent to configure, manage, and monitor these. Now, how do you test your cloud environment? You know how to test your controls, but when should you do it? And how often? Most frameworks and best practices guidelines suggest you do so annually or when you make a major change to your environment, but how does the external threat landscape come into consideration? You now have the insights and data to show your controls will function in a real-world attack. How do you use this intel when talking to your board? Is it always doom and gloom or is celebrating successes equally important? This presentation makes a case for integrating continuous breach attack simulation as a practical approach to rationalizing your security portfolio. We examine the notion of abiding by the spirit of the compliance framework vs. the letter of that framework and discuss how you can get the most benefit out of your security controls through simulating real-world scenarios without risk to your environment. We then conclude with the positive impact that performing continuous breach attack simulation can bring to your communications up to the executive and board level.

Cloud Security with Continuous Security Validation

At Adobe we are always investing and innovating in the ways we improve the skills of our security team. For our incident responders that are part of our Security Coordination Center (SCC), this includes tabletop exercises, capture-the-flag (CTF) contests, incident simulations, peer-to-peer knowledge sharing, and other techniques designed to help teams better handle evolving real-world scenarios and improve our response processes. This effort also helps us uncover possible areas where investment in technology and tooling can help us get even better in how we manage incidents. In this webcast, Todd Harper, Manager, Incident Response and Mike Weaver, Sr. Incident Responder at Adobe will talk about the best practices we have learned as we have developed and grown the capabilities of our teams in being better incident responders. They will offer more detail on the programs we run and their impact on the effectiveness of our incident response team. You will leave this webcast with knowledge you can use to help improve your own incident response processes and capabilities in your organization.

Building Better Incident Responders

Panel Discussion 

In the light of the many cloud security related standards (e.g. ISO27017, STAR) that CSPs claim to comply with, how does an enterprise make sense of this plethora of seemingly different or similar frameworks? How does one reconcile these with respect to those specified by the regulators?  This panel of experts will help us to clear the air and clarify the confusion as well as bring to light how programs like CSA STAR help provide a "Implement Once Comply Many" approach.

MODERATOR : John DIMARIA (Assurance Investigatory Fellow & Research Fellow, CSA)

PANELISTS :
- Ashwin CHAUDHARY (CEO, Accedere Inc.)
- Nguyen Minh THANH (Cybersecurity Consultant, Viettel - CHT Co Ltd)
- Hoang QUANG Huy (Country Manager, Vietnam, Palo Alto Networks)
- Steven NGUYEN (Head of Solution Consultant, VNG Cloud)
- Dr. Sak SEGKHOONTHOD (Advisor, The Electronic Transactions Development Agency)

Standards, Standards Everywhere, Which One Should I Adopt?

Cloud adoption has been growing rapidly over the years due to business benefits such as cost  savings, scalability, increased security, ease of deployment. In 2020 the world experienced an even bigger upsurge due to the COVID pandemic. This massive growth in cloud adoption also brings about a unique set of challenges when it comes to data privacy and security.

The Security Trust Assurance and Risk (STAR) Program encompasses key principles of transparency, rigorous auditing, and harmonization of standards. Companies that submit to the STAR Registry indicate best practices and validate the security posture of their cloud offerings. They increase the level of assurance by turning their scars into STARs. It’s about reducing complexity, which equals reduced cost, decreased risk and increased security.

Join us on this must-attend as CSA provides you with an insight into the global growing mandate for organizational certification and details behind CSA STAR. During this session you will learn how it has evolved into a framework that provides a flexible, incremental, and multi-layered cloud provider system that is being recognized as the international certifiable harmonized GRC solution, starting with development, implementation and the three levels of the Open Certification Framework that constitute up the STAR Program.

CSA STAR Program – Turning your Scars into STARS

Threat modeling serves to identify threats and preventive measures for a system or application. However, threat modeling is one security methodology that has not matched the general rate of cloud adoption, due to a gap in guidance, expertise, and applicability of the practice. Threat modeling for cloud systems expands on standard threat modeling to account for unique cloud services. It allows organizations to further security discussions and assess their security controls and mitigation decisions. The CSA Cloud Threat Modeling best practice attempts to bridge the gap between threat modeling and the cloud. To that end, this publication provides crucial guidance to help identify threat modeling security objectives, set the scope of assessments, decompose systems, identify threats, identify design vulnerabilities, develop mitigations and controls, and communicate a call-to-action. Central lessons include the benefits of threat modeling, the unique knowledge and considerations required when threat modeling in the cloud, and how to create a cloud threat model. 
Example threat modeling cards are provided and can be used by your team for a more gamified approach.

Cloud Threat Modeling

Containers, Microservices, DevSecOps, oh my!   Where should one start when trying to design an application, much less bake security in as opposed to bolting it on.   The Cloud Security Alliance’s Application Containers and Microservices (ACM) Working Group conducted research to develop guidance around best practices to implement a secure application container architecture.   Come to this session to learn about the challenges and associated best practices to develop secure applications.

Best Practices for Implementing a Secure Application Container Architecture

It is important to recognize the compliance objectives and translate them to appropriate security measures. CSA recommends “Six Pillars of DevSecOps” and provides a high-level set of methods and solutions to build software at speed with minimal security-related bugs.  CSA provides guidance to ensure the gap between compliance and development is addressed by identifying inflection points within the software development lifecycle where these controls can be embedded, automated, measured, and tested in a transparent and easily understood way. CSA and SAFECode aim to continuously improve software security outcomes. The recent publication  covers in-depth details on Framework for Bridging Compliance and Development with the use of DevSecOps practices.

Bridging the Compliance & Development Gaps with DevSecOps

(In Vietnamese)

Distributed Denial-of-Service (DDoS) attacks are one of the most prevalent types of cyber attack, and their numbers are only climbing. DDoS attacks are large-scale incursions in which the perpetrator uses more than one unique source IP address (often thousands of them) to launch simultaneous attacks against a target. Organizations should be aware of this threat and on the lookout for the best DDoS mitigation methods.

In this talk, the speaker will advocate for Software-Defined Perimeter (SDP) as a tool to protect private services from DDoS attacks. SDP is an architecture that provides integrated security, which is otherwise hard to achieve with existing security point products.

Software-Defined Perimeter as a DDoS Prevention Mechanism

Keynote 

Vietnam has undergone major digital transformation over the last two decades of its development. The COVID-19 pandemic has accelerated much of its efforts. Today, Vietnam is maturing into a greater understanding of what it means to implement cloud technologies. What are the recent policy and regulatory developments that the country has undertaken to improve the adoption, safety, and security of cloud and its related technologies? This presentation will provide a snapshot of recent updates, and pose questions on what lies ahead for Vietnam's digital transformation.

Cloud Architecture and Digital Transformation in Vietnam

The growth of cloud service in Vietnam is driven by digital transformation involving many companies across industries. Besides the major CSPs, cloud clients in Vietnam also enjoy local private CSPs. 

Cloud services have become the preferred IT infrastructure of choice for many start-ups and enterprises. Cloud security is expected of CSPs by cloud service consumers. An important requirement is that the cloud data center has to be located in Vietnam for specific types of applications and purposes.  CSPs in Vietnam are required to comply with international standards such as ISO 27017, 27018 and government requirements such as No.1145/BTTTT-CATTT, Decision /QD Ttg-by Prime Minister.  In the banking sector, The State Bank of Vietnam is starting to support the use of public cloud services for all banking members (due to digital transformation pushing from the Government). For other industries, the policy depends on the respective organization and their plans in the near future.

Cloud computing is trending in Vietnam, a country full of potential that enjoys a high growth rate.  Cost and cyber security of the cloud environment are important things that both CSPs and clients are concerned with.

Evolving Cloud Security in the Age of Digital Transformation

The typical cloud customer easily grasps perceived advantages and user-friendliness in the cloud, but they are not security experts. Matching an customer's security requirements with what is being offered by CSPs can be the biggest challenge. Even though most CSPs include security provisions in their SLAs (Service Level Agreements), the variety of customer requirements make it all too easy to over/undershoot the security target. This is where the benefits of a template SLA kicks in.

This webinar will present expert opinions on the topic of cloud security SLA (secSLA) negotiation taking into consideration standards, technical, legal and social aspects.

How to Negotiate a Proper SLA

cloud

computing

security

legal

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

How to Negotiate a Proper SLA

Presented by

About this talk

More from this channel