Name: Fireside Chat
Start: 2022-10-13T02:30:00Z
End: 2022-10-13T03:00:30.000Z
Location: BrightTALK
Rating: 5

CSA CloudBytes was launched as a webinar series to help us educate the industry on all matters related to the cloud. Our channel is designed to inform our audience about trending topics, new technologies, and latest research. Learn more at cloudsecurityalliance.org.  Join the Cloud Security Alliance on LinkedIn and follow us on twitter: @cloudsa

Cloud development has enabled amazing innovations and allowed our companies to move faster. It’s also completely broken the old methods for prioritizing risk remediations. 

With an infrastructure that changes day-to-day, minute-to-minute, a cloud’s perimeter is hard to define. Checking for open network access and CVEs doesn’t keep attackers out of your cloud. 

The number of software vulnerabilities present at any point in the cloud, particularly with open source-driven development, far outnumber what was typical in the data center world. And the explosion of identities - representing both real users and machine identities - has opened up the attack surface for credential abuse a hundred-fold. These massive changes in scale make it overwhelming to try and to answer the question, “what should I fix next?”

The sheer scale and ephemeral nature of cloud demands a new approach to risk prioritization. Beyond securing a perimeter, combinations of overlapping risks create a hidden blast radius that includes sensitive data. An attacker may enter the cloud via a vulnerability on a sandbox environment, but through subsequent indirect access abuse, be able to move laterally and access PII. The only way to stop this? Knowing where your sensitive data is, and how anyone or anything can access it - even if access requires a combination of workload, identity, and network-based risks.

We’ve brought together cloud security leaders responsible for securing many of the Fortune 100 enterprise clouds to discuss how to rebuild remediation prioritization, and how blast radius intel is critical to spending your team’s remediation efforts wisely. 

During this session, our panel of cloud security leaders will share:

• Ideas for building in the cloud fast and securely
• How to overcome the cloud complexity challenge
• What alignment between dev, security, and ops can do for your company
• Avoiding the common pitfalls around prioritization

Prioritizing Risk Among the Chaos of Cloud Development

Software supply chains are the backbone of our digital connections. Unsecured software supply chains are becoming one of the biggest opportunities for hackers to strategically compromise mass amounts of victims with one entry point.    

How can you ensure and prove the code your organization develops does not contain vulnerabilities from open-source or third-party dependencies? That your development tools and practices are also secure and aren’t creating gaps for hackers to exploit? Most importantly, that the software you set out to develop, is not going to cause a customer to become compromised…   

In this talk we will answer these questions and look at the best frameworks and guidelines that can prevent software supply chain attacks and improve security posture.

Confidence in Software Supply Chains with Continuous Security

With a US economic recession looming, tech layoffs hitting the news, and security incidents continuing to climb at record rates, it’s a tough time to be a CISO. But experienced security leaders have dealt with economic pressures before, and in this discussion will share their insights into how new CISOs and security leaders should prepare to ‘recession-proof’ their security strategy for 2022 and beyond. Specifically, we’ll cover:

• Security trends from past recessions 
• How 2022 is different from past recessions
• What CISOs and security leaders can do to prepare
• Where to consolidate and where to invest for the best possible security outcomes 
• How to adjust your security strategy if you face resource constraints

Panel: CISO’s Guide to Security Strategy During a Recession

Cloud adoption is the trend of the decade, and threat actors are tailoring their methods to this new attack surface. Cryptojacking is the most prevalent type of cloud attack due to the low risk and high reward for the perpetrator. But even newer technology like containers is being used for evil as attackers plant unpleasant surprises in public repositories, exposing your business to potential supply chain compromise.

Join us to learn about what Sysdig's Threat Research Team is seeing out there and what you can do to protect yourself. Anna Belak, Director of Thought Leadership at Sysdig, will discuss:
• What types of attacks are popular in the cloud and why?
• How cryptojacking works and how to avoid becoming a victim?
• What is hiding in malicious Docker images and how to protect yourself?

Cloud Attacks Are Here: Threat Actors Like Containers Too!

The ever-changing nature of today's threat landscape, and the hyper-connected environments that today's businesses operate in, require that companies take a continuous approach to security that encapsulates their own environments as well as those belonging to the third parties they rely on to run their businesses. Moreover, continued migration to the cloud has created a need for a framework that accounts for requirements and controls necessary for running a business in a cloud first environment. Join CSA and SSC as we discuss the importance of continuously monitoring first and third parties, and how businesses can leverage CCM to guide and benchmark their security practices.

Continuously Monitoring First and Third Parties against the CCM Framework

Data security is arguably among the top concerns for anyone who uses cloud-based services – this is especially true for governments who are responsible for protecting nation-wide security. Prior to the creation of Federal Risk and Authorization Management Program (FedRAMP), cloud service providers had to conduct evaluations for each individual agency, often resulting in redundant and inconsistent efforts from both ends. Now, with FedRAMP, the U.S. government has established a standardized baseline of security assessment criteria for cloud services. This “authorize once, use many” approach ultimately helps to ensure government data is consistently secured in the cloud. 

 

At Adobe, we strongly believe that FedRAMP is an instrumental program in gaining customer trust for federal organizations and customers. To further support our ongoing compliance efforts, Adobe has also developed an open-source foundational framework of security processes and controls known as the Common Controls Framework (CCF). In this webcast, I will cover Adobe’s experience and continued success with FedRAMP, including how we’ve leveraged our CCF and the benefits we’ve uncovered. I will also share tips and best practices on how you can kickstart your organization’s own FedRAMP journey and how you can ensure all requirements are met.

Adobe CCF & FedRAMP Moderate: Building a Secure Compliant Environment

The world’s data is under attack and cybercrime continues to be a persistent threat impacting every organization. No company, government, or industry is immune. In this fireside chat, Rubrik’s Steve Stone and John Murphy will share newly released research and insights from "The State of Data Security" by Rubrik Zero Labs. Based on conversations with 1,600+ global CISOs, CIOs, and VPs of IT and Security Operations, the findings explore what’s happening in cybersecurity and the human effects from cyberthreats. These insights will help you navigate the dynamic threat landscape and gain key learnings on how to prepare for and recover from a cyberattack to secure your business.

A Fireside Chat: The Human Effects of Cybercrime

SaaS solutions have enabled healthcare organizations to better share EHRs (electronic health records) and similar PHI with patients, clinicians, and business partners involved in providing exceptional care. 

But is your organization using SaaS securely? Data breaches, misconfigurations, and 3rd party app integrations can potentially expose sensitive data across a healthcare organization’s SaaS ecosystem to the public and threat actors. On top of these risks, abiding by compliance considerations for PHI stored and accessed in the cloud adds additional configuration, permissions management, and audit complexity to SaaS within healthcare settings. 

Join healthcare SaaS security experts Mark Butler and Joshua Smith, along with AppOmni’s Michelle Jones as moderator, for an in-depth look at healthcare, SaaS security, and PHI. This panel discussion will cover topics such as:
• Controlling SaaS environments that store or touch PHI or EHRs
• Maintaining appropriate access roles that limit visibility to sensitive data 
• Considerations for data sharing and 3rd party integrations, such as Salesforce backend portals
• Policies and user education for phishing scams, ransomware, and other breach threats
• Regulatory requirements, increased audit diligence and compliance concerns across healthcare

Is PHI Secure in SaaS Applications — And Their  Ecosystems?

Achieving Zero Trust and securing multicloud infrastructure is an always-moving target. With more than 95 percent of human and workload identities using less than five percent of the permissions granted, this “permissions gap” has become the biggest roadblock to organizations protecting their critical multicloud infrastructure. 

Join us to learn about Cloud Infrastructure Entitlement Management (CIEM), a new approach to closing the gap by managing permissions with continuous and automated enforcement of least privilege across multicloud.

Achieving the Principle of Least Privilege Across Multicloud with CIEM!

With the rise in cyber threats, your cloud infrastructure growing and devops demanding privileged access, you can no longer approach cloud security opportunistically.

Surprisingly, a recent study by Osterman Research found that 84% of organizations had only rudimentary cloud security capabilities, while 80% of companies reported they lack a dedicated security team responsible for protecting cloud resources from threats.

In this webinar, we will look at the key findings of the Osterman study and introduce a Cloud Security Maturity Model to help organizations assess their maturity level and plan an actionable roadmap to incrementally improve on it.

In participating in this session find out:
● How applying a maturity model to your organization can help you set cloud security priorities and build a security roadmap
● How to close surprising gaps in perception and reality of organizations’ security practices as revealed by the study
● Which security practices, when prioritized, lead to higher maturity levels, and other actions to build into a continuous maturity improvement program

How Does Your Cloud Security Compare, and Where Do You Go From Here?

When moving to the cloud, people often rely on their cloud service provider (CSP) for security and other baseline configurations, assuming that the cloud is secure by default. However, that’s an incorrect – and potentially dangerous – assumption. While CSPs provide features and platforms to build, deploy, and manage secure applications, certain configurations are still the customer’s responsibility. Customers need to apply the shared responsibility model provided by many leading CSPs and understand what security and compliance controls they are responsible for implementing and managing. 

In this webcast, Manik will cover typical customer responsibilities in the shared responsibility model, including data governance, access management, network management, logging and monitoring, backup management, encryption, and more. Manik will also touch on the major security tools provided by AWS and Azure and how customers can leverage them to satisfy compliance requirements. Also, Manik will talk a bit about Security-driven compliance and compliance-driven security in a cloud world.

Responsible Compliance for Cloud Security

Today’s attackers have become cloud security experts, abusing cloud APIs to deploy ransomware, mine cryptocurrency, or steal data. Andre Rall, former Head of Account Takeover for AWS Fraud Prevention, has seen it happen first hand and has some surprising stories to share.

Join a lively conversation with Rall, now Director of Cloud Security at Uptycs, as we dive into:
• The different types of data that AWS makes available to cloud security practitioners 
• Why the reconnaissance phase of a cloud attack is where you should prioritize detection efforts
• How attackers abuse the AWS API to perform discovery, privilege escalation, and data exfiltration
• Offer advice on how organizations can defend their AWS estates from sophisticated threat actors

Threat Detection in AWS: Cloud security secrets from my time at AWS

Whether you noticed it or not, data governance is very much back on the agenda globally, from the European General Data Protection Regulation (GDPR), to California's personal data and privacy law and everything in between. When doing business globally, the data chain of custody and associated responsibility, including data retention, is an increasingly important consideration as we move towards cloud-based data management services and big data analytics.
During this session, we will take you through the major changes around the world, delve into data governance issues and how they may impact the financial industry, and provide some predictions of upcoming trends. We will also discuss the current landscape and why the adequacy of the current regulations is still being debated.

Governance in the Cloud - Managing Data Regulation

Historically, security architectures relied on a castle and moat strategy. We derived a certain amount of comfort knowing our assets were protected inside the castle. We placed a base level of trust in people because they entered the same gates, we did to enter the castle. Post-Covid, the castle is more porous than ever. Enterprises are much more complex, with most revenue driven by digital, and more than half of corporate valuations are derived from intangible, usually digital assets. With about 36 million people working from home at least part-time, our exposure has only increased. Traditional security practices do not work. Zero Trust fundamentally changes the way we view security architectures, how we minimize the blast radius, and how we respond to incidents.   This session focuses on not only the philosophy of Zero Trust but, more importantly, how Zero Trust fits into traditional Governance, Risk Management, and Compliance (GRC) practices like the Lines of Defense (LODs), Risk Registers, and RAIC diagrams. The session will begin with an overview of how the game has changed. We will then talk about where Zero Trust fits into your strategy and end with practical guidance on crafting your Zero Trust journey with a list of things you can do today.

Aligning Zero Trust with Organizational Governance and Compliance Practices

You’ve got a bunch of Zero Trust experts sitting on a panel in front of you…what do you do? Pepper them with questions of course! Ask the event presenters pretty much anything you want (well, within reason) related to Zero Trust. This will be an interactive and informative session, providing you with a great opportunity to gain insights into real world problems faced by other attendees, as well as a chance to ask experts to “read the tea leaves” about the past, present, and future of Zero Trust.

Ask the Experts: Life, The Universe and Everything about Zero Trust

Building off of our beginner session for Zero Trust, we will expand that knowledge into a more complex look for advanced practitioners. This session will cover the deeper layers of Zero Trust from the perspective of a more advanced implementation. What advanced architecture looks like, at what point you can consider yourself in an advanced environment, and understanding where to go once you reach this point will be just a few of the key points given during this panel.

An Advanced Approach to Zero Trust in the Enterprise

In the current age of sophisticated architectures and engineering feats, executives are still faced with the difficulty or struggle of building out or adopting their business into a Zero Trust future on top of already competing priorities. Accompanied by CISO's leading in this space, the panel will discuss their personal Zero Trust journeys and successes and failures when approaching this architecture. This panel will also address the resourcing issues and costs, identifying what pillar of zero trust makes the most sense to start with, and how to be successful should Zero Trust be in your future.

CISO Panel: Leading into a World of Zero Trust

CrowdStrike’s mission is to stop breaches from all adversaries including nation-states, criminal organizations, and even from insider threats.  We will reveal our findings of key tactics and techniques used by these adversaries and how to leverage this information to develop an adversary focused Zero Trust strategy.   Through a use case based approach, we will show the top five CISO best practices to stop these modern attacks while showing value to the business for all stages of Zero Trust deployment maturity.

Deploying Adversary Focused Zero Trust

Fireside Chat with FOONG Cheng Leong (Advocate & Solicitor, Foong Cheng Leong & Co) & Moderator Daniele CATTEDDU (CTO, CSA)

Fireside Chat

Cloud Security

Cyber Security

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Fireside Chat

Presented by

About this talk

More from this channel