Panel Discussion: GDPR with the CSA Center of Excellence

How to avoid letting supply chain attack compromise your most sensitive machines.
Supply-chain attacks affecting software development when a malicious code is introduced into legitimate software through supply chain poisoning is an effective tool for cybercriminals. It has been used many times in the wild, successful attacks generating hundreds of thousands of downloads leading to successful pipeline compromise and backdoored software distribution. Such attacks tend to target the most sensitive production environments and are enabled and augmented by sub-par security practices and miscommunication between DevOps and InfoSec. The results are long-lasting, impacting the company image, relations and often bottom line. Let’s discuss how DevOps can introduce on-demand security to their CI/CD pipelines without hindering their KPIs.

Ten years after the formation of the Cloud Security Alliance, cloud computing is a proven and globally accepted enterprise delivery and operational technology model. According to a January 2019 IDC report, the spending on Cloud IT infrastructure may have reached a tipping point in the third quarter of 2018 by surpassing traditional IT revenues with slightly more than a 50% market share.
Looking at the European market, on one hand cloud computing appears not to have achieved maturity and expressed its full potential, yet on the other we see several new emerging and converging trends (Industrial IoT, Blockchain and AI). This session will address emerging technology trends and the risk and opportunities in the aftermath of the COVID 19 pandemic.

This session hosted by the CSA EMEA Privacy Center of Excellence will address accountability under GDPR and how Codes of Conduct and certifications are being leveraged by organizations to drive transparency, compliance, and trust.

GDPR Fundamentals & CSA Code of Conduct: Objectives, Scope and Methodology.

Join Chris Hertz, VP, and Jeremy Snyder, Sr. Director, DivvyCloud by Rapid7 to learn how to achieve full lifecycle cloud security. They will discuss how cloud security challenges manifest in DevOps and how cloud security and developer misalignment creates friction and makes security a four-letter word. Additionally, they will provide guidance on how to integrate cloud security into DevOps with pipelines and Infrastructure as Code to improve developer productivity and cloud security.

Alexandra will share insights on the multi-level work of the European Banking Federation (EBF) to facilitate the adoption of cloud computing in the European banking sector. The EBF supports the efforts of European institutions and agencies to promote security for cloud usage, contributing the banking industry's input in shaping processes and standards. Emphasis is attributed on the need for a future-proof risk-based approach, alleviation of fragmentation and establishment of a common security level.

An effective governance, risk and compliance program should enable all stakeholders across business units to break down traditionally siloed risk areas and replace them with a connected, holistic view of risk that spans their organization and relationships. However, the data sprawl and scope of GRC initiatives can make this seem like a daunting or unattainable task. When reviewing today's roles, responsibilities and technology across today’s data driven landscape, there are three key aspects that set the foundation for establishing an insightful GRC program. In this session, we’ll review modern day GRC-drivers as well as the challenges of operating in the age of digital enterprises. We’ll breakdown practical applications and lessons learned in building a risk-based culture, proactively monitoring compliance, and mapping digital enterprises for GRC success.
−Define business outcomes to own risk within each line of business and encourage support across leadership
−Understand how to harmonize regulatory obligations and business objectives to effectively balance compliance and risk
−Learn how to eliminate overlap across systems to work together and add greater business value to every layer of an organization.

Cloud Computing is entering a mature phase from both the market share and technical evolution standpoint. However, one area that could achieve better results is security and privacy governance. Modernizing the risk management approach, improving the organizational accountability program and streamlining compliance are to be considered key goals for companies that want to optimize their cloud investments and reduce the likelihood of security and privacy incidents.
Two of the foundational pieces for this optimization process are compliance with solid standards and a skilled and knowledgeable workforce.
In this session Daniele Catteddu, Global CTO at CSA, will moderate a panel of key experts on cloud auditing, risks management and governance from the Financial Services sector and Accademia.

This talk will look at the Cybersecurity Certification Framework under the EU Cybersecurity Act (2019), give an overview of the new European cybersecurity certification schemes under development and offer an outlook on the implementation and use of such schemes for 2021 and beyond.

Certifications or attestations championed through the CSA STAR program, ISO/IEC, or AICPA, have been a critical driver in the adoption of cloud service across the globe. However, for some cloud customers in sensitive or highly-regulated industries such as banking or healthcare, these certifications or attestations are not sufficient because they do not provide a continuous level of assurance as they rely on annual or bi-annual audits only.
To address the concerns of this segment of the industry, the Cloud Security Alliance (CSA) is building a continuous auditing framework designed to provide assurance to customers on a monthly, daily, or even hourly basis. This framework can be applied either to self-assessments or third-party certifications.

This talk will look at the Cybersecurity Certification Framework under the EU Cybersecurity Act (2019), give an overview of the new European cybersecurity certification schemes under development and offer an outlook on the implementation and use of such schemes for 2021 and beyond.

In 2019, the Cybersecurity Act became a law in Europe, establishing a European Certification Framework. In November 2019, the European Commission tasked ENISA with designing a candidate scheme for cloud services. This work is currently underway. This presentation will first describe the Cybersecurity Act's Certification Framework, and then provide a high-level status on the ongoing work on the scheme for cloud services.

In 2019, the Cybersecurity Act became law in Europe, establishing a European Certification Framework. In November 2019, the European Commission tasked ENISA with designing a candidate scheme for cloud services. This work is currently underway. This presentation will first describe the Cybersecurity Act's Certification Framework, and then provide a high-level status on the ongoing work on the scheme for cloud services.

Certifications or attestations championed through the CSA STAR program, ISO/IEC, or AICPA, have been a critical driver in the adoption of cloud service across the globe. However, for some cloud customers insensitive or highly-regulated industries such as banking or healthcare, these certifications or attestations are not sufficient because they do not provide a continuous level of assurance as they rely on annual or bi-annual audits only.
To address the concerns of this segment of the industry, the Cloud Security Alliance (CSA) is building a continuous auditing framework designed to assure customers on a monthly, daily, or even hourly basis. This framework can be applied either to self-assessments or third-party certifications.

The Israeli ministry of health was facing a major challenge, develop fast solution for tracking the movement of citizens and alert if they been exposed to COVID-19 patients while the keeping privacy of the citizens safe. In very short time frame the ministry with the help of security community released an open source application that got the full blessing and support even from the security community. In this webinar Moshe Ferber, Chairman @ CSA Israeli Chapter and Guy Barnhart-mages, CTO @ Profero and consultant for the ministry, will be talking about the process of releasing this new application and how challenges were analyzed and solved.

This webinar will introduce CSA's Top 20 Critical Controls for Cloud ERP Customers document. The webinar will discuss common challenges of migrating and operating ERP applications in the cloud as well as discussing the Top 20 critical controls that organizations can use to help them secure their ERP applications in the cloud.

SDP combines well-proven technical and architectural components to protect networked applications and infrastructure, more efficiently and effectively than with traditional network security tools.
This document serves to explain SDP, educate readers on its benefits, and encourage its adoption.

In this webinar, the lead author for CSA's "Mitigating the Quantum Threat with Hybrid Cryptography," Roberta Faux, will give the document background and an overview of what you can expect in the document itself.

Application containers and a microservices architecture are being used to design, develop and deploy applications leveraging agile software development approaches such as Development Operations. Security must be embedded into these software development approaches. CSA has recently released two documents that outline the challenges and best practices in securing application containers and microservices to provide guidance on the engineering of trustworthy secure systems through the lens of the Developer, Operator and Architect.

In this webinar, Anil Karmel, co-chair for the CSA Application Containers and Microservices Working group will cover....
- define application containers and microservices
- background on the research and development of the artifacts
- container security challenges and best practices
- microservices challenges and best practices
- overview of the document contents