...

...

cloud-security-dzone-2202-w_defa3108.pdf link

finserv-cloud-security-101-2023.pdf  link 

finserv-cloud-security-101-2023.pdf file

TOC

01 Securing customers' money in a cloud-first world..............3

02 Key cloud security solution categories: CSPM,

CIEM, and CWPP

03 What is CSPM?.

04 What is CIEM?

05 What is CWPP?

What is CNAPP?.

CNAPP has you covered.

Six key considerations when evaluating a cloud security solution

#1 Choose an agentless + agent based approach for comprehensive protection

#2 Manage configuration and permission risk..

#3 Identify and prioritize vulnerabilities from source to run........

#4 Enable cloud security monitoring with audit logs.........

#5 Implement runtime detection and response..

#6 Map to the MITRE ATT&CK framework............

Potential Value Opportunities

...

• cloud custom services have a learning 
• create cloud vendor locking requiring costs to move applications later ( vs open-source standard stacks with lower migration costs )
• as firms grow, efficient management of services can compete on costs with better flexibility, control than cloud providers in many cases

cloud-enterprise-hybrid-cloud-adoption-management-2024-short.pdf.  link

cloud-enterprise-hybrid-cloud-adoption-management-2024-short.pdf  file

concepts

strategies

myths

tips

Build Run Pipelines in the Cloud

https://www.linkedin.com/pulse/overview-security-postures-azure-aws-christophe-parisel/

...

https://www.fedramp.gov/faqs/

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a “do once, use many times” framework that saves cost, time, and staff required to conduct redundant Agency security assessments.

Yes, FedRAMP is mandatory for Federal Agency cloud deployments and service models at the low, moderate, and high risk impact levels. Private cloud deployments intended for single organizations and implemented fully within federal facilities are the only exception.

CSA - Cloud Security Alliance  - Security, Trust, Assurance and Risk (STAR)

Security, Trust, Assurance and Risk (STAR)
The industry's most powerful program for security assurance in the cloud.

The Security, Trust, Assurance, and Risk (STAR) Registry is a publicly accessible registry that documents the security and privacy controls provided by popular cloud computing offerings.

STAR encompasses the key principles of transparency, rigorous auditing, and harmonization of standards outlined in the Cloud Controls Matrix (CCM). Publishing to the registry allows organizations to show current and potential customers their security and compliance posture, including the regulations, standards, and frameworks they adhere to. It ultimately reduces complexity and helps alleviate the need to fill out multiple customer questionnaires.

Level 1 - self assessment with cloud security standards 

Level 2 - audited proof of compliance with cloud security standards

Which organizations should pursue level 2?

Organizations should pursue this level if they are...

• Operating in a medium to high risk environment
• Already hold or adhere to the following: ISO27001, SOC 2, GB/T 22080-2008, or GDPR
• Looking for a cost-effective way to increase assurance for cloud security and privacy.

Step-by-step guide for Example

...