Financial Services Industry

Financial Services Meeting - 7/27/22

• CSA Events and Updates
  • CSA ASEAN Summit 2022 - August 4^th - 5^th
  • ATARC 2022 Zero Trust Summit - August 9^th
  • Black Hat USA 2022 - August 10^th- 11^th
  • Cyversity Engage | A Step Towards Continuous Trust - August 24^th
  • SECtember 2022 - September 26^th- 30^th
• Zero Trust Advancement Center Events
  • Top 5 Zero Trust Practices to Stop Modern Attacks - August 24^th
    
  • The role of zero trust in improving corporate governance and compliance - September 14^th
  • Zero Trust Summit - November 16^th - 17^th
• Cloud Change Management for initiated changes
  • CSP-initiated changes that result in vulnerabilities 
  • This initiative aims to achieve 2 outcomes:
    • Agree on an industry-standard approach for change notification to consumers of CSPs & SaaS platform providers that can be accessed by consumers of these services.
    • Explore consumer tooling that can read in the CSP notifications, support workflow & triage changes.
  • CSA Global Security Database (GSD)
    • Meant to be a fast, cooperative, royalty free, and public collection of security information. 
    • The project uses the open source model to overcome many of the existing shortcomings of security databases such as being difficult to access, update, and restricted use of the security information.
• Poll group for a new Financial Services meeting time
  • Due to scheduling conflicts with the CCM working group and for other reasons, the Financial Services working group is planning on adjusting the day/time of the meeting. 
  • As of now, the 4th Monday of every Month at 8:00 AM PT is the preferred time slot selected by the group, instead of the current 4th Wednesday of every month at 8:00 AM PT. 
• Financial Services Research in Development
  • Cloud Usage in the Financial Services Sector v2
    • Execution Stage - Continue to review draft, finalize, ready for Peer Review, potential release in August/September 2022
    • Add applicable categories/domains which would provide useful information for modern Financial Institutions in the cloud.
    • Develop questions/answers of different styles and varieties to get a well-rounded perspective of the current state of the industry.
    • Add informative graphics, tables, and charts to provide context.
      
• Financial security startup company evaluations
  • Proposal - Have 30 minutes of each monthly call for a working session, and 30 minutes for a "shark tank" style session with security companies having 10 minutes to pitch and receive feedback
  • A potential way to increase participation from Financial Institutions in the working group
• CSA Peer Reviews and Surveys
  • Recommendations for using a Customer Controlled Key Store - August 12^th
    
  • Healthcare Interoperability - August 8^th
  • Sensitive Data in the Cloud (Survey) - July 12^th
• Recent Research Releases
  • Third-Party Vendor Risk Management - July 19^th
  • CSA CCM v4.0 Addendum - CRI FS Profile v1.2 - July 15^th
  • Critical Controls Implementation for Oracle Fusion Applications - July 12^th
  • State of ICS Security in the Age of Cloud - July 5^th
  • Measuring Risk and Risk Governance - June 21^st
• Next Zoom Meeting: Monday, August 22^nd 8:00 AM PT
• https://cloudsecurityalliance.zoom.us/j/94151107820
  • Provide an overview of the CRI control framework, the CCM/CRI mapping and the recently published CSA CCM v4.0 Addendum - CRI FS Profile v1.2 for financial services
  • Cloud Change Management for initiated changes
  • Cloud Usage in the Financial Services Sector v2 development

------------------------------
Alex Kaluza
Research Analyst
Cloud Security Alliance
------------------------------