Financial Services Industry

Financial Services Meeting - 3/23/22

• CSA Updates and Chapter Events - Spring 2022
  • RSA Conference 2022 - June 6^th-9^th
  • SECtember 2022 - September 26^th
  • CCSK Digital Badge - In partnership with Credly, CSA will be providing digital badges to qualified holders of the CCSK v.3 and v.4.
  • Zero Trust Advancement Center - CSA's mission is to create research, training, professional credentialing and provide an online center for additional curated Zero Trust resources. These tools will enable enterprises to understand and implement Zero Trust principles into business planning, enterprise architectures and technology deployments.
• CSA Peer Reviews and Surveys
• https://cloudsecurityalliance.org/research/contribute#peer-reviews
  • HPC Cloud Services Onboarding Guide - March 24^th
  • SaaS Governance Best Practices for Cloud Customers - April 4^th
  • Best Practices for Smart Contract Security Hyperledger Fabric - April 4^th
    
  • Cloud Key Management Working Group Charter - April 13^th
• Latest Research Releases
• https://cloudsecurityalliance.org/research/
  • The Importance of STAR - March 17^th
  • Software-Defined Perimeter (SDP) Specification v2.0 - March 10^th
  • Blockchain/Distributed Ledger Technology (DLT) Risk and Security Considerations - February 16^th
• Financial Services Research in Development
• Cloud Usage in the Financial Services Sector v2 (Draft)
  • Domains / areas for next survey
  • Data privacy/sharing: GDPR / Schrems 2
  • Vendor risk assessments: SaaS provider -> subcontractor to CSP
  • Encryption/key
  • Secrets (short lived etc) lifecycle management:
  • Compliance infra for SaaS/PaaS decentralized/centralized environments
  • Application / Ops: end-to-end understanding/visibility, maturity, documentation (DevOps as a forcing function highlighting gaps in Application teams understanding and appreciation for Ops) / Incident Preparedness within Ops
  • Agile maturity: how are orgs benchmarking their maturity within agile adoption
  • BCP: region migration (e.g. in response to geo-political events): tension between availability zones vs region (particularly in context of SaaS providers)
  • SOC: logging/visibility/response, level of integration with internal/3rd party SOCs
  • SaaS integration with SOC - is it happening?
  • Homework question: Take one or two of the above and formulate a survey question and suggest the answer choices/measures (scroll to the end to see the prior format - just for ideas)
    
  • Cloud Usage in the Financial Services Sector - Previous paper/survey from February 2020 for reference
• Lift and Shift Best Practices and Strategy (Draft)
  
• Next Zoom Meeting: April 27^th 8:00 AM PT
• https://cloudsecurityalliance.zoom.us/j/94151107820
  • Agenda, guest speaker TBA
  • Cloud Usage in the Financial Services Sector v2 development

------------------------------
Alex Kaluza
Research Coordinator
Cloud Security Alliance
------------------------------