Financial Services Industry

Financial Services Meeting - 4/28/21

• Recent Activity, upcoming CSA Events - Spring 2021
  • RSA Conference 2021
  • CSA CISO Summit at RSAC 2021
  • Identity as the New Perimeter
  • Getting Sassy With SASE
  • How to Think Like a Hacker to Avoid Cloud Exploits
• CCAK Exam now available
• CSA Blog
  
  
• CSA & Cyber Risk Institute Mapping project
  • CSA Global Vice President John Yeoh
    • John explained the partnership between CSA and the Cyber Risk Institute to integrate CSA's Cloud Controls Matrix (CCM) and CRI's Cloud Cybersecurity Profile for the financial services industry. The goal is to define the scope, objectives and technical specifications of the Cloud Security Framework for Financial Services.
    • We're looking for SME volunteers who would like to contribute to this mapping project, and will continue to discuss the details at upcoming meetings.
    • https://cloudsecurityalliance.org/artifacts/cloud-security-initiative-for-the-financial-sector-working-group-charter/
      
      
• Lift & Shift discussion, cloud compliance demo
  • Nnamdi Osuagwu, CEO Strategic Generation 
    
    • Nnamdi gave a demo on Hybrid Cloud Security & Compliance by utilizing a network scanning compliance tool to scan a test network, and demonstrate how the software can be used to examine a network for compliance to a specific framework (NIST, HIPAA, CCM).
    • Compliance scans are design to locate and assess vulnerabilities in system hardening configurations, not applications or operating systems. Compliance scanning is a crucial part of a vulnerability management program.
      
• Open Discussion, Q&A
  • Follow up questions from the group for John on the Cyber Risk mapping project and Nnamdi's hybrid cloud compliance demo.
  • Topic ideas for the next financial services research publications
    • Additional Lift & Shift Case studies
      
      • Develop a framework and/or checklist that could be useful in Lift & Shift migrations for cloud services providers and financial institutions.
    • Containers in the Financial Industry
    • Threat Intelligence
      
      
• Next Zoom Meeting: May 26^th 8:00 AM PT
  • https://cloudsecurityalliance.zoom.us/j/94151107820
    • Lift and Shift
      • Continued discussion, additional use cases, develop framework, best practice recommendations
    • Cyber Risk Institute analysis and mapping with CCM, call for participation
    • Containers and Microservices usage and development strategy in the Financial Industry
      • ACM working group guest speaker, group discussion
    • Additional Resources
      • Review FSSP Artifacts
      • Participate in Research open peer reviews and surveys on CSA website

------------------------------
Alex Kaluza
Research Coordinator
Cloud Security Alliance
------------------------------