Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

12/17/2010
06:37 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

CSA Releases Cloud Controls Matrix 1.1

New version includes more thorough mapping around NIST and GAAP

Orlando, FL – December 17, 2010 – The Cloud Security Alliance (CSA) today announced the launch of revision 1.1 of the CCM Security Controls Matrix. The matrix is now available for free download at: http://www.cloudsecurityalliance.org/cm.html

The Cloud Security Alliance Cloud Controls Matrix (CCM); as part of the CSA GRC Stack, is specifically designed to provide fundamental security principles to guide cloud vendors and to assist prospective cloud customers in assessing the overall security risk of a cloud provider. The CSA CCM provides a controls framework that gives a detailed understanding of security concepts and principles that are aligned to the Cloud Security Alliance’s 13 domains. The foundations of the CSA CCM rest on its customized relationship to other industry-accepted security standards, regulations, and controls frameworks such as ISO 27001/27002, ISACA COBIT, PCI, and NIST. As a framework, the CSA CCM provides organizations with the needed structure, detail and clarity relating to information security tailored to the cloud industry. The CSA CCM strengthens existing information security control environments by emphasizing business information security control requirements, reduces and identifies consistent security threats and vulnerabilities in the cloud, provides standardize security and operational risk management, and seeks to normalize security expectations, cloud taxonomy and terminology, and security measures implemented in the cloud.

In support of the CSA CCM, John DiMaria, president of Holistic Information Security Practitioner Institute (HISPI) said, “We are proud to be associated with and have contributed to the integrity of the CSA Cloud Controls Matrix. HISPI is recognized as a leader through its introduction of a visionary, next generation line of thinking. HISPI’s overall objectives include researching and developing an integrated system for widely accepted best practice frameworks that are applicable to Information Security such as ISO/IEC 27002, ISO/IEC 27001, COBIT, COSO, ISO/IEC 20000 (ITIL), NIST Guidelines, FIPS 200 (NIST 800-53).” DiMaria went on to say, “Our mapping experts and volunteers were happy to deliver the final quality checks and feedback that we feel raises the level of confidence and ultimately the acceptance of the CSA controls matrix.”

Phil Agcaoili, Cloud Security Alliance Cloud Controls Matrix co-founder and steering committee co-chair, added, “I continue to be amazed at the unprecedented level of collaboration and cooperation among the global security community and continue to be very pleased with the industry support to quickly and efficiently produce results. The Holistic Information Security Practitioner Institute (HISPI) and its community answered the call to support the Cloud security industry and delivered very rapidly to meet the demands of the global economy.”

About Cloud Security Alliance

The Cloud Security Alliance is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing. The Cloud Security Alliance is led by a broad coalition of industry practitioners, corporations, associations and other key stakeholders. For further information, the Cloud Security Alliance Web site is www.cloudsecurityalliance.org.

Contact

Zenobia Godschalk, [email protected] , PH: 650-269-8315

About The HISPI:

Headquartered in Lithonia, GA, the Holistic Information Security Practitioner Institute (HISPI) is an independent certification organization consisting of volunteers that are true information security practitioners, such as Chief Information Security Officers (CISOs), Information Security Officers (ISOs), Information Security Managers, Directors of Information Security, Security Analysts, Security Engineers and Technology Risk Managers from major corporations and organizations.

One of the main objectives of the HISPI is to promote cost-effective training and certification to information security, audit and compliance professionals, particularly Public Sector and Higher Education employees, where budget constraints can be a barrier to obtaining such quality training and certification.

Membership to the HISP Institute is currently open to anyone who is interested in achieving their organizational objectives through improving the efficiency of the organization's internal controls and security processes, as well as adopting a holistic approach to information security management. Because the certification effectively blends technology, processes and people to meet company goals, the professional is often considered to be a hybrid Information Security professional with a balance of technical and business skills. This indicates the HISP certified individual can function effectively in the capacity of a CISO, CCO, CRO, Risk Manager, Security Manager or Audit Manager.

For additional information on the HISPI and the benefits of membership, please visit the HISPI website at http://www.hispi.org or call 888-247-4858.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
The Data-Centric Path to Zero Trust
Altaz Valani, Director of Insights Research, Security Compass,  1/13/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).