CloudSecurityAlliance

@cloudsa

We lead in security of Cloud, AI and Zero Trust. Follow our research, education, certification and events.

Global

cloudsecurityalliance.org

الردود المنشورات المُعاد نشرها الوسائط

CloudSecurityAlliance
@cloudsa
3h
2am: an agent spins up three sub-agents to parallelize a job, each mints its own API key, then all three vanish by sunrise. The keys don't. Do that across every team running agentic workflows and your identity population turns over faster than any access review cycle could ever
1
CloudSecurityAlliance
@cloudsa
5h
Quick gut check: do you actually know where your cloud provider's responsibility ends and yours begins, or are you just assuming the diagram in their docs matches reality? Most teams only find out during an incident, when it's too late to matter. CCSK is how you find out earlier:
cloudsecurityalliance.org
Certificate of Cloud Security Knowledge (CCSK) | CSA
The CCSK is an open-book, online exam, completed in 90 minutes with 60 multiple-choice questions selected randomly from the CCSK question pool.
CloudSecurityAlliance
@cloudsa
6h
CSA membership goes from $9,000 to $15,000 on October 1. That's not a price increase dressed up as a sale — it's the Frontier Ready rate holding through September 30, then ending. $6,000 difference. If your 2027 security budget is being drafted right now, this is the cheaper line
cloudsecurityalliance.org
CSA September 2026 Membership Drive — Frontier Ready | CSA
Join Cloud Security Alliance through September 30th, 2026 for $9,000 with one year of Corporate Membership plus Frontier Ready Support. From October 1st, the combined package is $15,000.
CloudSecurityAlliance
@cloudsa
10h
Before you sign with a new cloud vendor, their site says "we take security seriously." Great — what does that actually mean? A logo and a promise isn't due diligence. STAR Registry is where you check instead: published, third-party-verifiable assessments from the world's largest
cloudsecurityalliance.org
STAR | Cloud Security Alliance (CSA)
The Security Trust Assurance and Risk (STAR) Program encompasses key principles of transparency, rigorous auditing, and harmonization of standards. Companies who use STAR indicate best practices and...
CloudSecurityAlliance
@cloudsa
14h
Red Heron's rootkit doesn't just hide on your Linux box — it auto-relaunches the moment you kill it. The China-linked actor built SIXZUT to patch ~15 core library functions via LD_PRELOAD, then paired it with a new implant (JITTERLY) packing 30+ post-exploitation commands. They
labs.cloudsecurityalliance.org
Red Heron Weaponizes Gitea RCE, Compromises 13 Organizations
Key Takeaways A suspected China-linked threat actor tracked by Acronis’s Threat Research Unit as Red Heron converted a public proof-of-concept for CVE-2026-60004, a critical remote code execu…