So Your Company has decided to do FedRAMP - What does that mean?
Nick Peters, Senior Manager, FedRAMP Assurance Services, Coalfire
The exponential increase in cloud adoption in recent years has led to a dramatic increase in technology companies evolving from software and application companies to Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a Service (IaaS) providers. The 2011 release of the Cloud First Initiative in the Federal government launched the Federal Risk and Authorization Management Program (FedRAMP). To sell cloud services to the Federal government, FedRAMP requires Cloud Service Providers (CSPs) to have their multi-tenant Cloud Service Offering (CSO) assessed and authorized, and then they must maintain compliance via continuous monitoring and annual assessments.
The Cloud is Beige - The demise of black box testing
Mike Weber, Vice President, Coalfire Labs
Black-box penetration testing is dead. I’d question why it is even a consideration. It’s of limited and dubious value in almost any context. Wait, wait… I didn’t mean that. Put down the pitchforks and torches, development and QA teams, I’m only talking about black-box penetration testing. Yes, traditional software functional or regression testing in a black-box manner does have a purpose. Validating the functional requirements of the code has a place, and it’s valuable. Non-functional black-box testing has a place as well, when evaluating the sturdiness of an application such as load testing and the like. Settle down. Read more
Compliance in the Cloud - Effective Strategies to Ensure Success
Adam Kerns, Managing Principal, Commercial Services: Product Development, Coalfire
It's no secret that the principles, controls, and terminology associated with compliance can be a confusing alphabet soup that hinders an organization's ability to go-to-market and expand its customer base. The difficulties in meeting compliance objectives are not limited to organization size or types. Most (if not all) organizations struggle to integrate compliance requirements into their existing workloads and systems.
Data Governance in the Cloud
Jonathan Leach, Principal, Cyber Risk Services, Coalfire
Data governance is something your organization has likely considered, put into action, and implemented. The question is, to what degree is the data actually being governed – or not?
Is Cloud Computing Really New? And Other Insights on the Changing Face of Cloud
Kurt Hagerman, CxO Advisor, Cyber Strategy, Coalfire
What is cloud computing, and why is its increased use getting so much attention? In my view, cloud computing is just the latest iteration of what started back in the days of the IBM service bureaus of the 1960s and ‘70s. Back then, only a handful of organizations had the resources to own and operate IBM mainframe computers. Those that did eventually realized they were only using a fraction of these computers’ capacity; and so, they came up with a novel approach – rent computing time to other organizations that couldn’t afford to own a mainframe themselves but could take advantage of the computing power they offered. This was easily done given the security model and ability to partition memory and processing built into the mainframe. Voila! Cloud computing was born!