Search the Community

Do you recall the incidents involving Equifax, Target, and British Airways? Experiencing a data breach can significantly harm your business and reputation. According to research by the National Cyber Security Alliance, 60% of small businesses shut down within six months of a data breach. To mitigate the risk of such breaches, PCI compliance establishes stringent […] The post How to Get PCI Compliance Certification? Steps to Obtain it appeared first on Kratikal Blogs. The post How to Get PCI Compliance Certification? Steps to Obtain it appeared first on Security Boulevard. View the full article

At Google Cloud, we understand you have a diverse set of regulatory, compliance, and sovereignty needs. We strive to provide you with the controls you need and the flexibility to meet your requirements. We offer a range of customizable control packages, so you can choose the level of control that best aligns with your risk tolerance and compliance needs. This flexibility allows you to tailor your approach with minimal tradeoffs. Additionally, we work closely with local partners in select countries to offer Sovereign Controls by Partners to address regional requirements. At Google Cloud Next, we announced several significant enhancements to further expand your power of choice. These include new Regional Controls and Sovereign Controls by Partners packages, new controls and audit enhancements, and a simplified compliance configuration and management experience for new workloads. These enhancements give you even more options to meet your requirements, at lower cost, and with increased ease of use. Launch of Regional Controls Regional Controls, now in preview, expands Assured Workloads control package availability to 32 regions across 14 countries. Regional Controls includes foundational controls such as data residency (at-rest and during processing) and administrative Access Transparency, at no additional cost. With these updates, controls provided through Assured Workloads are now more accessible than ever to a wider range of Google Cloud customers. Sovereign Controls by Partners We are also expanding our Sovereign Controls by Partners offering with the preview of Sovereign Controls by PSN in Italy and Sovereign Controls by SIA/Minsait in Spain. These local partners, as with T-Systems in Germany and S3NS in France, can provide additional layers of control including local support personnel, managed External Key Management (EKM) with Key Access Justifications (KAJ), and additional oversight options. EKM with KAJ provides strong control over your data. Since keys are stored outside of Google's infrastructure, you or your local partner have the power to directly approve or deny any access requests. You can read more about how partnerships like these have met the specific demands of our European customers and have helped to propel their businesses forward. Expanding compliance controls and audit capabilities We also continue to expand the compliance controls and audit capabilities available to Google Cloud customers. We are thrilled to announce that we now offer data residency core processing commitments to customers using Assured Workloads. This is a major milestone towards additional data residency guarantees, which makes it possible for enterprise and public sector customers to deploy regulated workloads and help keep their data within the country while it is processed by the service. To help customers simplify their compliance audit process, our new Audit Manager can help automate control verification with proof of compliance for your workloads and data on Google Cloud. The compliance assessments and proof can help reduce the time and effort required in costly audit processes. Additionally, the available responsibility matrices clarify the shared responsibility between you and Google Cloud, and help you set the right configurations. Organizations that need to process sensitive data in the cloud with strong guarantees around confidentiality can continue to use our Confidential Computing portfolio. We offer support for Confidential VMs, Containers, and your entire data processing pipeline, as well as ubiquitous data encryption, which can provide additional security and peace of mind about the encryption and protection of your data. Simplifying the onboarding experience We’ve worked to make it easier to configure workload controls by default and migrate workloads that were not initially set up in Assured Workloads to a controlled environment. A new onboarding flow is now directly integrated into the Cloud Resource Manager (CRM). When setting up a Google Cloud folder from the CRM, simply choose 'Assured Workloads Folder' to automatically apply a chosen set of Regional, Sovereign, or Compliance controls to resources in that folder. The new “Learn More” panel provides contextual information to help understand Assured Workloads capabilities during the folder creation process, and it can help you make an informed decision as to the right control package for your specific needs. We’ve also streamlined and simplified the setup flow to help you save time. Getting started You can take advantage of our free trial program to check out our premium compliance offerings at no additional cost for a limited time. If you’re looking to migrate existing Google Cloud workloads into an Assured Workloads controlled environment, we have an Analyze Move API that can assist you by pointing out any incompatibilities in moving your current projects into your chosen Assured Workloads program. And if you’re not sure where to start your sovereignty journey, you can use our free interactive Digital Sovereignty Explorer to get personalized recommendations on potential cloud controls and other Google Sovereign Cloud solutions based on your unique requirements. View the full article

This blog discusses the essentials of PCI DSS compliance, and the 5 best practices for maintaining compliance. The post The 5 Best Practices for PCI DSS Compliance appeared first on Scytale. The post The 5 Best Practices for PCI DSS Compliance appeared first on Security Boulevard. View the full article

Our digital world is based on connectivity, but with that comes great responsibility. Businesses manage vast amounts of client information. Ensuring the protection of this information is not an easy task, especially given the company’s present obligations. This is why SOC 2 Compliance Audit is essential. It is important to rebuild trust and strengthen cybersecurity […] The post What is SOC 2 Compliance Audit? appeared first on Kratikal Blogs. The post What is SOC 2 Compliance Audit? appeared first on Security Boulevard. View the full article

DataDome's SOC 2 Type 2 compliance has been renewed for another year, further underlining that our security controls for customer data align with the AICPA's SOC 2 standard. The post DataDome Renews SOC 2 Type 2 Compliance appeared first on Security Boulevard. View the full article

Reading Time: 5 min Data privacy in email communication refers to the protection and confidentiality of personal data. Learn about data privacy regulations, particularly GDPR. The post Data Privacy in Email Communication: Compliance, Risks, and Best Practices appeared first on Security Boulevard. View the full article

By integrating AI into governance, organizations streamline their security operations and significantly reduce the likelihood of oversight or human error. The post The Strategic Role of AI in Governance, Risk and Compliance (GRC) appeared first on Security Boulevard. View the full article

At DockerCon 2023, we announced the General Availability (GA) of Docker Scout. We built Docker Scout for modern application teams, to help developers navigate the complexities and challenges of the software supply chain through actionable insights. The Scout GA release introduced several new capabilities, including a policy-driven evaluation mechanism, aka guardrails, that helps developers prioritize their insights to better align their work with organizational standards and industry best practices. In this article, we will walk through how Docker Scout policies enable teams to identify, prioritize, and fix their software quality issues at the point of creation — the developer inner loop (i.e., local development, building, and testing) — so that they can meet their organization’s security and reliability standards without compromising their speed of execution and innovation. Prioritizing problems When implementing software supply chain tools and processes, organizations often encounter a daunting wall of issues in their software. The sheer volume of these issues (ranging from vulnerabilities in code to malicious third-party dependencies, compromised build systems, and more) makes it difficult for development teams to balance shipping new features and improving their product. In such situations, policies play a crucial role in helping developers prioritize which problems to fix first by providing clear guidelines and criteria for resolution. Docker Scout’s out-of-the-box policies align with software supply chain best practices to maintain up-to-date base images, remove high-risk vulnerabilities, check for undesirable licenses, and look for other issues to help organizations maintain the quality of the artifacts they’re building or consuming (Figure 1). Figure 1: A summary of available policies in Docker Scout. These policies bring developers critical insights about their container images and enable them to focus on prioritizing new issues as they come in and to identify which pre-existing issues require their attention. In fact, developers can get these insights right from their local machine, where it is much faster and less expensive to iterate than later in the supply chain, such as in CI, or even later in production (Figure 2). Figure 2: Policy evaluation results in CLI. Make things better Docker Scout also adopts a more pragmatic and flexible approach when it comes to policy. Traditional policy solutions typically follow a binary pass/fail evaluation model that imposes rigid, one-size-fits-all targets, like mandating “fewer than 50 vulnerabilities” where failure is absolute. Such an approach overlooks nuanced situations or intermediate states, which can cause friction with developer workflows and become a main impediment to successful adoption of policies. In contrast, Docker Scout’s philosophy revolves around a simple premise: “Make things better.” This premise means the first step in every release is not to get developers to zero issues but to prevent regression. Our approach acknowledges that although projects with complex, extensive codebases have existing quality gaps, it is counterproductive to place undue pressure on developers to fix everything, everywhere, all at once. By using Docker Scout, developers can easily track what has worsened in their latest builds (from the website, the CLI and CI pipelines) and only improve the issues relevant to their policies (Figures 3 and 4). Figure 3: Outcomes driven by Docker Scout Policy. Figure 4: Pull Request diff from the Scout GitHub Action. But, finding and prioritizing the right problems is only half of the effort. For devs to truly “make things better,” the second step they must take is toward fixing these issues. According to a recent survey of 500 developers conducted by GitHub, the primary areas where development teams spend most of their time include writing code (32%) and identifying and addressing security vulnerabilities (31%). This is far from ideal, as it means that developers are spending less time driving innovation and user value. With Docker Scout, we aim to address this challenge head-on by providing developers access to automated, in-context remediation guidance (Figure 5). By actively suggesting upgrade and remediation paths, Docker Scout helps to bring teams’ container images back in line with policies, reducing their mean time to repair (MTTR) and freeing up more of their time to create value. Figure 5: Example scenario for the ‘Base images not up to date’ policy. While Docker Scout initially helps teams prioritize the direction of improvement, once all the existing critical software issues have been effectively addressed, developers can transition to employing the policies to achieve full compliance. This process ensures that going forward, all container images are void of the specific issues deemed vital to their organization’s code quality, compliance, and security goals. The Docker Scout team is excited to help our customers build software that meets the highest standards of safety, efficiency, and quality in a rapidly evolving ecosystem within the software supply chain. To get started with Docker Scout, visit our product page today. Learn more VIsit the Docker Scout product page. Looking to get up and running? Use our Quickstart guide. Vote on what’s next! Check out the Docker Scout public roadmap. Have questions? The Docker community is here to help. New to Docker? Get started. View the full article

Compliance and Security go together in the environment of an organization. Compliance standards and services offer customer satisfaction and build trust in the organization. Compliance also has a vital role in application scalability and organization flexibility. This article will explain some of the compliance standards and certifications that AWS supports and the cloud services that work to keep a check on compliance standards. Let us discuss the compliance standards and certifications first and then we will head to the services. What are the Compliance Standards and Certifications? Some of the compliance standards and certifications that are implemented and held by AWS are: HIPAA ISO C5 CSA CyberGRX TPN Let us explain these standards and certifications in compliance with AWS: HIPAA The Health Insurance Portability and Accountability Act is a federal act of 1996 by the US to ensure that organizations do not leak sensitive information about patients. AWS complies with this act. ISO ISO (International Organization for Standardization) is a world-renowned organization that awards certifications to organizations worldwide based on the standards they meet. AWS has a suitable number of certifications from ISO for risk management and cloud security etc. C5 C5 (Cloud Computing Compliance Control Catalog) is a German attestation scheme that the AWS user can use to understand security controls in compliance with the organization. CSA CSA (Cloud Security Alliance) provides certifications for security assurance and best practices of use. AWS holds up to level 3 certifications. CyberGRX This organization carries out a third-party risk assessment and is validated by Deloitte and KPMG as well. Users of AWS can generate their own CyberGRX report. TPN TPN (Trusted Partner Network) has a few benchmarks for the protection and privacy of protected media content. AWS meets these benchmarks to increase media content security. Let us head to some of the cloud services used for compliance purposes: What are the Compliance Services in AWS? AWS meets a lot of compliance standards and security protocols. To ensure security and compliance with policies, there are a few services provided by AWS regarding this. Two main services in this scenario are: AWS Artifact AWS Audit Manager Let us discuss them one by one: AWS Artifact AWS Artifact service serves the purpose of a library that holds information related to compliance standards and practices. It provides an on-demand service for users based on their needs. All the compliance and security-related certifications and standards that AWS holds are accessible by this service. It works by providing the customer with the required information. It can be used to download the reports and results. Refer to the below figure to grasp the understanding of its working: Let us discuss the AWS Audit Manager now: AWS Audit Manager This cloud service continuously keeps a check on your usage for a simpler assessment of risk and compliance issues. It gathers information on the root causes of non-compliance and generates reports for auditing. It works by choosing a pre-built framework and then defining rules. Then it continuously monitors services used to find out the root cause for compliance issues and then generates the audit report. The basic system architecture can be seen below: That is all from this article. Conclusion Security and compliance standards and certification are necessary to keep an organization working and hence ensure customer satisfaction. Amazon not only follows the standardized rules and regulations defined by regulating authorities but also provides services to help users be aware of these rules. This article has explained the compliance services in AWS. View the full article

Amazon Kendra is now authorized as FedRAMP High in AWS GovCloud (US-West) Region. Amazon Kendra is a highly accurate intelligent search service powered by machine learning. Kendra reimagines enterprise search for your websites and applications so your employees and customers can easily find the content they are looking for, even when it’s scattered across multiple locations and content repositories within your organization. View the full article

Styra, Inc. today launched an authorization service based on the Open Policy Agent (OPA) software that can be invoked via an application programming interface (API). Torin Sandall, vice president of open source for Styra, said the Styra Run cloud service will make it much simpler to embed enterprise-grade authorization capabilities within applications. Today, developers spend […] The post Styra Unfurls Cloud Service for Implementing Compliance-as-Code appeared first on DevOps.com. View the full article

Amazon Managed Streaming for Apache Kafka (Amazon MSK) is now authorized as FedRAMP Moderate in US East (Ohio), US East (N. Virginia), US West (N. California), US West (Oregon) and as FedRAMP High in AWS GovCloud (US) Regions. View the full article

AWS Resource Access Manager (AWS RAM) can now be used for workloads subject to Service Organization Control (SOC) compliance and International Organization for Standardization (ISO) ISO 9001, ISO 27001, ISO 27017, ISO 27018 and ISO 27701 standards. Now, customers in finance, healthcare, and other regulated sectors can get insights into the security processes and controls that protect customer data which can be found in the SOC reports, AWS ISO and CSA STAR certificates in AWS Artifact. AWS' alignment with these standards in addition to the independent third-party assessment of these internationally recognized code of practices demonstrates AWS' commitment to the privacy and protection of customers' content. View the full article

Infrastructure as Code (IaC) is an important part of Cloud Applications. Developers rely on various Static Application Security Testing (SAST) tools to identify security/compliance issues and mitigate these issues early on, before releasing their applications to production. Additionally, SAST tools often provide reporting mechanisms that can help developers verify compliance during security reviews. cdk-nag integrates directly into AWS Cloud Development Kit (AWS CDK) applications to provide identification and reporting mechanisms similar to SAST tooling. This post demonstrates how to integrate cdk-nag into an AWS CDK application to provide continual feedback and help align your applications with best practices... View the full article

GitLab launched its next major iteration, GitLab 15, starting with its first release version, 15.0, which the company said pulls together new DevOps and data science capabilities into the platform. With GitLab 15, GitLab says it provides (or soon will provide) continuous security and compliance, enterprise Agile planning, visibility and observability, workflow automation and increased […] The post GitLab Gets an Overhaul appeared first on DevOps.com. View the full article

Progress this week extended its DevSecOps portfolio—built atop the Chef automation framework it acquired in 2020—to now include the ability to programmatically address compliance mandates. At the same time, Progress has updated the Progress Chef InSpec framework for automating the discovery of compliance issues to add support for SAP ASE, IBM DB2, Mongo, Cassandra, Oracle, […] The post Progress Expands Scope of Compliance-as-Code Capabilities appeared first on DevOps.com. View the full article

AWS Backup Audit Manager now allows you to audit and report on the compliance of your data protection policies for hybrid VMware workloads. With this launch, you can include the VMware Virtual Machines in AWS Backup Audit Manager’s controls to maintain the compliance status of your organizational data protection policies and to generate unified auditor-ready reports for your VMware workloads across VMware Cloud on AWS, on premises, and on AWS Outposts. View the full article