hi everyone I'm eileena armstrong
president of the cloud security alliance
and it is
my pleasure to welcome you to our season summit
at the rsa conference
many of you may know that each year we hold
an event at rsa
and typically we really dedicated to all things
cloud security cloud security
this year we're doing that
but we're concentrating
on the c suite particularly the c so
and there are a couple of reasons
we've decided to dedicate our time at rsa too
so summit and helping you to
learn about strategies that you could apply
in your own enterprises
and so to kick this event off
I wanted to share with you
some of the reasons why
we're doing that this year
so obviously
when it comes to our current situation right now
cloud is most assuredly the top priority
and before we get into
all of the reasons why that is
and many of which I'm sure you're quite aware
we're going to
talk a little bit I'd like to talk a little bit about
the cloud security alliance and how
what we've been doing over the last
12 years just to reappoint you to
with some of our products
and then talk about some
initiatives that were undertaking
right now so
obviously we've been around
for many many years
we we started our organization 12 years ago
and we've been dedicated to helping
organizations
different types of entities
of all sizes
securing helping them to secure their cloud
obviously given the
breadth of our product offerings
we really have been able to position ourselves
as a non profit
in this way of being unquestioned
and certainly vendor neutral
in addition to having this war chest
of intellectual property
which I kind of point out here
we're known for other things as well
so obviously many of you are part of our membership
we offer corporate memberships whereby we really help
and support our member organizations with developing
and sort of progressing their cloud strategies
ensuring that they're keeping in
mind things like
governance privacy security compliance issues
we also offer
a bevy of events just like this one
for the last year of course just
as many of you have been doing we're doing
a lot of our events moline
so we have our series of cloud whites events
and then we have some live events
we are looking to hold our
live September event this fall
and I'll talk more about that
as we move forward
but in the meantime
I shouldn't forget our chapters
so in addition to corporate membership
we have individuals who participate in very
since sundry chapters
north america
amia apac all the regions in which we play
some role we have
you know team members placed in these
various regions
so
we want to make sure that we're covering those as well
so there are a few ways that
you and your organizations can work with us
in addition to
the different types of membership and the events
our research team is absolutely indefatigable in
releasing
countless research assets throughout the year
so they look at
all of the challenges
that we're all facing today when it comes to the cloud
but then they
also make sure that they're staying ahead of the curve
and looking at any kind of technological
developments that could impact you and
your cloud ecosystems
of course training and certificates
our training and certificate program is huge
we launched with our
certificate of cloud security knowledge
back in the day
and that's going gain busters of course
because there is this need for
professionals to have
a very strong dedicated cloud security knowledge
but recently in partnership with osaka
we also launched our
certificate of cloud audit knowledge
just to make sure that we're
you know capturing that whole cycle of
securing and protecting cloud environments
and of course the data all of that ip
that one can find in those
different infrastructures or ecosystems
and of course then we have our cloud controls matrix
we just released this year version 4
and that really shows all of these
security controls and requirements
you need to pay attention to
when it comes to your
migrating workloads to the cloud and working with your
cloud vendors
our consensus assessment initiative questionnaire
or cake is undergoing
update as well
so if you're interested in learning more about that
you can go to our website
but basically that really helps cloud consumers
as well as auditors
ask questions of their providers
to ensure that they are in compliance with the
cloud controls matrix they're really dedicating
themselves to
ensuring that they're
mindful of all of the security requirements
when it comes to cloud environments and migrating those
critical workloads to the cloud
our star registry
which is our security trust assurance and risk registry
really helps companies find providers
who are taking security seriously
they are
at the right level of
security and data privacy
for your organization
so you can always check that star registry out to see
what organizations have placed
have met certain requirements to be listed
but in association with that
we've also recently launched our
trusted cloud provider trust mark
and that really is a
recognition I should say it's really a recognition of
how cloud providers
are really demonstrating their commitment to
having and
maintaining a holistic
security program
when it comes to their offerings
and so in our star registry
you'll see that trust mark that recognition
by those organizations that have met that and with
our launch of our
trusted cloud provider trust mark
we also announced our first cohort
of cloud providers who have met the requirements to
hold that that trust mark so definitely check that out
obviously we do a heck of a lot more
and we've just
cloud security and cloud
we've released just tons of emp
and worked with any number of entities
missed other government organizations
in europe and apac to
really just protect this overarching
infrastructure on which we're all now relying
and we've done that in a way
where we've released a lot of technical
and operational information
and guidance but now we want to ensure that we're also
tackling that strategic level
to really arm the sea suite particularly seesaws
with information that can help them
kind of oversee
and evolve their cloud security programs
and maintain their cloud ecosystems
so
one of the reasons of course that we're looking to
have this initiative is
because cloud has become the primary business model
for most organizations
and I'm sure that's a point on which we all can agree
and as a result of that
cloud has become
the
priority the top priority for most organizations now
and one could definitely surmise
that not only is it the top priority now
but it's probably going to be right up there
on the list that to do list
for a mighty long time to come
so it only makes sense that
given our history and given where
the
the businesses are
and really relying on
all of these different types of cloud providers
and migrating so many of their workloads to
the cloud that csa
connects pesos
and other sea level executives
more tightly with one another
but also that we're connecting the sea suite
to
other organizations
and the wider industry so we want to be
we want to be sure that we're
enabling the sea suite to
very closely partner with their providers
ensuring that the solutions on which they're relying
are really headed
in the right direction and meeting their needs
and we want to make sure too that
the sea suite is
working closely with any of those bodies that
implement standards
or requirements or even legislation
that could impact how their
working and
how they're relying
on the cloud so
we're looking to launch what I have here
sea sweet initiative and we're calling it our csa 6
trust and it's going to be based on three pillars
where we will establish a very strong robust
trusted community of
sea level executives
again primarily focusing on season
but engaging with all of the other
stakeholders in an organization
that has a vested interest in ensuring that their
cloud journeys that digital transformation
that all these organizations are undertaking
is on point and solidly managed
from there we
obviously will make sure that this
trusted community of professionals and leaders
in the industry
really establishes a strong collective voice
and we want that voice to be extremely influential
influential on one another
and in their respective organizations influential
with the
provider the vendor community making sure that
the providers are really
meeting the needs of the sea suite
and the organizations they serve
and then of course
like I said the wider industry
we already have been working with
any number of government agencies
nest etc but
if as cloud has evolved
no doubt there could be future legislation
so we want to make sure
that our seasons
and us we have that voice that influential voice
to ensure whatever
is getting discussed and possibly passed is really
solid and helpful
rather than causing any kind of impediments or
challenges additional challenges
for seasons and their sea level partners
it's not like you guys don't have enough
challenges as it is
so one of the
things I wanted to do very quickly is kind of
take a look back
and see where we were last year so co hit
and even if some organizations were sort of on their
digital transformation journeys
certainly last year helped to
usher the embrace of cloud even more intensely
and what we can see from this particular survey
is that at the time
it was June you know we were all dealing with covet
about 20 head six or more cloud providers
a little over half or very much concerned about
data confidentiality and privacy in public cloud
they were adopting sass based delivering models
in the meantime
they were dealing with
teams
that lacked the cloud security knowledge they needed
but now we jump ahead here
and so in partnership with algol
csa released a survey where we wanted to kind of assess
the landscape and where organizations were now
that we all had to kind of
you know there are many organizations scrambling
just pushing forward
quite aggressively their digital transformations
we had about 2 000 people or so
it and it security leaders respond to this survey
so more than 50 are running 41
% or more of their workloads in a public cloud
and that's up from 25
63 expect to run 41
or more of their workloads in a public cloud this year
another 62 have a multi cloud strategy and
27 % are using three
or more public cloud platforms
and then as far as the
major cloud infrastructure providers
the market shares pretty evenly split
aws is the front runner 67
and then you have the likes of azure and other
coming in
right behind
the reasons that these organizations the respondents
move to the cloud
are all the usual suspects but reduce clouds
increased agility elasticity improved up time
and certainly the cloud has now been quite
tried and true for organizations when it comes to
their develops ops
initiatives and on average respondents were meeting or
found that their providers were meeting or exceeding
these expectations
as far as the cloud can
security concerns for many other responses again
I'm sure there are no surprises here
some of the seesaws with whom we've been speaking
as we looked to
build a roadmap for our co trust program
certainly found that compliance was a pretty
high priority for them
but
according to this survey network security remain quite
quite
major a worry and then again we saw this
idea that teams
just lack that cloud security knowledge
that specific cloud security knowledge
that organizations are requiring and not only that
but as you can see
many felt that they did not have enough
staff to actually address all of the cloud
security concerns
and then of course
the
migration of workloads to the cloud was a challenge
the integration
of these cloud ecosystems with the existing it
infrastructure
kind of an issue
and you know some of the other
smaller
worries were things like cost and legal concerns
and lack of visibility
the teams managing
the security and the public cloud no surprise here
obviously there are those large organizations that
had the luxury of a cloud team so we saw 18
there but for most
they turned to their
security teams or their it teams to help
you know to sort of
lead the charge and managing security
and there were a small number of respondents that
depended on manage security service providers
network teams etc
so
framing all of that
seeing how
co kind of ushered
this
embrace of cloud even more for some organizations
although there are quite a bevy
of companies that sense like 2012 were really
pretty aggressive
and migrating their workloads to the cloud
it is obvious that cloud is the future
and it is the business model that many organizations
are relying on when it comes to
you know
just impairing their organizations with that computing
power they need
so the csa's co trust really will be all about
seeking a common
understanding and knowledge of cloud computing
as well as
help to evolve all of the solutions standards
any kind of legislation
that might come up
to help meet the security challenges
that are confronting all
of the sea level stakeholders from the see
so all the way up to the ceo and of course
their
their boards
right now
we are definitely in the midst of beginning the build
so you can consider this announcement
kind of a soft launch
but we will be taking a phased approach
and as I noted earlier
we're definitely looking to have that strong community
we'll be releasing tons of research guidance use cases
you name it we'll see
you know when we can go live again
we look to have some hands on training
some really inventive
and useful discussion groups roundabouts etc
we'll look to our current offerings
and see what we can add on there
and then of course when it comes to
where we are and helping train
and
enable professionals to sit for these certificates
cloud security and cloud audit knowledge
we're very well positioned to
offer even stronger
products and solutions to support organizations support
ciaos
when they're looking to really build out their team
so you can definitely expect us
to help with mentoring hiring etc
that's going to be key
and of course
there will be other benefits for our chapters
and our members
and certainly
we expect that our current numbers and most assuredly
our chapters who are like on the ground
every day and some of them
hold quite frequent events
will really support and help us to roll out
and enhance our road of
offerings with our co trust as we move forward
so for this particular
presentation I wanted to
talk to you very quickly we are
having a call for participation
and our co trust advisory council
and that's really going to be
the overarching body that will support
my team and my efforts and
launching different useful offerings
and you know a support system
that will really help our members and other
members of that trusted community
enhance and
constantly update and manage their cloud strategies
so if you're interested in that you can go to our
website and you'll see information about how to
voice your
your desire to work with us there
we're also going to establish a research working group
we've already created a draft charter for that
we'll look to
seek out the participation formally after rsa
however if you aren't interested you want to know more
again definitely go to our site
but by all means don't hesitate to contact me directly
very shortly you'll see us
release a pretty robust editorial calendar
we've been working with our research team
as well as our
chief trust officer in residents
pete kronos who is a former season
build out a very strong calendar
and I'll give you just a taste
in a moment of some of the topics but it's
you know we already have a huge one
the rooms that were ready to release shortly
well definitely
you'll see some
content offerings throughout the rest of this year
as well as some moline and live events and
speaking of live events
we will be having our September events in value
Washington in September
so if you can attend
and if your companies are allowing you to travel
we definitely encourage you to
take us up and hang out with us there will be having
dedicated cso co trust
happenings and you'll be hearing more about those
shortly if you can please do a 10 map
it's likely going to be a hybrid affair
so there will be
some online
offerings associated with our September of n as well
here is just a smattering of topics
from our editorial calendar
for our co that is underpinning our co trust
initiative but again
we've got so many topics now
taking a look at the rest of the year
we need to decide how we're going to narrow that down
and so you'll see
that formal list that will be subject to change
as we bring on our advisory council members
shortly from us
so do hit up our website if you'd like to learn more
about our new co trust
we're very excited about it and we believe
it's just going to be awesome
I mean the intent here is that
csa is going to do
for ce and other sea level executives
who are really spearheading and
embarking whether they're spearheading now
currently in the midst of it
or embarking on the cloud journeys
or digital transformations
what we did for cloud security back in the day
what we've been doing for cloud security these last
12 years so we're very much excited
we definitely want to hear from you
if you have any questions
if you'd like to talk the initiative down
our co trust or any of our other offerings down
don't hesitate
to reach out to me
I love setting up time to talk to members and
industry industry folks we've had some really amazing
and supportive conversations with
many of our ceca friends over the last three months
as we've been building out
more and more this program so
anytime you'd like to talk to me don't hesitate
but in the meantime
this peso summit
we have a lineup of amazing
experts who are ready to just share with you
some
their knowledge their experiences and most definitely
you know some advice
and some of the things that they've been doing to
enhance their cloud
strategies their cloud security strategies
so don't leave
please stay tuned for more from this
wonderful lineup of experts and in the meantime
thanks to all of our sponsors who have helped us to
again
have this wonderful event at rsa conference
and of course thank you
everyone for attending this is wonderful we really
appreciate all of your support
and we look forward to working with you more
on our existing offerings but also
with on our co trust so thank you everyone take care