The Cloud Security Alliance (CSA) is the world&rsquo;s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, certification, events and products. CSA&rsquo;s activities, knowledge and extensive network benefit the entire community impacted by cloud &mdash; from providers and customers, to governments, entrepreneurs and the assurance industry &mdash; and provide a forum through which diverse parties can work together to create and maintain a trusted cloud ecosystem.

Cloud Security Alliance

Adobe is changing the world through digital experiences. Great experiences have the power to inspire, transform, and move the world forward. And every great experience starts with creativity. Creativity is in our DNA. Our game-changing innovations are redefining the possibilities of digital experiences. We connect content and data and introduce new technologies that democratize creativity, shape the next generation of storytelling, and inspire entirely new categories of business.&nbsp;
At Adobe, we're committed to protecting the security, privacy, and availability of our products, systems, and data &mdash; so you can deliver trusted experiences every day.&nbsp;

Adobe

Prisma&reg; Cloud is the industry&rsquo;s most comprehensive cloud-native application protection platform (CNAPP) with the broadest security and compliance coverage&mdash;for applications, data, and the entire cloud-native technology stack&mdash;throughout the development lifecycle and across hybrid and multi-cloud environments. Our integrated approach enables security operations and DevOps teams to stay agile, collaborate effectively, and accelerate secure cloud-native application development.

Prisma Cloud

Kick off this segment of the summit as we introduce managing third-party risk in the cloud

Troy Leach

Welcome and Introduction to Managing 3rd Party Risk in the Cloud 

Third party risk is all around us, yet frequently pushed off to the side in favor of discussing more "in your face" risk topics. However, third party risk is only getting more real each day as organizations rely more heavily on various IaaS, PaaS, CaaS, SaaS, or your favorite aaS-of-choice. Join Verizon's Chris Novak - Managing Director of Cyber Security Consulting - as he discusses the breadth and depth of these concerns and illuminates real-world examples from his team's work in the trenches investigating some of the uglier data breaches that resulted.&nbsp;

Chris Novak

It's Time to Have the Talk... About Third Party Risk

In order to scale your business using new and innovative technologies, harnessing cloud infrastructure is pretty much inevitable. As your organization finds themselves moving to the cloud faster than ever, maintaining security and compliance at the speed of development is often overlooked in the process.
Securing applications, the underlying infrastructure and the data, all while meeting compliance and governance requirements, in the cloud is a major undertaking. This requires organizational-wide collaboration, updated policies and processes, and the implementation of new, cloud-focused security solutions.
Join us in this session as we discuss: - Key challenges faced on your cloud journey, and how to overcome them - The importance of posture, risk, and vulnerability management in the cloud - Embracing the use of micro-services to achieve security objectives - How to enable partnership between development and security teams in order to secure applications

Bob West

Andy Barrett

Navigating Cloud Security: How Financial Services Companies Can Protect Their Data

Whether they are Cloud Service Provider partners or internal staff, how do you empower the professionals responsible for protecting your cloud services to make better-informed decisions? What is your strategy for keeping your teams and operations current with zero-day threats?&nbsp;
Moderated by CSA Board member and BlackRock CISO, Stephen Scharf, senior leaders from Bank of America (Alex Hutton, CISO), Robinhood (Caleb Sima, CSO), and National Australian Bank (CSO Sandro Bucchicheri) will discuss approaches to supporting the knowledge of cloud professionals to remain current with advancements in technology and strategy to managing to emerging risks.

Stephen Scharf

Caleb Sima

Sandro Bucchianeri

Panel Discussion: People, Cloud, and the Learning Curve

Financial institutions face many major challenges across all IT services as their cloud journey progresses. Cyber security governance, risk management, compliance, third-party vendor management, and assurance and accountability are just a few that scratch the surface. An essential component to solving these challenges is a standardized and mature security control framework.
CSA&rsquo;s Cloud Control Matrix (CCM) has been adopted by several financial institutions and is recognized and appreciated by regulators. In 2022, CSA established a partnership with the Cyber Risk Institute (CRI), that lead to the creation of the &ldquo;Cloud Profile,&rdquo; an extension of the CCM and of the CRI Profile. The goal of this collaboration is to support financial institutions in navigating the complexity of cloud security compliance and assurance. CSA is also working alongside organizations such as the European Cloud User Council, the European and UK Cloud Pooled Audits groups, and IBM Financial Services, to further extend the CCM, the Financial Service Addendum, and ultimately improve its relevance for Financial Institutions and their Regulators.&nbsp;
This session will provide an overview of:
The Cloud Control Matrix The Cloud Profile: what it is, key stakeholders involved, goal and objectives The CCM Financial Service Addendum

Emily Beam

Daniele Catteddu

The CRI-CSA Cloud Profile Has Arrived!

Third-party cloud service providers are a critical component of the payments landscape. They are required to protect the confidentiality and integrity of the information and clearly demonstrate adherence to regulatory expectations to their customers. This panel discussion will explore how the PCI security standards help organizations and cloud service providers mitigate risks and secure payments in the cloud.

kandyce young

Emma Sutcliffe

Panel Discussion: Protecting Payment Data in the Cloud

Wrap up this portion of the summit with thoughts from CSA's STAR Program Director, John DiMaria, who will provide a recap of the day's discussions on managing third-party risk in the cloud

John DiMaria

Mid-day Recap

Kick off this segment of the summit with John Yeoh, EVP of Research for the CSA, as he introduces the needs of Cloud Service Providers

John Yeoh

Welcome and Introduction of The Needs of the Cloud Service Provider

As financial services institutions strive to meet the need for instant gratification demanded by today&rsquo;s digital-first customers, they also need to stay ahead of everchanging regulations and growing cyberthreats. Howard will share his perspective on how banks can find this balance as they modernize, while reducing 3rd and 4th party risk. This session will highlight the need for banks to innovate at the pace of change, with security and compliance at the forefront.

Jim Reavis

Howard Boville

Navigating the Financial Services Digital Paradox

Operational resiliency continue to be a key area of focus for organizations, especially in the financial services sector, accentuated by recently published operational resiliency and outsourcing regulations. Given firms are cohabiting on the same CSPs, financial sector impacts can be multiplied if there is a disruption or incident. This session will focus on how financial institutions and CSPs can look to partner together to advance operational resiliency through cloud adoption.&nbsp;

Alicja Cade

Resilient Together: CSPs and FSIs Partnering to Strengthen the Financial Sector

The use of scalable cloud services saves FSI organizations billions of dollars each year. However, questions remain. How do organizations know they are getting the most from their cloud services? How do customers implement and operate their instances securely? How will you engage with your CSP if a security incident occurs?
Join Aly Farooqui, Chief Risk Officer of IBM Cloud for Financial Services, David Stone, Officer of the Cloud CISO from Google, and Soo Stahl, M365 Principal Program Manager from Microsoft, for this critical discussion.
This session will be moderated by Erik Johnson, Senior Cloud Security Research Analyst at CSA, while presenters discuss how financial service organizations can work most effectively with their cloud providers.

Aly Farooqui

Erik Johnson

David Stone

Soo Stahl

Leverage Cloud Service Providers Effectively to Scale Cloud Usage Securely

The cloud Shared Security Responsibility Model (SSRM) is inherent to the use of cloud services. It is critical for cloud service customers (CSCs) to be competent and up to date on how they and their cloud service providers (CSPs) share the responsibility for securing their cloud footprint. CSA&rsquo;s Cloud Controls Matrix (CCM) and framework of underlying components help cloud organizations, CSPs and CSCs, delineate their controls ownership and implementation responsibility by conveying how a CSP is responsible for managing the security of public-cloud, while the CSC is responsible for securing what is in the cloud. In this presentation, we aim to demystify the most important cloud security construct, the SSRM, while leveraging the controls and toolsets provided by CCM v4.

Eleftherios Skoutaris

Implementing the Shared Security Responsibility Model Using CCM/CAIQ V4

In this presentation you will learn what embedded payments is and how it relates to you. &nbsp;Embedded payments increase your PCI scope as well as your PII responsibilities. &nbsp;You will leave this presentation understanding the difference between fraud controls, ensuring the data is correct on the way in, and data security, not letting data be stolen in the first place. &nbsp;Are you in scope for PCI or out of scope? &nbsp;There is a lot we can do to protect data. &nbsp;

Deana Rich

Ruston Miles

Ron Isaacson

Panel Discussion: Protecting the Next Generation of Payments in the Cloud

Wrap up the summit with thoughts from CSA CEO, Jim Reavis, as he provides his thoughts on the needs of cloud service providers and brings the event to a close

Agenda

Speakers.css-1f6omqm{margin:0;font-size:1.4rem;font-weight:500;line-height:1.5;color:#5d5d5d;font-family:'Poppins',sans-serif;margin-left:0.8rem;}46 Speakers

John DiMaria

Thomas Pfeiffer

Imre Bakó

J.R. Santos

Jim Reavis

Illena Armstrong

Daniele Catteddu

John Yeoh

Eleftherios Skoutaris

Emily Beam

David Dadoun

John Carlson

Troy Leach

Dr. Alissa Abdullah

Vinay Patel

Stacy Hughes

Craig Balding

Julie Conroy

Chris Novak

Stephen Scharf

Caleb Sima

Howard Boville

Aly Farooqui

David Cross

Sandro Bucchianeri

Todd Aument

Erik Johnson

Michael Brown

David Stone

Emma Sutcliffe

kandyce young

Cherilyn Pascoe

Alicja Cade

Deana Rich

Ruston Miles

Bob West

Andy Barrett

Hillary Baron

Sofia Pogrebynska

Avani Desai

Rahat Sethi

Ron Isaacson

Sean Gray

Soo Stahl

Sam Phillips

Brian Peister

Booth.css-7303n9{margin:0;font-size:1.4rem;font-weight:500;line-height:1.5;color:#5d5d5d;font-family:'Poppins',sans-serif;color:#FFFFFF;margin-left:0.8rem;font-weight:400;}3 Booth

Cloud Security Alliance

Adobe

Prisma Cloud

Speakers46 Speakers

Booth3 Booth