Background: #fff
Foreground: #000
PrimaryPale: #8cf
PrimaryLight: #18f
PrimaryMid: #04b
PrimaryDark: #014
SecondaryPale: #ffc
SecondaryLight: #fe8
SecondaryMid: #db4
SecondaryDark: #841
TertiaryPale: #eee
TertiaryLight: #ccc
TertiaryMid: #999
TertiaryDark: #666
Error: #f88
<!--{{{-->
<link rel='stylesheet' href='font-awesome/css/fontawesome.min.css' />
<link rel='stylesheet' href='font-awesome/css/all.css' />
<!--}}}-->
— [[InterfaceOptions]] — [[AdvancedOptions]] —
<!--{{{-->
<div class='header' role='banner' macro='gradient vert [[ColorPalette::PrimaryDark]] [[ColorPalette::PrimaryLight]]'>
<div class='headerShadow'>
<img src="iCSF/cloud-security-alliance-fr.png" align="right">
</div>
<div class='headerForeground'>
<span class='siteTitle' refresh='content' tiddler='SiteTitle'></span>&nbsp;
<span class='siteSubtitle' refresh='content' tiddler='SiteSubtitle'></span>&nbsp;
</div>
</div>
<div id='mainMenu' role='navigation' refresh='content' tiddler='MainMenu'></div>
<div id='sidebar'>
<div id='sidebarOptions' role='navigation' refresh='content' tiddler='SideBarOptions'></div>
<div id='sidebarTabs' role='complementary' refresh='content' force='true' tiddler='SideBarTabs'></div>
</div>
<div id='displayArea' role='main'>
<div id='messageArea' class='messageArea'></div>
<div style="text-align:center"><span class='HeaderMenu' refresh='content' tiddler='HeaderMenu'></span></div>
<div id='tiddlerDisplay'></div>
<div style="text-align:center"><span class='FooterNews' refresh='content' tiddler='FooterDisclaimer'></span></div>
</div>
<!--}}}-->
/*{{{*/
body {background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]];}
a {color:[[ColorPalette::PrimaryMid]];}
a:hover {background-color:[[ColorPalette::PrimaryMid]]; color:[[ColorPalette::Background]];}
a img {border:0;}
h1,h2,h3,h4,h5,h6 {color:[[ColorPalette::SecondaryDark]]; background:transparent;}
h1 {border-bottom:2px solid [[ColorPalette::TertiaryLight]];}
h2,h3 {border-bottom:1px solid [[ColorPalette::TertiaryLight]];}
.button {color:[[ColorPalette::PrimaryDark]]; border:1px solid [[ColorPalette::Background]];}
.button:hover {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::SecondaryLight]]; border-color:[[ColorPalette::SecondaryMid]];}
.button:active {color:[[ColorPalette::Background]]; background:[[ColorPalette::SecondaryMid]]; border:1px solid [[ColorPalette::SecondaryDark]];}
.header {background:[[ColorPalette::PrimaryMid]];}
.headerShadow {color:[[ColorPalette::Foreground]];}
.headerShadow a {font-weight:normal; color:[[ColorPalette::Foreground]];}
.headerForeground {color:[[ColorPalette::Background]];}
.headerForeground a {font-weight:normal; color:[[ColorPalette::PrimaryPale]];}
.tabSelected {color:[[ColorPalette::PrimaryDark]];
 background:[[ColorPalette::TertiaryPale]];
 border-left:1px solid [[ColorPalette::TertiaryLight]];
 border-top:1px solid [[ColorPalette::TertiaryLight]];
 border-right:1px solid [[ColorPalette::TertiaryLight]];
}
.tabUnselected {color:[[ColorPalette::Background]]; background:[[ColorPalette::TertiaryMid]];}
.tabContents {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::TertiaryPale]]; border:1px solid [[ColorPalette::TertiaryLight]];}
.tabContents .button {border:0;}
#sidebar { display: none; }
/* #sidebar {} */
#sidebarOptions input {border:1px solid [[ColorPalette::PrimaryMid]];}
#sidebarOptions .sliderPanel {background:[[ColorPalette::PrimaryPale]];}
#sidebarOptions .sliderPanel a {border:none;color:[[ColorPalette::PrimaryMid]];}
#sidebarOptions .sliderPanel a:hover {color:[[ColorPalette::Background]]; background:[[ColorPalette::PrimaryMid]];}
#sidebarOptions .sliderPanel a:active {color:[[ColorPalette::PrimaryMid]]; background:[[ColorPalette::Background]];}
.wizard { background:[[ColorPalette::PrimaryPale]]; }
.wizard__title { color:[[ColorPalette::PrimaryDark]]; border:none; }
.wizard__subtitle { color:[[ColorPalette::Foreground]]; border:none; }
.wizardStep { background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]]; }
.wizardStep.wizardStepDone {background:[[ColorPalette::TertiaryLight]];}
.wizardFooter {background:[[ColorPalette::PrimaryPale]];}
.wizardFooter .status {background:[[ColorPalette::PrimaryDark]]; color:[[ColorPalette::Background]];}
.wizard .button {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::SecondaryLight]]; border: 1px solid;
 border-color:[[ColorPalette::SecondaryPale]] [[ColorPalette::SecondaryDark]] [[ColorPalette::SecondaryDark]] [[ColorPalette::SecondaryPale]];}
.wizard .button:hover {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::Background]];}
.wizard .button:active {color:[[ColorPalette::Background]]; background:[[ColorPalette::Foreground]]; border: 1px solid;
 border-color:[[ColorPalette::PrimaryDark]] [[ColorPalette::PrimaryPale]] [[ColorPalette::PrimaryPale]] [[ColorPalette::PrimaryDark]];}
.wizard .notChanged {background:transparent;}
.wizard .changedLocally {background:#80ff80;}
.wizard .changedServer {background:#8080ff;}
.wizard .changedBoth {background:#ff8080;}
.wizard .notFound {background:#ffff80;}
.wizard .putToServer {background:#ff80ff;}
.wizard .gotFromServer {background:#80ffff;}
.messageArea { border:2px solid [[ColorPalette::Background]]; background:[[ColorPalette::PrimaryMid]]; color:[[ColorPalette::Background]]; }
.messageToolbar__button { color:[[ColorPalette::PrimaryMid]]; background:[[ColorPalette::SecondaryPale]]; border:none; }
.messageToolbar__button_withIcon { background:inherit; }
.messageToolbar__button_withIcon:active { background:inherit; border:none; }
.messageToolbar__icon { fill:[[ColorPalette::TertiaryDark]]; }
.messageToolbar__icon:hover { fill:[[ColorPalette::Foreground]]; }
.popupTiddler {background:[[ColorPalette::TertiaryPale]]; border:2px solid [[ColorPalette::TertiaryMid]];}
.popup {background:[[ColorPalette::TertiaryPale]]; color:[[ColorPalette::TertiaryDark]]; border-left:1px solid [[ColorPalette::TertiaryMid]]; border-top:1px solid [[ColorPalette::TertiaryMid]]; border-right:2px solid [[ColorPalette::TertiaryDark]]; border-bottom:2px solid [[ColorPalette::TertiaryDark]]; }
.popup hr {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::PrimaryDark]]; border-bottom:1px;}
.popup li.disabled {color:[[ColorPalette::TertiaryMid]];}
.popup li a, .popup li a:visited {color:[[ColorPalette::Foreground]]; border: none;}
.popup li a:hover {background:[[ColorPalette::SecondaryLight]]; color:[[ColorPalette::Foreground]]; border: none;}
.popup li a:active {background:[[ColorPalette::SecondaryPale]]; color:[[ColorPalette::Foreground]]; border: none;}
.popupHighlight {background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]];}
.listBreak div {border-bottom:1px solid [[ColorPalette::TertiaryDark]];}
.tiddler .defaultCommand {font-weight:bold;}
.shadow .title {color:[[ColorPalette::TertiaryDark]];}
.title {color:[[ColorPalette::SecondaryDark]];}
.subtitle {color:[[ColorPalette::TertiaryDark]];}
.toolbar {color:[[ColorPalette::PrimaryMid]];}
.toolbar a {color:[[ColorPalette::TertiaryLight]];}
.selected .toolbar a {color:[[ColorPalette::TertiaryMid]];}
.selected .toolbar a:hover {color:[[ColorPalette::Foreground]];}
.tagging, .tagged {border:1px solid [[ColorPalette::TertiaryPale]]; background-color:[[ColorPalette::TertiaryPale]];}
.selected .tagging, .selected .tagged {background-color:[[ColorPalette::TertiaryLight]]; border:1px solid [[ColorPalette::TertiaryMid]];}
.tagging .listTitle, .tagged .listTitle {color:[[ColorPalette::PrimaryDark]];}
.tagging .button, .tagged .button {border:none;}
.footer {color:[[ColorPalette::TertiaryLight]];}
.selected .footer {color:[[ColorPalette::TertiaryMid]];}
.error, .errorButton {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::Error]];}
.warning {color:[[ColorPalette::Foreground]]; background:[[ColorPalette::SecondaryPale]];}
.lowlight {background:[[ColorPalette::TertiaryLight]];}
.zoomer {background:none; color:[[ColorPalette::TertiaryMid]]; border:3px solid [[ColorPalette::TertiaryMid]];}
.imageLink, #displayArea .imageLink {background:transparent;}
.annotation {background:[[ColorPalette::SecondaryLight]]; color:[[ColorPalette::Foreground]]; border:2px solid [[ColorPalette::SecondaryMid]];}
.viewer .listTitle {list-style-type:none; margin-left:-2em;}
.viewer .button {border:1px solid [[ColorPalette::SecondaryMid]];}
.viewer blockquote {border-left:3px solid [[ColorPalette::TertiaryDark]];}
.viewer table, table.twtable {border:2px solid [[ColorPalette::TertiaryDark]];}
.viewer th, .viewer thead td, .twtable th, .twtable thead td {background:[[ColorPalette::SecondaryMid]]; border:1px solid [[ColorPalette::TertiaryDark]]; color:[[ColorPalette::Background]];}
.viewer td, .viewer tr, .twtable td, .twtable tr {border:1px solid [[ColorPalette::TertiaryDark]];}
.viewer pre {border:1px solid [[ColorPalette::SecondaryLight]]; background:[[ColorPalette::SecondaryPale]];}
.viewer code {color:[[ColorPalette::SecondaryDark]];}
.viewer hr {border:0; border-top:dashed 1px [[ColorPalette::TertiaryDark]]; color:[[ColorPalette::TertiaryDark]];}
.highlight, .marked {background:[[ColorPalette::SecondaryLight]];}
.editor input {border:1px solid [[ColorPalette::PrimaryMid]];}
.editor textarea {border:1px solid [[ColorPalette::PrimaryMid]]; width:100%;}
.editorFooter {color:[[ColorPalette::TertiaryMid]];}
.readOnly {background:[[ColorPalette::TertiaryPale]];}
#backstageArea {background:[[ColorPalette::Foreground]]; color:[[ColorPalette::TertiaryMid]];}
#backstageArea a {background:[[ColorPalette::Foreground]]; color:[[ColorPalette::Background]]; border:none;}
#backstageArea a:hover {background:[[ColorPalette::SecondaryLight]]; color:[[ColorPalette::Foreground]]; }
#backstageArea a.backstageSelTab {background:[[ColorPalette::Background]]; color:[[ColorPalette::Foreground]];}
#backstageButton a {background:none; color:[[ColorPalette::Background]]; border:none;}
#backstageButton a:hover {background:[[ColorPalette::Foreground]]; color:[[ColorPalette::Background]]; border:none;}
#backstagePanel {background:[[ColorPalette::Background]]; border-color: [[ColorPalette::Background]] [[ColorPalette::TertiaryDark]] [[ColorPalette::TertiaryDark]] [[ColorPalette::TertiaryDark]];}
.backstagePanelFooter .button {border:none; color:[[ColorPalette::Background]];}
.backstagePanelFooter .button:hover {color:[[ColorPalette::Foreground]];}
#backstageCloak {background:[[ColorPalette::Foreground]]; opacity:0.6; filter:alpha(opacity=60);}
/*}}}*/
/*{{{*/
* html .tiddler {height:1%;}
/* font-size:.75em; */
body {font-size:1em; font-family:arial,helveticahelvetica; margin:0; padding:0;}
h1,h2,h3,h4,h5,h6 {font-weight:bold; text-decoration:none;}
h1,h2,h3 {padding-bottom:1px; margin-top:1.2em;margin-bottom:0.3em;}
h4,h5,h6 {margin-top:1em;}
h1 {font-size:1.35em;}
h2 {font-size:1.25em;}
h3 {font-size:1.1em;}
h4 {font-size:1em;}
h5 {font-size:1em;}
hr {height:1px;}
a {text-decoration:none;}
dt {font-weight:bold;}
ol {list-style-type:decimal;}
ol ol {list-style-type:lower-alpha;}
ol ol ol {list-style-type:lower-roman;}
ol ol ol ol {list-style-type:decimal;}
ol ol ol ol ol {list-style-type:lower-alpha;}
ol ol ol ol ol ol {list-style-type:lower-roman;}
ol ol ol ol ol ol ol {list-style-type:decimal;}
.txtOptionInput {width:10em;}
#contentWrapper .chkOptionInput {border:0;}
.externalLink {text-decoration:underline;}
.indent {margin-left:3em;}
.outdent {margin-left:3em; text-indent:-3em;}
code.escaped {white-space:nowrap;}
.tiddlyLinkExisting {font-weight:bold;}
.tiddlyLinkNonExisting {font-style:italic;}
/* the 'a' is required for IE, otherwise it renders the whole tiddler in bold */
a.tiddlyLinkNonExisting.shadow {font-weight:bold;}
#mainMenu .tiddlyLinkExisting,
#mainMenu .tiddlyLinkNonExisting,
#sidebarTabs .tiddlyLinkNonExisting {font-weight:normal; font-style:normal;}
#sidebarTabs .tiddlyLinkExisting {font-weight:bold; font-style:normal;}
.header {position:relative;}
.header a:hover {background:transparent;}
.headerShadow {position:relative; padding:4.5em 0 1em 1em; left:-1px; top:-1px;}
.headerForeground {position:absolute; padding:4.5em 0 1em 1em; left:0; top:0;}
.siteTitle {font-size:3em;}
.siteSubtitle {font-size:1.5em;}
#mainMenu {position:absolute; left:0; width:10em; text-align:right; line-height:1.6em; padding:1.5em 0.5em 0.5em 0.5em; font-size:1.1em;}
#sidebar { display: none; }
/* #sidebar {position:absolute; right:3px; width:16em; font-size:.9em;} */
#sidebarOptions {padding-top:0.3em;}
#sidebarOptions a {margin:0 0.2em; padding:0.2em 0.3em; display:block;}
#sidebarOptions input {margin:0.4em 0.5em;}
#sidebarOptions .sliderPanel {margin-left:1em; padding:0.5em; font-size:.85em;}
#sidebarOptions .sliderPanel a {font-weight:bold; display:inline; padding:0;}
#sidebarOptions .sliderPanel input {margin:0 0 0.3em 0;}
#sidebarTabs .tabContents {width:15em; overflow:hidden;}
.wizard { padding:0.1em 2em 0; }
.wizard__title { font-size:2em; }
.wizard__subtitle { font-size:1.2em; }
.wizard__title, .wizard__subtitle { font-weight:bold; background:none; padding:0; margin:0.4em 0 0.2em; }
.wizardStep { padding:1em; }
.wizardFooter { padding:0.8em 0.4em 0.8em 0; }
.wizardFooter .status { padding:0.2em 0.7em; margin-left:0.3em; }
.wizardFooter .button { margin:0.5em 0 0; font-size:1.2em; padding:0.2em 0.5em; }
.messageArea { position:fixed; top:0; right:20em; margin:0.5em; padding:0.7em 1em; z-index:2000; }
.messageToolbar { text-align:right; padding:0.2em 0; }
.messageToolbar__button { text-decoration:underline; }
.messageToolbar__icon { height: 1em; }
.messageArea__text a { text-decoration:underline; }
.tiddlerPopupButton {padding:0.2em;}
.popupTiddler {position: absolute; z-index:300; padding:1em; margin:0;}
.popup {position:absolute; z-index:300; font-size:.9em; padding:0.3em 0; list-style:none; margin:0; padding: 0.3em 0; border: none; box-shadow: 1px 2px 5px [[ColorPalette::TertiaryMid]];}
.popup .popupMessage {padding:0.4em;}
.popup hr {display:block; height:1px; width:auto; padding:0; margin:0.2em 0;}
.popup li.disabled {padding:0.4em;}
.popup li a {display:block; padding: 0.5em 0.5em; font-weight:normal; cursor:pointer;}
.listBreak {font-size:1px; line-height:1px;}
.listBreak div {margin:2px 0;}
.tabset {padding:1em 0 0 0.5em;}
.tab {margin:0 0 0 0.25em; padding:2px;}
.tabContents {padding:0.5em;}
.tabContents ul, .tabContents ol {margin:0; padding:0;}
.txtMainTab .tabContents li {list-style:none;}
.tabContents li.listLink { margin-left:.75em;}
#contentWrapper {display:block;}
#splashScreen {display:none;}
/* 0C wide displayArea top(1)/right(17)/bottom(0)/left(14) */
#displayArea {margin:0 0 0 10em;}
.toolbar {text-align:right; font-size:.9em;}
.tiddler {padding:1em 1em 0;}
.missing .viewer,.missing .title {font-style:italic;}
.title {font-size:1.6em; font-weight:bold;}
.missing .subtitle {display:none;}
.subtitle {font-size:1.1em;}
.tiddler .button {padding:0.2em 0.4em;}
.tagging {margin:0.5em 0.5em 0.5em 0; float:left; display:none;}
.isTag .tagging {display:block;}
.tagged {margin:0.5em; float:right;}
.tagging, .tagged {font-size:0.9em; padding:0.25em;}
.tagging ul, .tagged ul {list-style:none; margin:0.25em; padding:0;}
.tagClear {clear:both;}
.footer {font-size:.9em;}
.footer li {display:inline;}
.annotation {padding:0.5em; margin:0.5em;}
* html .viewer pre {width:99%; padding:0 0 1em 0;}
.viewer {line-height:1.4em; padding-top:0.5em;}
.viewer .button {margin:0 0.25em; padding:0 0.25em;}
.viewer blockquote {line-height:1.5em; padding-left:0.8em;margin-left:2.5em;}
.viewer ul, .viewer ol {margin-left:0.5em; padding-left:1.5em;}
.viewer table, table.twtable {border-collapse:collapse; margin:0.8em 1.0em;}
.viewer th, .viewer td, .viewer tr,.viewer caption,.twtable th, .twtable td, .twtable tr,.twtable caption {padding:3px;}
table.listView {font-size:0.85em; margin:0.8em 1.0em;}
table.listView th, table.listView td, table.listView tr {padding:0 3px 0 3px;}
.viewer pre {padding:0.5em; margin-left:0.5em; font-size:1.2em; line-height:1.4em; overflow:auto;}
.viewer code {font-size:1.2em; line-height:1.4em;}
.editor {font-size:1.1em;}
.editor input, .editor textarea {display:block; width:100%; box-sizing: border-box; font:inherit;}
.editorFooter {padding:0.25em 0; font-size:.9em;}
.editorFooter .button {padding-top:0; padding-bottom:0;}
.fieldsetFix {border:0; padding:0; margin:1px 0px;}
.zoomer {font-size:1.1em; position:absolute; overflow:hidden;}
.zoomer div {padding:1em;}
* html #backstage {width:99%;}
* html #backstageArea {width:99%;}
#backstageArea {display:none; position:relative; overflow: hidden; z-index:150; padding:0.3em 0.5em;}
#backstageToolbar {position:relative;}
#backstageArea a {font-weight:bold; margin-left:0.5em; padding:0.3em 0.5em;}
#backstageButton {display:none; position:absolute; z-index:175; top:0; right:0;}
#backstageButton a {padding:0.1em 0.4em; margin:0.1em;}
#backstage {position:relative; width:100%; z-index:50;}
#backstagePanel { display:none; z-index:100; position:absolute; width:90%; margin-left:3em; }
.backstagePanelFooter {padding-top:0.2em; float:right;}
.backstagePanelFooter a {padding:0.2em 0.4em;}
#backstageCloak {display:none; z-index:20; position:absolute; width:100%; height:100px;}
.whenBackstage {display:none;}
.backstageVisible .whenBackstage {display:block;}
/*}}}*/
/*{{{*/
body {font-size:1em;}
#sidebarOptions {font-size:1.05em;}
#sidebarOptions a {font-style:normal;}
#sidebarOptions .sliderPanel {font-size:0.95em;}
.subtitle {font-size:0.8em;}
.viewer table.listView {font-size:0.95em;}
/*}}}*/
/*{{{*/
@media print {
#mainMenu, #sidebar, .messageArea, .toolbar, #backstageButton, #backstageArea {display: none !important;}
#displayArea { margin-right: 0; }
/* #displayArea {margin: 1em 1em 0em;} */
noscript {display:none;}
}
/*}}}*/
<!--{{{-->
<div class='toolbar' role='navigation' macro='toolbar [[ToolbarCommands::ViewToolbar]]'></div>
<div class='title' macro='view title'></div>
<div class='viewer' macro='view text wikified'></div>
<div class='tagClear'></div>
<!--}}}-->
/% |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!show
<<tiddler {{
 var co=config.options;
 if (co.chkShowLeftSidebar===undefined) co.chkShowLeftSidebar=true;
 var mm=document.getElementById('mainMenu');
 var da=document.getElementById('displayArea');
 if (mm) {
 mm.style.display=co.chkShowLeftSidebar?'block':'none';
 da.style.marginLeft=co.chkShowLeftSidebar?'':'1em';
 }
'';}}>><html><nowiki><a href='javascript:;' title="$2"
onmouseover="
 this.href='javascript:void(eval(decodeURIComponent(%22(function(){try{('
 +encodeURIComponent(encodeURIComponent(this.onclick))
 +')()}catch(e){alert(e.description?e.description:e.toString())}})()%22)))';"
onclick="
 var co=config.options;
 var opt='chkShowLeftSidebar';
 var show=co[opt]=!co[opt];
 var mm=document.getElementById('mainMenu');
 var da=document.getElementById('displayArea');
 if (mm) {
 mm.style.display=show?'block':'none';
 da.style.marginLeft=show?'':'1em';
 }
 saveOptionCookie(opt);
 var labelShow=co.txtToggleLeftSideBarLabelShow||'&#x25BA;';
 var labelHide=co.txtToggleLeftSideBarLabelHide||'&#x25C4;';
 if (this.innerHTML==labelShow||this.innerHTML==labelHide)
 this.innerHTML=show?labelHide:labelShow;
 this.title=(show?'masquer':'montrer')+' le menu à gauche';
 var sm=document.getElementById('storyMenu');
 if (sm) config.refreshers.content(sm);
 return false;
">$1</a></html>
!end
%/<<tiddler {{
 var src='.ToggleLeftSidebar';
 src+(tiddler&&tiddler.title==src?'##info':'##show');
}} with: {{
 var co=config.options;
 var labelShow=co.txtToggleLeftSideBarLabelShow||'&#x25BA;&#x25C1;'; /%0C%/
 var labelHide=co.txtToggleLeftSideBarLabelHide||'&#x25C4;&#x25B7;'; /%0C%/
 '$1'!='$'+'1'?'$1':(co.chkShowLeftSidebar?labelHide:labelShow);
}} {{
 var tip=(config.options.chkShowLeftSidebar?'cacher':'montrer')+' le menu gauche'; /%0C%/
 '$2'!='$'+'2'?'$2':tip;
}}>>
/% |Author|Eric Shulman|License|https://www.TiddlyTools.com/#LegalStatements|
%/<html><nowiki><a href="javascript:;" title="masquer/montrer l'en-tête" /%0C%/
onmouseover="
 this.href='javascript:void(eval(decodeURIComponent(%22(function(){try{('
 +encodeURIComponent(encodeURIComponent(this.onclick))
 +')()}catch(e){alert(e.description?e.description:e.toString())}})()%22)))';"
onclick="
 var c=document.getElementById('contentWrapper'); if (!c) return;
 for (var i=0; i<c.childNodes.length; i++)
 if (hasClass(c.childNodes[i],'header')) { var h=c.childNodes[i]; break; }
 if (!h) return;
 config.options.chkHideSiteTitles=h.style.display!='none';
 h.style.display=config.options.chkHideSiteTitles?'none':'block';
 saveOptionCookie('chkHideSiteTitles');
 return false;
">&#x25b3;&#x25bc;</a></html>
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
*/
//{{{
version.extensions.BreadcrumbsPlugin= {major: 2, minor: 1, revision: 4, date: new Date(2011,2,16)};
var defaults={
 chkShowBreadcrumbs: true,
 chkReorderBreadcrumbs: true,
 chkCreateDefaultBreadcrumbs: true,
 chkShowStartupBreadcrumbs: false,
 chkBreadcrumbsReverse: false,
 chkBreadcrumbsLimit: false,
 txtBreadcrumbsLimit: 5,
 chkBreadcrumbsLimitOpenTiddlers:false,
 txtBreadcrumbsLimitOpenTiddlers:3,
 chkBreadcrumbsHideHomeLink: false,
 chkBreadcrumbsSave: false,
 txtBreadcrumbsHomeSeparator: ' | ',
 txtBreadcrumbsCrumbSeparator: ' > '
};
for (var id in defaults) if (config.options[id]===undefined)
 config.options[id]=defaults[id];
config.macros.breadcrumbs = {
 crumbs: [], // the list of current breadcrumbs
 askMsg: "Save current breadcrumbs before clearing?\n"
 +"Press OK to save, or CANCEL to continue without saving.",
 saveMsg: 'Enter the name of a tiddler in which to save the current breadcrumbs',
 saveTitle: 'SavedBreadcrumbs',
 handler: function(place,macroName,params,wikifier,paramString,tiddler) {
 var area=createTiddlyElement(place,"span",null,"breadCrumbs",null);
 area.setAttribute("homeSep",params[0]||config.options.txtBreadcrumbsHomeSeparator);
 area.setAttribute("crumbSep",params[1]||config.options.txtBreadcrumbsCrumbSeparator);
 this.render(area);
 },
 add: function (title) {
 var thisCrumb = title;
 var ind = this.crumbs.indexOf(thisCrumb);
 if(ind === -1)
 this.crumbs.push(thisCrumb);
 else if (config.options.chkReorderBreadcrumbs)
 this.crumbs.push(this.crumbs.splice(ind,1)[0]); // reorder crumbs
 else
 this.crumbs=this.crumbs.slice(0,ind+1); // trim crumbs
 if (config.options.chkBreadcrumbsLimitOpenTiddlers)
 this.limitOpenTiddlers();
 this.refresh();
 return false;
 },
 getAreas: function() {
 var crumbAreas=[];
 // find all DIVs with classname=="breadCrumbs"
 var all=document.getElementsByTagName("*");
 for (var i=0; i<all.length; i++)
 try{ if (hasClass(all[i],"breadCrumbs")) crumbAreas.push(all[i]); } catch(e) {;}
 // or, find single DIV w/fixed ID (backward compatibility)
 var byID=document.getElementById("breadCrumbs")
 if (byID && !hasClass(byID,"breadCrumbs")) crumbAreas.push(byID);
 if (!crumbAreas.length && config.options.chkCreateDefaultBreadcrumbs) {
 // no crumbs display... create one
 var defaultArea = createTiddlyElement(null,"span",null,"breadCrumbs",null);
 defaultArea.style.display= "none";
 var targetArea= document.getElementById("tiddlerDisplay");
 targetArea.parentNode.insertBefore(defaultArea,targetArea);
 crumbAreas.push(defaultArea);
 }
 return crumbAreas;
 },
 refresh: function() {
 var crumbAreas=this.getAreas();
 for (var i=0; i<crumbAreas.length; i++) {
 crumbAreas[i].style.display = config.options.chkShowBreadcrumbs?"inline":"none";
 removeChildren(crumbAreas[i]);
 this.render(crumbAreas[i]);
 }
 },
 render: function(here) {
 var co=config.options; var out=""
 if (!co.chkBreadcrumbsHideHomeLink) {
 createTiddlyButton(here,"Accueil",null,this.home,"tiddlyLink tiddlyLinkExisting");
 out+=here.getAttribute("homeSep")||config.options.txtBreadcrumbsHomeSeparator;
 }
 for (c=0; c<this.crumbs.length; c++) // remove non-existing tiddlers from crumbs
 if (!store.tiddlerExists(this.crumbs[c]) && !store.isShadowTiddler(this.crumbs[c]))
 this.crumbs.splice(c,1);
 var count=this.crumbs.length;
 if (co.chkBreadcrumbsLimit && co.txtBreadcrumbsLimit<count) count=co.txtBreadcrumbsLimit;
 var list=[];
 for (c=this.crumbs.length-count; c<this.crumbs.length; c++) list.push('[['+this.crumbs[c]+']]');
 if (co.chkBreadcrumbsReverse) list.reverse();
 out+=list.join(here.getAttribute("crumbSep")||config.options.txtBreadcrumbsCrumbSeparator);
 wikify(out,here);
 },
 home: function() {
 var cmb=config.macros.breadcrumbs;
 if (config.options.chkBreadcrumbsSave && confirm(cmb.askMsg)) cmb.saveCrumbs();
 story.closeAllTiddlers(); restart();
 cmb.crumbs = []; var crumbAreas=cmb.getAreas();
 for (var i=0; i<crumbAreas.length; i++) crumbAreas[i].style.display = "none";
 return false;
 },
 saveCrumbs: function() {
 var tid=prompt(this.saveMsg,this.saveTitle); if (!tid||!tid.length) return; // cancelled by user
 var t=store.getTiddler(tid);
 if(t && !confirm(config.messages.overwriteWarning.format([tid]))) return;
 var who=config.options.txtUserName;
 var when=new Date();
 var text='[['+this.crumbs.join(']]\n[[')+']]';
 var tags=t?t.tags:[]; tags.pushUnique('story');
 var fields=t?t.fields:{};
 store.saveTiddler(tid,tid,text,who,when,tags,fields);
 story.displayTiddler(null,tid);
 story.refreshTiddler(tid,null,true);
 displayMessage(tid+' has been '+(t?'updated':'created'));
 },
 limitOpenTiddlers: function() {
 var limit=config.options.txtBreadcrumbsLimitOpenTiddlers; if (limit<1) limit=1;
 for (c=this.crumbs.length-1; c>=0; c--) {
 var tid=this.crumbs[c];
 var elem=story.getTiddler(tid);
 if (elem) { // tiddler is displayed
 if (limit <=0) { // display limit has been reached
 if (elem.getAttribute("dirty")=="true") { // tiddler is being edited
 var msg= "'"+tid+"' is currently being edited.\n\n"
 +"Press OK to save and close this tiddler\n"
 +"or press Cancel to leave it opened";
 if (confirm(msg)) {
 story.closeTiddler(tid);
 }
 }
 else story.closeTiddler(this.crumbs[c]);
 }
 limit--;
 }
 }
 }
};
//}}}
// // PreviousTiddler ('back') command and macro
//{{{
config.commands.previousTiddler = {
 text: 'back',
 tooltip: 'view the previous tiddler',
 handler: function(event,src,title) {
 var crumbs=config.macros.breadcrumbs.crumbs;
 if (crumbs.length<2) config.macros.breadcrumbs.home();
 else story.displayTiddler(story.findContainingTiddler(src),crumbs[crumbs.length-2]);
 return false;
 }
};
config.macros.previousTiddler= {
 label: 'back',
 prompt: 'view the previous tiddler',
 handler: function(place,macroName,params,wikifier,paramString,tiddler) {
 var label=params.shift(); if (!label) label=this.label;
 var prompt=params.shift(); if (!prompt) prompt=this.prompt;
 createTiddlyButton(place,label,prompt,function(ev){
 return config.commands.previousTiddler.handler(ev,this)
 });
 }
}//}}}
// // HIJACKS
//{{{
// update crumbs when a tiddler is displayed
if (Story.prototype.breadCrumbs_coreDisplayTiddler==undefined)
 Story.prototype.breadCrumbs_coreDisplayTiddler=Story.prototype.displayTiddler;
Story.prototype.displayTiddler = function(srcElement,tiddler) {
 var title=(tiddler instanceof Tiddler)?tiddler.title:tiddler;
 this.breadCrumbs_coreDisplayTiddler.apply(this,arguments);
 if (!startingUp || config.options.chkShowStartupBreadcrumbs)
 config.macros.breadcrumbs.add(title);
}
// update crumbs when a tiddler is deleted
if (TiddlyWiki.prototype.breadCrumbs_coreRemoveTiddler==undefined)
 TiddlyWiki.prototype.breadCrumbs_coreRemoveTiddler=TiddlyWiki.prototype.removeTiddler;
TiddlyWiki.prototype.removeTiddler= function() {
 this.breadCrumbs_coreRemoveTiddler.apply(this,arguments);
 config.macros.breadcrumbs.refresh();
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Configuration
<<<
<<option chkDisableWikiLinks>> Disable ALL automatic WikiWord tiddler links
<<option chkAllowLinksFromShadowTiddlers>> ... except for WikiWords //contained in// shadow tiddlers
<<option chkDisableNonExistingWikiLinks>> Disable automatic WikiWord links for non-existing tiddlers
Disable automatic WikiWord links for words listed in: <<option txtDisableWikiLinksList>>
Disable automatic WikiWord links for tiddlers tagged with: <<option txtDisableWikiLinksTag>>
<<<
!Code
*/
//{{{
version.extensions.DisableWikiLinksPlugin= {major: 1, minor: 6, revision: 0, date: new Date(2008,7,22)};
if (config.options.chkDisableNonExistingWikiLinks==undefined) config.options.chkDisableNonExistingWikiLinks= false;
if (config.options.chkDisableWikiLinks==undefined) config.options.chkDisableWikiLinks=false;
if (config.options.txtDisableWikiLinksList==undefined) config.options.txtDisableWikiLinksList="DisableWikiLinksList";
if (config.options.chkAllowLinksFromShadowTiddlers==undefined) config.options.chkAllowLinksFromShadowTiddlers=true;
if (config.options.txtDisableWikiLinksTag==undefined) config.options.txtDisableWikiLinksTag="excludeWikiWords";
// find the formatter for wikiLink and replace handler with 'pass-thru' rendering
initDisableWikiLinksFormatter();
function initDisableWikiLinksFormatter() {
 for (var i=0; i<config.formatters.length && config.formatters[i].name!="wikiLink"; i++);
 config.formatters[i].coreHandler=config.formatters[i].handler;
 config.formatters[i].handler=function(w) {
  // supress any leading "~" (if present)
  var skip=(w.matchText.substr(0,1)==config.textPrimitives.unWikiLink)?1:0;
  var title=w.matchText.substr(skip);
  var exists=store.tiddlerExists(title);
  var inShadow=w.tiddler && store.isShadowTiddler(w.tiddler.title);
  // check for excluded Tiddler
  if (w.tiddler && w.tiddler.isTagged(config.options.txtDisableWikiLinksTag))
   { w.outputText(w.output,w.matchStart+skip,w.nextMatch); return; }
  // check for specific excluded wiki words
  var t=store.getTiddlerText(config.options.txtDisableWikiLinksList);
  if (t && t.length && t.indexOf(w.matchText)!=-1)
   { w.outputText(w.output,w.matchStart+skip,w.nextMatch); return; }
  // if not disabling links from shadows (default setting)
  if (config.options.chkAllowLinksFromShadowTiddlers && inShadow)
   return this.coreHandler(w);
  // check for non-existing non-shadow tiddler
  if (config.options.chkDisableNonExistingWikiLinks && !exists)
   { w.outputText(w.output,w.matchStart+skip,w.nextMatch); return; }
  // if not enabled, just do standard WikiWord link formatting
  if (!config.options.chkDisableWikiLinks)
   return this.coreHandler(w);
  // just return text without linking
  w.outputText(w.output,w.matchStart+skip,w.nextMatch)
 }
}
Tiddler.prototype.coreAutoLinkWikiWords = Tiddler.prototype.autoLinkWikiWords;
Tiddler.prototype.autoLinkWikiWords = function()
{
 if (!config.options.chkDisableWikiLinks)
  return this.coreAutoLinkWikiWords.apply(this,arguments);
 return false;
}
Tiddler.prototype.disableWikiLinks_changed = Tiddler.prototype.changed;
Tiddler.prototype.changed = function()
{
 this.disableWikiLinks_changed.apply(this,arguments);
 var t=store.getTiddlerText(config.options.txtDisableWikiLinksList,"").readBracketedList();
 if (t.length) for (var i=0; i<t.length; i++)
  if (this.links.contains(t[i]))
   this.links.splice(this.links.indexOf(t[i]),1);
};
//}}}
/* |Author|Yakov Litvin|Forked from|[[abego.ForEachTiddlerPlugin|http://tiddlywiki.abego-software.de/#ForEachTiddlerPlugin]], by Udo Borkowski| */
//{{{
(function(){
// Only install once
if (version.extensions.ForEachTiddlerPlugin) {
 alert("Warning: more than one copy of ForEachTiddlerPlugin is set to be launched");
 return;
} else
 version.extensions.ForEachTiddlerPlugin = {
  source: "[repository url here]",
  licence: "[licence url here]",
  copyright: "Copyright (c) Yakov Litvin, 2012 [url of the meta page]"
 };
config.macros.forEachTiddler = {
 actions: {
  addToList: {},
  write: {}
 }
};
config.macros.forEachTiddler.handler = function(place,macroName,params,wikifier,paramString,tiddler) {
 var parsedParams = this.parseParams(params);
 if (parsedParams.errorText) {
  this.handleError(place, parsedParams.errorText);
  return;
 }//else
  parsedParams.place = place;
  parsedParams.inTiddler = tiddler? tiddler : getContainingTiddler(place);
 parsedParams.actionName = parsedParams.actionName ? parsedParams.actionName : "addToList";
 var actionName = parsedParams.actionName;
 var action = this.actions[actionName];
 if (!action) {
  this.handleError(place, "Unknown action '"+actionName+"'.");
  return;
 }
 var element = document.createElement(action.element);
 jQuery(element).attr({ refresh: "macro", macroName: macroName }).data(parsedParams);
 place.appendChild(element);
 this.refresh(element);
};
config.macros.forEachTiddler.refresh = function(element) {
 var parsedParams = jQuery(element).data(),
  action = this.actions[parsedParams.actionName];
 jQuery(element).empty();
 try {
  var tiddlersAndContext = this.getTiddlersAndContext(parsedParams);
  action.handler(element, tiddlersAndContext.tiddlers,
    parsedParams.actionParameter, tiddlersAndContext.context);
 } catch (e) {
  this.handleError(place, e);
 }
};
config.macros.forEachTiddler.getTiddlersAndContext = function(parameter) {
 var context = config.macros.forEachTiddler.createContext(parameter.place, parameter.filter, parameter.whereClause, parameter.sortClause, parameter.sortAscending, parameter.actionName, parameter.actionParameter, parameter.scriptText, parameter.tiddlyWikiPath, parameter.inTiddler);
 var tiddlyWiki = parameter.tiddlyWikiPath ? this.loadTiddlyWiki(parameter.tiddlyWikiPath) : store;
 context["tiddlyWiki"] = tiddlyWiki;
 var tiddlers = this.findTiddlers(parameter.filter, parameter.whereClause, context, tiddlyWiki);
 context["tiddlers"] = tiddlers;
 if (parameter.sortClause)
  this.sortTiddlers(tiddlers, parameter.sortClause, parameter.sortAscending, context);
 return {tiddlers: tiddlers, context: context};
};
config.macros.forEachTiddler.actions.addToList.element = "ul";
config.macros.forEachTiddler.actions.addToList.handler = function(place, tiddlers, parameter, context) {
 var p = 0;
 if (parameter.length > p) {
  config.macros.forEachTiddler.createExtraParameterErrorElement(place, "addToList", parameter, p);
  return;
 }
 for (var i = 0; i < tiddlers.length; i++) {
  var tiddler = tiddlers[i];
  var listItem = document.createElement("li");
  place.appendChild(listItem);
  createTiddlyLink(listItem, tiddler.title, true);
 }
};
var parseNamedParameter = function(name, parameter, i) {
 var beginExpression = null;
 if ((i < parameter.length) && parameter[i] == name) {
  i++;
  if (i >= parameter.length) {
   throw "Missing text behind '%0'".format([name]);
  }
  return config.macros.forEachTiddler.paramEncode(parameter[i]);
 }
 return null;
}
config.macros.forEachTiddler.actions.write.element = "span";
config.macros.forEachTiddler.actions.write.handler = function(place, tiddlers, parameter, context) {
 var p = 0;
 if (p >= parameter.length) {
  this.handleError(place, "Missing expression behind 'write'.");
  return;
 }
 var textExpression = config.macros.forEachTiddler.paramEncode(parameter[p]);
 p++;
 var beginExpression = parseNamedParameter("begin", parameter, p);
 if (beginExpression !== null)
  p += 2;
 var endExpression = parseNamedParameter("end", parameter, p);
 if (endExpression !== null)
  p += 2;
 var noneExpression = parseNamedParameter("none", parameter, p);
 if (noneExpression !== null)
  p += 2;
 var filename = null;
 var lineSeparator = undefined;
 if ((p < parameter.length) && parameter[p] == "toFile") {
  p++;
  if (p >= parameter.length) {
   this.handleError(place, "Filename expected behind 'toFile' of 'write' action.");
   return;
  }
  filename = config.macros.forEachTiddler.getLocalPath(config.macros.forEachTiddler.paramEncode(parameter[p]));
  p++;
  if ((p < parameter.length) && parameter[p] == "withLineSeparator") {
   p++;
   if (p >= parameter.length) {
    this.handleError(place, "Line separator text expected behind 'withLineSeparator' of 'write' action.");
    return;
   }
   lineSeparator = config.macros.forEachTiddler.paramEncode(parameter[p]);
   p++;
  }
 }
 if (parameter.length > p) {
  config.macros.forEachTiddler.createExtraParameterErrorElement(place, "write", parameter, p);
  return;
 }
 var func = config.macros.forEachTiddler.getEvalTiddlerFunction(textExpression, context);
 var count = tiddlers.length;
 var text = "";
 if (count > 0 && beginExpression)
  text += config.macros.forEachTiddler.getEvalTiddlerFunction(beginExpression, context)(undefined, context, count, undefined);
 for (var i = 0; i < count; i++) {
  var tiddler = tiddlers[i];
  text += func(tiddler, context, count, i);
 }
 if (count > 0 && endExpression)
  text += config.macros.forEachTiddler.getEvalTiddlerFunction(endExpression, context)(undefined, context, count, undefined);
 if (count == 0 && noneExpression)
  text += config.macros.forEachTiddler.getEvalTiddlerFunction(noneExpression, context)(undefined, context, count, undefined);
 if (filename) {
  if (lineSeparator !== undefined) {
   lineSeparator = lineSeparator.replace(/\\n/mg, "\n").replace(/\\r/mg, "\r");
   text = text.replace(/\n/mg,lineSeparator);
  }
  saveFile(filename, convertUnicodeToUTF8(text));
 } else
  wikify(text, place, null/* highlightRegExp */, context.inTiddler);
};
config.macros.forEachTiddler.parseParams = function(params) {
 var i = 0; // index running over the params
 var tiddlyWikiPath = undefined;
 if ((i < params.length) && params[i] == "in") {
  i++;
  if (i >= params.length)
   return { errorText: "TiddlyWiki path expected behind 'in'." };
  tiddlyWikiPath = this.paramEncode((i < params.length) ? params[i] : "");
  i++;
 }
 if ((i < params.length) && params[i] == "filter") {
  i++;
  var filter = (i < params.length) ? params[i] : undefined;
  i++;
 }
 var whereClause ="true";
 if ((i < params.length) && params[i] == "where") {
  i++;
  whereClause = this.paramEncode((i < params.length) ? params[i] : "");
  i++;
 }
 var sortClause = null;
 var sortAscending = true;
 if ((i < params.length) && params[i] == "sortBy") {
  i++;
  if (i >= params.length)
   return { errorText: "sortClause missing behind 'sortBy'." };
  sortClause = this.paramEncode(params[i]);
  i++;
  if ((i < params.length) && (params[i] == "ascending" || params[i] == "descending")) {
    sortAscending = params[i] == "ascending";
    i++;
  }
 }
 var scriptText = null;
 if ((i < params.length) && params[i] == "script") {
  i++;
  scriptText = this.paramEncode((i < params.length) ? params[i] : "");
  i++;
 }
 var actionName = "addToList";
 if (i < params.length) {
  if (!config.macros.forEachTiddler.actions[params[i]])
   return { errorText: "Unknown action '"+params[i]+"'." };
  else {
   actionName = params[i];
   i++;
  }
 }
 var actionParameter = params.slice(i);
 return {
   filter:   filter,
   whereClause:  whereClause,
   sortClause:  sortClause,
   sortAscending:  sortAscending,
   actionName:  actionName,
   actionParameter: actionParameter,
   scriptText:  scriptText,
   tiddlyWikiPath:  tiddlyWikiPath
  }
};
var getContainingTiddler = function(e) {
 while(e && !hasClass(e,"tiddler"))
  e = e.parentNode;
 var title = e ? e.getAttribute("tiddler") : null;
 return title ? store.getTiddler(title) : null;
};
config.macros.forEachTiddler.createContext = function(placeParam, filterParam, whereClauseParam, sortClauseParam, sortAscendingParam, actionNameParam, actionParameterParam, scriptText, tiddlyWikiPathParam, inTiddlerParam) {
 return {
  place  : placeParam,
  filter  : filterParam,
  whereClause : whereClauseParam,
  sortClause : sortClauseParam,
  sortAscending : sortAscendingParam,
  script  : scriptText,
  actionName : actionNameParam,
  actionParameter : actionParameterParam,
  tiddlyWikiPath : tiddlyWikiPathParam,
  inTiddler : inTiddlerParam, // the tiddler containing the <<forEachTiddler ...>> macro call.
  viewerTiddler : getContainingTiddler(placeParam) //the tiddler showing the forEachTiddler result
 };
};
config.macros.forEachTiddler.loadTiddlyWiki = function(path, idPrefix) {
 if (!idPrefix) {
  idPrefix = "store";
 }
 var lenPrefix = idPrefix.length;
 var content = loadFile(this.getLocalPath(path));
 if(content === null) {
  throw "TiddlyWiki '"+path+"' not found.";
 }
 var tiddlyWiki = new TiddlyWiki();
 if (!tiddlyWiki.importTiddlyWiki(content))
  throw "File '"+path+"' is not a TiddlyWiki.";
 tiddlyWiki.dirty = false;
 return tiddlyWiki;
};
config.macros.forEachTiddler.getEvalTiddlerFunction = function (javaScriptExpression, context) {
 var script = context["script"];
 var functionText = "var theFunction = function(tiddler, context, count, index) { return "+javaScriptExpression+"}";
 var fullText = (script ? script+";" : "")+functionText+";theFunction;";
 return eval(fullText);
};
config.macros.forEachTiddler.findTiddlers = function(filter, whereClause, context, tiddlyWiki) {
 var result = [];
 var func = config.macros.forEachTiddler.getEvalTiddlerFunction(whereClause, context);
 if(filter) {
  var tids = tiddlyWiki.filterTiddlers(filter);
  for(var i = 0; i < tids.length; i++)
   if(func(tids[i], context, undefined, undefined))
    result.push(tids[i]);
 } else
  tiddlyWiki.forEachTiddler(function(title,tiddler) {
   if(func(tiddler, context, undefined, undefined))
    result.push(tiddler);
  });
 return result;
};
config.macros.forEachTiddler.sortAscending = function(tiddlerA, tiddlerB) {
 return ((tiddlerA.forEachTiddlerSortValue == tiddlerB.forEachTiddlerSortValue)
   ? 0
   : ((tiddlerA.forEachTiddlerSortValue < tiddlerB.forEachTiddlerSortValue)
    ? -1
    : +1))
};
config.macros.forEachTiddler.sortDescending = function(tiddlerA, tiddlerB) {
 return ((tiddlerA.forEachTiddlerSortValue == tiddlerB.forEachTiddlerSortValue)
   ? 0
   : ((tiddlerA.forEachTiddlerSortValue < tiddlerB.forEachTiddlerSortValue)
    ? +1
    : -1))
};
config.macros.forEachTiddler.sortTiddlers = function(tiddlers, sortClause, ascending, context) {
 var func = config.macros.forEachTiddler.getEvalTiddlerFunction(sortClause, context);
 var count = tiddlers.length;
 var i;
 for (i = 0; i < count; i++) {
  var tiddler = tiddlers[i];
  tiddler.forEachTiddlerSortValue = func(tiddler,context, undefined, undefined);
 }
 tiddlers.sort(ascending ? this.sortAscending : this.sortDescending);
 for (i = 0; i < tiddlers.length; i++)
  delete tiddlers[i].forEachTiddlerSortValue;
};
config.macros.forEachTiddler.createErrorElement = function(place, exception) {
 var message = (exception.description) ? exception.description : exception.toString();
 return createTiddlyElement(place,"span",null,"forEachTiddlerError","<<forEachTiddler ...>>: "+message);
};
config.macros.forEachTiddler.handleError = function(place, exception) {
 if (place) {
  this.createErrorElement(place, exception);
 } else {
  throw exception;
 }
};
config.macros.forEachTiddler.createExtraParameterErrorElement = function(place, actionName, parameter, firstUnusedIndex) {
 var message = "Extra parameter behind '"+actionName+"':";
 for (var i = firstUnusedIndex; i < parameter.length; i++) {
  message += " "+parameter[i];
 }
 this.handleError(place, message);
};
config.macros.forEachTiddler.paramEncode = function(s) {
 var reGTGT = new RegExp("\\$\\)\\)","mg");
 var reGT = new RegExp("\\$\\)","mg");
 return s.replace(reGTGT, ">>").replace(reGT, ">");
};
config.macros.forEachTiddler.getLocalPath = function(originalPath) {
 var originalAbsolutePath = originalPath;
 if(originalAbsolutePath.search(/^((http(s)?)|(file)):/) != 0) {
  if (originalAbsolutePath.search(/^(.\:\\)|(\\\\)|(\/)/) != 0){// is relative?
   var currentUrl = document.location.toString();
   var currentPath = (currentUrl.lastIndexOf("/") > -1) ?
    currentUrl.substr(0, currentUrl.lastIndexOf("/") + 1) :
    currentUrl + "/";
   originalAbsolutePath = currentPath + originalAbsolutePath;
  } else
   originalAbsolutePath = "file://" + originalAbsolutePath;
  originalAbsolutePath = originalAbsolutePath.replace(/\\/mg,"/");
 }
 return getLocalPath(originalAbsolutePath);
};
setStylesheet(
 ".forEachTiddlerError{color: #ffffff;background-color: #880000;}",
 "forEachTiddler");
config.macros.fet = config.macros.forEachTiddler;
String.prototype.startsWith = function(prefix) {
 var n = prefix.length;
 return (this.length >= n) && (this.slice(0, n) == prefix);
};
String.prototype.endsWith = function(suffix) {
 var n = suffix.length;
 return (this.length >= n) && (this.right(n) == suffix);
};
String.prototype.contains = function(substring) {
 return this.indexOf(substring) >= 0;
};
})();
Tiddler.prototype.getSlice = function(sliceName,defaultText) {
 var re = TiddlyWiki.prototype.slicesRE;
 re.lastIndex = 0;
 var m = re.exec(this.text);
 while(m) {
  if(m[2]) {
   if(m[2] == sliceName)
    return m[3];
  } else {
   if(m[5] == sliceName)
    return m[6];
  }
  m = re.exec(this.text);
 }
 return defaultText;
};
Tiddler.prototype.getSection = function(sectionName,defaultText) {
 var beginSectionRegExp = new RegExp("(^!{1,6}[ \t]*" + sectionName.escapeRegExp() + "[ \t]*\n)","mg"),
  sectionTerminatorRegExp = /^!/mg;
 var match = beginSectionRegExp.exec(this.text), sectionText;
 if(match) {
  sectionText = this.text.substr(match.index+match[1].length);
  match = sectionTerminatorRegExp.exec(sectionText);
  if(match)
   sectionText = sectionText.substr(0,match.index-1); // don't include final \n
  return sectionText
 }
 return defaultText;
};
//}}}
/* |Author|SaqImtiaz|Version|1.11|0C_Tuned| */
//{{{
config.hoverMenu={};
config.hoverMenu.settings={ align: 'right', x: 4, y: 100 };
config.hoverMenu.handler=function()
{
  var theMenu = createTiddlyElement(document.getElementById("contentWrapper"), "div","hoverMenu");
  theMenu.setAttribute("refresh","content");
  theMenu.setAttribute("tiddler","HoverMenu");
  var menuContent = store.getTiddlerText("HoverMenu");
  wikify(menuContent,theMenu);
        var Xloc = this.settings.x;
        Yloc =this.settings.y;
        var ns = (navigator.appName.indexOf("Netscape") != -1);
        function SetMenu(id)
   {
   var GetElements=document.getElementById?document.getElementById(id):document.all?document.all[id]:document.layers[id];
   if(document.layers)GetElements.style=GetElements;
   GetElements.sP=function(x,y){this.style[config.hoverMenu.settings.align]=x +"px";this.style.top=y +"px";};
   GetElements.x = Xloc;
   GetElements.y = findScrollY();
   GetElements.y += Yloc;
   return GetElements;
   }
  window.LoCate_XY=function()
   {
   var pY =  findScrollY();
   ftlObj.y += (pY + Yloc - ftlObj.y)/15;
   ftlObj.sP(ftlObj.x, ftlObj.y);
   setTimeout("LoCate_XY()", 10);
   }
  ftlObj = SetMenu("hoverMenu");
   LoCate_XY();
};
window.old_lewcid_hovermenu_restart = restart;
restart = function()
{
  window.old_lewcid_hovermenu_restart();
  config.hoverMenu.handler();
};
setStylesheet(
"#hoverMenu .button, #hoverMenu .tiddlyLink {border:none; background:#008; color:#fff; padding:0 20px; float:right; margin-bottom:5px;}\sn"+
"#hoverMenu .button:hover, #hoverMenu .tiddlyLink:hover {border:none; color:#fff; background:#00f; padding:0 20px; float:right; margin-bottom:5px;}\sn"+
"#hoverMenu .button {width:100%; text-align:center}"+
"#hoverMenu { position:absolute; width:10px;}\sn"+
"\sn","hoverMenuStyles");
config.macros.renameButton={};
config.macros.renameButton.handler = function(place,macroName,params,wikifier,paramString,tiddler)
{
  if (place.lastChild.tagName!="BR")
       {
  place.lastChild.firstChild.data = params[0];
  if (params[1]) {place.lastChild.title = params[1];}
       }
};
config.shadowTiddlers["HoverMenu"]="<<top>><<jump ≡→ '' top>>[[CCM]]^^[[CCSK]]^^^^[[CAIQ]]^^^^[[Hebdo|Newsletters]]^^^^[[Outils]]^^^^[[Veille|Veille Web]]^^";
config.macros.top={};
config.macros.top.handler=function(place,macroName)
{ createTiddlyButton(place,"→↑↑","↑ Haut de page ↑",this.onclick); }
config.macros.top.onclick=function()
{ window.scrollTo(0,0); };
config.commands.top =
{ text:" ^ ", tooltip:"^ Haut de page ^" };
config.commands.top.handler = function(event,src,title)
{ window.scrollTo(0,0); }

config.macros.jump= {};
config.macros.jump.handler = function (place,macroName,params,wikifier,paramString,tiddler)
{
 var label = (params[0] && params[0]!=".")? params[0]: 'jump';
 var tooltip = (params[1] && params[1]!=".")? params[1]: '→ Aller vers un article déjà ouvert';
 var top = (params[2] && params[2]=='top') ? true: false;
 var btn =createTiddlyButton(place,label,tooltip,this.onclick);
 if (top==true)
       btn.setAttribute("top","true")
}
config.macros.jump.onclick = function(e)
{
 if (!e) var e = window.event;
 var theTarget = resolveTarget(e);
 var top = theTarget.getAttribute("top");
 var popup = Popup.create(this);
 if(popup)
  {
   if(top=="true")
    {createTiddlyButton(createTiddlyElement(popup,"li"),'↑ Tout en Haut ↑','→ Aller tout en haut de cette page',config.macros.jump.top);
     createTiddlyElement(popup,"hr");}

  story.forEachTiddler(function(title,element) {
   createTiddlyLink(createTiddlyElement(popup,"li"),title,true);
   });
  }
 Popup.show(popup,false);
 e.cancelBubble = true;
 if (e.stopPropagation) e.stopPropagation();
 return false;
}
config.macros.jump.top = function()
{
       window.scrollTo(0,0);
}

Popup.show = function(unused,slowly)
{
var curr = Popup.stack[Popup.stack.length-1];
 var rootLeft = findPosX(curr.root);
 var rootTop = findPosY(curr.root);
 var rootHeight = curr.root.offsetHeight;
 var popupLeft = rootLeft;
 var popupTop = rootTop + rootHeight;
 var popupWidth = curr.popup.offsetWidth;
 var winWidth = findWindowWidth();
 if (isChild(curr.root,'hoverMenu'))
       var x = config.hoverMenu.settings.x;
 else
       var x = 0;
 if(popupLeft + popupWidth+x > winWidth)
  popupLeft = winWidth - popupWidth -x;
 if (isChild(curr.root,'hoverMenu'))
    {curr.popup.style.right = x + "px";}
 else
  curr.popup.style.left = popupLeft + "px";
 curr.popup.style.top = popupTop + "px";
 curr.popup.style.display = "block";
 addClass(curr.root,"highlight");
 if(config.options.chkAnimate)
  anim.startAnimating(new Scroller(curr.popup,slowly));
 else
  window.scrollTo(0,ensureVisible(curr.popup));
}
window.isChild = function(e,parentId) {
 while (e != null) {
  var parent = document.getElementById(parentId);
  if (parent == e) return true;
  e = e.parentNode;
  }
 return false;
};
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Configuration
<<<
Use {{{<hide linebreaks>}}} within HTML content to wiki-style rendering of line breaks. To //always// omit all line breaks from the rendered output, you can set this option:
><<option chkHTMLHideLinebreaks>> ignore all line breaks
which can also be 'hard coded' into your document by adding the following to a tiddler, tagged with <<tag systemConfig>>
>{{{config.options.chkHTMLHideLinebreaks=true;}}}
<<<
!Code
*/
//{{{
version.extensions.HTMLFormattingPlugin= {major: 2, minor: 4, revision: 1, date: new Date(2010,5,7)};
// find the formatter for HTML and replace the handler
initHTMLFormatter();
function initHTMLFormatter()
{
 for (var i=0; i<config.formatters.length && config.formatters[i].name!="html"; i++);
 if (i<config.formatters.length) config.formatters[i].handler=function(w) {
  if (!this.lookaheadRegExp)
   this.lookaheadRegExp = new RegExp(this.lookahead,"mg");
  this.lookaheadRegExp.lastIndex = w.matchStart;
  var lookaheadMatch = this.lookaheadRegExp.exec(w.source)
  if(lookaheadMatch && lookaheadMatch.index == w.matchStart) {
   var html=lookaheadMatch[1];
   // if <nowiki> is present, just let browser handle it!
   if (html.indexOf('<nowiki>')!=-1)
    createTiddlyElement(w.output,"span").innerHTML=html;
   else {
    // if <hide linebreaks> is present, or chkHTMLHideLinebreaks is set
    // suppress wiki-style literal handling of newlines
    if (config.options.chkHTMLHideLinebreaks||(html.indexOf('<hide linebreaks>')!=-1))
     html=html.replace(/\n/g,' ');
    // remove all \r's added by IE textarea and mask newlines and macro brackets
    html=html.replace(/\r/g,'').replace(/\n/g,'\\n').replace(/<</g,'%%(').replace(/>>/g,')%%');
    // create span, let browser parse HTML
    var e=createTiddlyElement(w.output,"span"); e.innerHTML=html;
    // then re-render text nodes as wiki-formatted content
    wikifyTextNodes(e,w);
   }
   w.nextMatch = this.lookaheadRegExp.lastIndex; // continue parsing
  }
 }
}
// wikify #text nodes that remain after HTML content is processed (pre-order recursion)
function wikifyTextNodes(theNode,w)
{
 function unmask(s) { return s.replace(/\%%\(/g,'<<').replace(/\)\%%/g,'>>').replace(/\\n/g,'\n'); }
 switch (theNode.nodeName.toLowerCase()) {
  case 'style': case 'option': case 'select':
   theNode.innerHTML=unmask(theNode.innerHTML);
   break;
  case 'textarea':
   theNode.value=unmask(theNode.value);
   break;
  case '#text':
   var txt=unmask(theNode.nodeValue);
   var newNode=createTiddlyElement(null,"span");
   theNode.parentNode.replaceChild(newNode,theNode);
   wikify(txt,newNode,highlightHack,w.tiddler);
   break;
  default:
   for (var i=0;i<theNode.childNodes.length;i++)
    wikifyTextNodes(theNode.childNodes.item(i),w); // recursion
   break;
 }
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Code
*/
//{{{
version.extensions.ImageSizePlugin= {major: 1, minor: 2, revision: 2, date: new Date(2010,7,24)};
//}}}
//{{{
var f=config.formatters[config.formatters.findByField("name","image")];
f.match="\\[[<>]?[Ii][Mm][Gg](?:\\([^,]*,[^\\)]*\\))?\\[";
f.lookaheadRegExp=/\[([<]?)(>?)[Ii][Mm][Gg](?:\(([^,]*),([^\)]*)\))?\[(?:([^\|\]]+)\|)?([^\[\]\|]+)\](?:\[([^\]]*)\])?\]/mg;
f.handler=function(w) {
 this.lookaheadRegExp.lastIndex = w.matchStart;
 var lookaheadMatch = this.lookaheadRegExp.exec(w.source)
 if(lookaheadMatch && lookaheadMatch.index == w.matchStart) {
  var floatLeft=lookaheadMatch[1];
  var floatRight=lookaheadMatch[2];
  var width=lookaheadMatch[3];
  var height=lookaheadMatch[4];
  var tooltip=lookaheadMatch[5];
  var src=lookaheadMatch[6];
  var link=lookaheadMatch[7];
  var e = w.output;
  if(link) { // LINKED IMAGE
   if (config.formatterHelpers.isExternalLink(link)) {
    if (config.macros.attach && config.macros.attach.isAttachment(link)) {
     // see [[AttachFilePluginFormatters]]
     e = createExternalLink(w.output,link);
     e.href=config.macros.attach.getAttachment(link);
     e.title = config.macros.attach.linkTooltip + link;
    } else
     e = createExternalLink(w.output,link);
   } else
    e = createTiddlyLink(w.output,link,false,null,w.isStatic);
   addClass(e,"imageLink");
  }
  var img = createTiddlyElement(e,"img");
  if(floatLeft) img.align="left"; else if(floatRight) img.align="right";
  if(width||height) {
   var x=width.trim(); var y=height.trim();
   var stretchW=(x.substr(x.length-1,1)=='+'); if (stretchW) x=x.substr(0,x.length-1);
   var stretchH=(y.substr(y.length-1,1)=='+'); if (stretchH) y=y.substr(0,y.length-1);
   if (x.substr(0,2)=="{{")
    { try{x=eval(x.substr(2,x.length-4))} catch(e){displayMessage(e.description||e.toString())} }
   if (y.substr(0,2)=="{{")
    { try{y=eval(y.substr(2,y.length-4))} catch(e){displayMessage(e.description||e.toString())} }
   img.style.width=x.trim(); img.style.height=y.trim();
   config.formatterHelpers.addStretchHandlers(img,stretchW,stretchH);
  }
  if(tooltip) img.title = tooltip;
  if (config.macros.attach && config.macros.attach.isAttachment(src))
   src=config.macros.attach.getAttachment(src); // see [[AttachFilePluginFormatters]]
  else if (config.formatterHelpers.resolvePath) { // see [[ImagePathPlugin]]
   if (config.browser.isIE || config.browser.isSafari) {
    img.onerror=(function(){
     this.src=config.formatterHelpers.resolvePath(this.src,false);
     return false;
    });
   } else
    src=config.formatterHelpers.resolvePath(src,true);
  }
  img.src=src;
  w.nextMatch = this.lookaheadRegExp.lastIndex;
 }
}
config.formatterHelpers.imageSize={
tip: '', dragtip: 'DRAG=étirer/réduire, '
}
config.formatterHelpers.addStretchHandlers=function(e,stretchW,stretchH) {
 e.title=((stretchW||stretchH)?this.imageSize.dragtip:'')+this.imageSize.tip;
 e.statusMsg='width=%0, height=%1';
 e.style.cursor='move';
 e.originalW=e.style.width;
 e.originalH=e.style.height;
 e.minW=Math.max(e.offsetWidth/20,10);
 e.minH=Math.max(e.offsetHeight/20,10);
 e.stretchW=stretchW;
 e.stretchH=stretchH;
 e.onmousedown=function(ev) { var ev=ev||window.event;
  this.sizing=true;
  this.startX=!config.browser.isIE?ev.pageX:(ev.clientX+findScrollX());
  this.startY=!config.browser.isIE?ev.pageY:(ev.clientY+findScrollY());
  this.startW=this.offsetWidth;
  this.startH=this.offsetHeight;
  return false;
 };
 e.onmousemove=function(ev) { var ev=ev||window.event;
  if (this.sizing) {
   var s=this.style;
   var currX=!config.browser.isIE?ev.pageX:(ev.clientX+findScrollX());
   var currY=!config.browser.isIE?ev.pageY:(ev.clientY+findScrollY());
   var newW=(currX-this.offsetLeft)/(this.startX-this.offsetLeft)*this.startW;
   var newH=(currY-this.offsetTop )/(this.startY-this.offsetTop )*this.startH;
   if (this.stretchW) s.width =Math.floor(Math.max(newW,this.minW))+'px';
   if (this.stretchH) s.height=Math.floor(Math.max(newH,this.minH))+'px';
   clearMessage(); displayMessage(this.statusMsg.format([s.width,s.height]));
  }
  return false;
 };
 e.onmouseup=function(ev) { var ev=ev||window.event;
  if (ev.shiftKey) { this.style.width=this.style.height=''; }
  if (ev.ctrlKey) { this.style.width=this.originalW; this.style.height=this.originalH; }
  this.sizing=false;
  clearMessage();
  return false;
 };
 e.onmouseout=function(ev) { var ev=ev||window.event;
  this.sizing=false;
  clearMessage();
  return false;
 };
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|!Code
*/
//{{{
version.extensions.InlineJavascriptPlugin= {major: 1, minor: 9, revision: 6, date: new Date(2010,12,15)};
config.formatters.push( {
 name: "inlineJavascript",
 match: "\\<script",
 lookahead: "\\<script(?: type=\\\"[^\\\"]*\\\")?(?: src=\\\"([^\\\"]*)\\\")?(?: label=\\\"([^\\\"]*)\\\")?(?: title=\\\"([^\\\"]*)\\\")?(?: key=\\\"([^\\\"]*)\\\")?( show)?\\>((?:.|\\n)*?)\\</script\\>",
 handler: function(w) {
  var lookaheadRegExp = new RegExp(this.lookahead,"mg");
  lookaheadRegExp.lastIndex = w.matchStart;
  var lookaheadMatch = lookaheadRegExp.exec(w.source)
  if(lookaheadMatch && lookaheadMatch.index == w.matchStart) {
   var src=lookaheadMatch[1];
   var label=lookaheadMatch[2];
   var tip=lookaheadMatch[3];
   var key=lookaheadMatch[4];
   var show=lookaheadMatch[5];
   var code=lookaheadMatch[6];
   if (src) { // external script library
    var script = document.createElement("script"); script.src = src;
    document.body.appendChild(script); document.body.removeChild(script);
   }
   if (code) { // inline code
    if (show) // display source in tiddler
     wikify("{{{\n"+lookaheadMatch[0]+"\n}}}\n",w.output);
    if (label) { // create 'onclick' command link
     var link=createTiddlyElement(w.output,"a",null,"tiddlyLinkExisting",wikifyPlainText(label));
     var fixup=code.replace(/document.write\s*\(/gi,'place.bufferedHTML+=(');
     link.code="function _out(place,tiddler){"+fixup+"\n};_out(this,this.tiddler);"
     link.tiddler=w.tiddler;
     link.onclick=function(){
      this.bufferedHTML="";
      try{ var r=eval(this.code);
       if(this.bufferedHTML.length || (typeof(r)==="string")&&r.length)
        var s=this.parentNode.insertBefore(document.createElement("span"),this.nextSibling);
       if(this.bufferedHTML.length)
        s.innerHTML=this.bufferedHTML;
       if((typeof(r)==="string")&&r.length) {
        wikify(r,s,null,this.tiddler);
        return false;
       } else return r!==undefined?r:false;
      } catch(e){alert(e.description||e.toString());return false;}
     };
     link.setAttribute("title",tip||"");
     var URIcode='javascript:void(eval(decodeURIComponent(%22(function(){try{';
     URIcode+=encodeURIComponent(encodeURIComponent(code.replace(/\n/g,' ')));
     URIcode+='}catch(e){alert(e.description||e.toString())}})()%22)))';
     link.setAttribute("href",URIcode);
     link.style.cursor="pointer";
     if (key) link.accessKey=key.substr(0,1); // single character only
    }
    else { // run script immediately
     var fixup=code.replace(/document.write\s*\(/gi,'place.innerHTML+=(');
     var c="function _out(place,tiddler){"+fixup+"\n};_out(w.output,w.tiddler);";
     try  { var out=eval(c); }
     catch(e) { out=e.description?e.description:e.toString(); }
     if (out && out.length) wikify(out,w.output,w.highlightRegExp,w.tiddler);
    }
   }
   w.nextMatch = lookaheadMatch.index + lookaheadMatch[0].length;
  }
 }
} )
//}}}
// // Backward-compatibility for TW2.1.x and earlier
//{{{
if (typeof(wikifyPlainText)=="undefined") window.wikifyPlainText=function(text,limit,tiddler) {
 if(limit > 0) text = text.substr(0,limit);
 var wikifier = new Wikifier(text,formatter,null,tiddler);
 return wikifier.wikifyPlain();
}
//}}}
// // GLOBAL FUNCTION: $(...) -- 'shorthand' convenience syntax for document.getElementById()
//{{{
if (typeof($)=='undefined') { function $(id) { return document.getElementById(id.replace(/^#/,'')); } }
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!Configuration
<<<
<<option chkFloatingSlidersAnimate>> allow floating sliders to animate when opening/closing
<<<
!Code
*/
//{{{
version.extensions.NestedSlidersPlugin= {major: 2, minor: 4, revision: 9, date: new Date(2008,11,15)};
// options for deferred rendering of sliders that are not initially displayed
if (config.options.chkFloatingSlidersAnimate===undefined)
 config.options.chkFloatingSlidersAnimate=false; // avoid clipping problems in IE
// default styles for 'floating' class
setStylesheet(".floatingPanel { position:absolute; z-index:10; padding:0.5em; margin:0em; \
 background-color:#eee; color:#000; border:1px solid #000; text-align:left; }","floatingPanelStylesheet");
// if removeCookie() function is not defined by TW core, define it here.
if (window.removeCookie===undefined) {
 window.removeCookie=function(name) {
  document.cookie = name+'=; expires=Thu, 01-Jan-1970 00:00:01 UTC; path=/;';
 }
}
config.formatters.push( {
 name: "nestedSliders",
 match: "\\n?\\+{3}",
 terminator: "\\s*\\={3}\\n?",
 lookahead: "\\n?\\+{3}(\\+)?(\\([^\\)]*\\))?(\\!*)?(\\^(?:[^\\^\\*\\@\\[\\>]*\\^)?)?(\\*)?(\\@)?(?:\\{\\{([\\w]+[\\s\\w]*)\\{)?(\\[[^\\]]*\\])?(\\[[^\\]]*\\])?(?:\\}{3})?(\\#[^:]*\\:)?(\\>)?(\\.\\.\\.)?\\s*",
 handler: function(w)
  {
   lookaheadRegExp = new RegExp(this.lookahead,"mg");
   lookaheadRegExp.lastIndex = w.matchStart;
   var lookaheadMatch = lookaheadRegExp.exec(w.source)
   if(lookaheadMatch && lookaheadMatch.index == w.matchStart)
   {
    var defopen=lookaheadMatch[1];
    var cookiename=lookaheadMatch[2];
    var header=lookaheadMatch[3];
    var panelwidth=lookaheadMatch[4];
    var transient=lookaheadMatch[5];
    var hover=lookaheadMatch[6];
    var buttonClass=lookaheadMatch[7];
    var label=lookaheadMatch[8];
    var openlabel=lookaheadMatch[9];
    var panelID=lookaheadMatch[10];
    var blockquote=lookaheadMatch[11];
    var deferred=lookaheadMatch[12];
    // location for rendering button and panel
    var place=w.output;
    // default to closed, no cookie, no accesskey, no alternate text/tip
    var show="none"; var cookie=""; var key="";
    var closedtext=">"; var closedtip="";
    var openedtext="<"; var openedtip="";
    // extra "+", default to open
    if (defopen) show="block";
    // cookie, use saved open/closed state
    if (cookiename) {
     cookie=cookiename.trim().slice(1,-1);
     cookie="chkSlider"+cookie;
     if (config.options[cookie]==undefined)
      { config.options[cookie] = (show=="block") }
     show=config.options[cookie]?"block":"none";
    }
    // parse label/tooltip/accesskey: [label=X|tooltip]
    if (label) {
     var parts=label.trim().slice(1,-1).split("|");
     closedtext=parts.shift();
     if (closedtext.substr(closedtext.length-2,1)=="=")
      { key=closedtext.substr(closedtext.length-1,1); closedtext=closedtext.slice(0,-2); }
     openedtext=closedtext;
     if (parts.length) closedtip=openedtip=parts.join("|");
     else { closedtip="afficher "+closedtext; openedtip="masquer "+closedtext; }
    }
    // parse alternate label/tooltip: [label|tooltip]
    if (openlabel) {
     var parts=openlabel.trim().slice(1,-1).split("|");
     openedtext=parts.shift();
     if (parts.length) openedtip=parts.join("|");
     else openedtip="hide "+openedtext;
    }
    var title=show=='block'?openedtext:closedtext;
    var tooltip=show=='block'?openedtip:closedtip;
    // create the button
    if (header) { // use "Hn" header format instead of button/link
     var lvl=(header.length>5)?5:header.length;
     var btn = createTiddlyElement(createTiddlyElement(place,"h"+lvl,null,null,null),"a",null,buttonClass,title);
     btn.onclick=onClickNestedSlider;
     btn.setAttribute("href","javascript:;");
     btn.setAttribute("title",tooltip);
    }
    else
     var btn = createTiddlyButton(place,title,tooltip,onClickNestedSlider,buttonClass);
    btn.innerHTML=title; // enables use of HTML entities in label
    // set extra button attributes
    btn.setAttribute("closedtext",closedtext);
    btn.setAttribute("closedtip",closedtip);
    btn.setAttribute("openedtext",openedtext);
    btn.setAttribute("openedtip",openedtip);
    btn.sliderCookie = cookie; // save the cookiename (if any) in the button object
    btn.defOpen=defopen!=null; // save default open/closed state (boolean)
    btn.keyparam=key; // save the access key letter ("" if none)
    if (key.length) {
     btn.setAttribute("accessKey",key); // init access key
     btn.onfocus=function(){this.setAttribute("accessKey",this.keyparam);}; // **reclaim** access key on focus
    }
    btn.setAttribute("hover",hover?"true":"false");
    btn.onmouseover=function(ev) {
     // optional 'open on hover' handling
     if (this.getAttribute("hover")=="true" && this.sliderPanel.style.display=='none') {
      document.onclick.call(document,ev); // close transients
      onClickNestedSlider(ev); // open this slider
     }
     // mouseover on button aligns floater position with button
     if (window.adjustSliderPos) window.adjustSliderPos(this.parentNode,this,this.sliderPanel);
    }
    // create slider panel
    var panelClass=panelwidth?"floatingPanel":"sliderPanel";
    if (panelID) panelID=panelID.slice(1,-1); // trim off delimiters
    var panel=createTiddlyElement(place,"div",panelID,panelClass,null);
    panel.button = btn; // so the slider panel know which button it belongs to
    btn.sliderPanel=panel; // so the button knows which slider panel it belongs to
    panel.defaultPanelWidth=(panelwidth && panelwidth.length>2)?panelwidth.slice(1,-1):"";
    panel.setAttribute("transient",transient=="*"?"true":"false");
    panel.style.display = show;
    panel.style.width=panel.defaultPanelWidth;
    panel.onmouseover=function(event) // mouseover on panel aligns floater position with button
     { if (window.adjustSliderPos) window.adjustSliderPos(this.parentNode,this.button,this); }
    // render slider (or defer until shown)
    w.nextMatch = lookaheadMatch.index + lookaheadMatch[0].length;
    if ((show=="block")||!deferred) {
     // render now if panel is supposed to be shown or NOT deferred rendering
     w.subWikify(blockquote?createTiddlyElement(panel,"blockquote"):panel,this.terminator);
     // align floater position with button
     if (window.adjustSliderPos) window.adjustSliderPos(place,btn,panel);
    }
    else {
     var src = w.source.substr(w.nextMatch);
     var endpos=findMatchingDelimiter(src,"+++","===");
     panel.setAttribute("raw",src.substr(0,endpos));
     panel.setAttribute("blockquote",blockquote?"true":"false");
     panel.setAttribute("rendered","false");
     w.nextMatch += endpos+3;
     if (w.source.substr(w.nextMatch,1)=="\n") w.nextMatch++;
    }
   }
  }
 }
)
function findMatchingDelimiter(src,starttext,endtext) {
 var startpos = 0;
 var endpos = src.indexOf(endtext);
 // check for nested delimiters
 while (src.substring(startpos,endpos-1).indexOf(starttext)!=-1) {
  // count number of nested 'starts'
  var startcount=0;
  var temp = src.substring(startpos,endpos-1);
  var pos=temp.indexOf(starttext);
  while (pos!=-1) { startcount++; pos=temp.indexOf(starttext,pos+starttext.length); }
  // set up to check for additional 'starts' after adjusting endpos
  startpos=endpos+endtext.length;
  // find endpos for corresponding number of matching 'ends'
  while (startcount && endpos!=-1) {
   endpos = src.indexOf(endtext,endpos+endtext.length);
   startcount--;
  }
 }
 return (endpos==-1)?src.length:endpos;
}
//}}}
//{{{
window.onClickNestedSlider=function(e)
{
 if (!e) var e = window.event;
 var theTarget = resolveTarget(e);
 while (theTarget && theTarget.sliderPanel==undefined) theTarget=theTarget.parentNode;
 if (!theTarget) return false;
 var theSlider = theTarget.sliderPanel;
 var isOpen = theSlider.style.display!="none";
 // if SHIFT-CLICK, dock panel first (see [[MoveablePanelPlugin]])
 if (e.shiftKey && config.macros.moveablePanel) config.macros.moveablePanel.dock(theSlider,e);
 // toggle label
 theTarget.innerHTML=isOpen?theTarget.getAttribute("closedText"):theTarget.getAttribute("openedText");
 // toggle tooltip
 theTarget.setAttribute("title",isOpen?theTarget.getAttribute("closedTip"):theTarget.getAttribute("openedTip"));
 // deferred rendering (if needed)
 if (theSlider.getAttribute("rendered")=="false") {
  var place=theSlider;
  if (theSlider.getAttribute("blockquote")=="true")
   place=createTiddlyElement(place,"blockquote");
  wikify(theSlider.getAttribute("raw"),place);
  theSlider.setAttribute("rendered","true");
 }
 // show/hide the slider
 if(config.options.chkAnimate && (!hasClass(theSlider,'floatingPanel') || config.options.chkFloatingSlidersAnimate))
  anim.startAnimating(new Slider(theSlider,!isOpen,e.shiftKey || e.altKey,"none"));
 else
  theSlider.style.display = isOpen ? "none" : "block";
 // reset to default width (might have been changed via plugin code)
 theSlider.style.width=theSlider.defaultPanelWidth;
 // align floater panel position with target button
 if (!isOpen && window.adjustSliderPos) window.adjustSliderPos(theSlider.parentNode,theTarget,theSlider);
 // if showing panel, set focus to first 'focus-able' element in panel
 if (theSlider.style.display!="none") {
  var ctrls=theSlider.getElementsByTagName("*");
  for (var c=0; c<ctrls.length; c++) {
   var t=ctrls[c].tagName.toLowerCase();
   if ((t=="input" && ctrls[c].type!="hidden") || t=="textarea" || t=="select")
    { try{ ctrls[c].focus(); } catch(err){;} break; }
  }
 }
 var cookie=theTarget.sliderCookie;
 if (cookie && cookie.length) {
  config.options[cookie]=!isOpen;
  if (config.options[cookie]!=theTarget.defOpen) window.saveOptionCookie(cookie);
  else window.removeCookie(cookie); // remove cookie if slider is in default display state
 }
 // prevent SHIFT-CLICK from being processed by browser (opens blank window... yuck!)
 // prevent clicks *within* a slider button from being processed by browser
 // but allow plain click to bubble up to page background (to close transients, if any)
 if (e.shiftKey || theTarget!=resolveTarget(e))
  { e.cancelBubble=true; if (e.stopPropagation) e.stopPropagation(); }
 Popup.remove(); // close open popup (if any)
 return false;
}
//}}}
//{{{
// click in document background closes transient panels
document.nestedSliders_savedOnClick=document.onclick;
document.onclick=function(ev) { if (!ev) var ev=window.event; var target=resolveTarget(ev);
 if (document.nestedSliders_savedOnClick)
  var retval=document.nestedSliders_savedOnClick.apply(this,arguments);
 // if click was inside a popup... leave transient panels alone
 var p=target; while (p) if (hasClass(p,"popup")) break; else p=p.parentNode;
 if (p) return retval;
 // if click was inside transient panel (or something contained by a transient panel), leave it alone
 var p=target; while (p) {
  if ((hasClass(p,"floatingPanel")||hasClass(p,"sliderPanel"))&&p.getAttribute("transient")=="true") break;
  p=p.parentNode;
 }
 if (p) return retval;
 // otherwise, find and close all transient panels...
 var all=document.all?document.all:document.getElementsByTagName("DIV");
 for (var i=0; i<all.length; i++) {
   // if it is not a transient panel, or the click was on the button that opened this panel, don't close it.
  if (all[i].getAttribute("transient")!="true" || all[i].button==target) continue;
  // otherwise, if the panel is currently visible, close it by clicking it's button
  if (all[i].style.display!="none") window.onClickNestedSlider({target:all[i].button})
  if (!hasClass(all[i],"floatingPanel")&&!hasClass(all[i],"sliderPanel")) all[i].style.display="none";
 }
 return retval;
};
//}}}
//{{{
// adjust floating panel position based on button position
if (window.adjustSliderPos==undefined) window.adjustSliderPos=function(place,btn,panel) {
 if (hasClass(panel,"floatingPanel") && !hasClass(panel,"undocked")) {
  // see [[MoveablePanelPlugin]] for use of 'undocked'
  var rightEdge=document.body.offsetWidth-1;
  var panelWidth=panel.offsetWidth;
  var left=0;
  var top=btn.offsetHeight;
  if (place.style.position=="relative" && findPosX(btn)+panelWidth>rightEdge) {
   left-=findPosX(btn)+panelWidth-rightEdge; // shift panel relative to button
   if (findPosX(btn)+left<0) left=-findPosX(btn); // stay within left edge
  }
  if (place.style.position!="relative") {
   var left=findPosX(btn);
   var top=findPosY(btn)+btn.offsetHeight;
   var p=place; while (p && !hasClass(p,'floatingPanel')) p=p.parentNode;
   if (p) { left-=findPosX(p); top-=findPosY(p); }
   if (left+panelWidth>rightEdge) left=rightEdge-panelWidth;
   if (left<0) left=0;
  }
  panel.style.left=left+"px"; panel.style.top=top+"px";
 }
}
//}}}
//{{{
// TW2.1 and earlier:
// hijack Slider stop handler so overflow is visible after animation has completed
Slider.prototype.coreStop = Slider.prototype.stop;
Slider.prototype.stop = function()
 { this.coreStop.apply(this,arguments); this.element.style.overflow = "visible"; }
// TW2.2+
// hijack Morpher stop handler so sliderPanel/floatingPanel overflow is visible after animation has completed
if (version.major+.1*version.minor+.01*version.revision>=2.2) {
 Morpher.prototype.coreStop = Morpher.prototype.stop;
 Morpher.prototype.stop = function() {
  this.coreStop.apply(this,arguments);
  var e=this.element;
  if (hasClass(e,"sliderPanel")||hasClass(e,"floatingPanel")) {
   // adjust panel overflow and position after animation
   e.style.overflow = "visible";
   if (window.adjustSliderPos) window.adjustSliderPos(e.parentNode,e.button,e);
  }
 };
}
//}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
*/
//{{{
version.extensions.QuoteOfTheDayPlugin= {major: 1, minor: 4, revision: 1, date: new Date(2008,3,21)};
config.macros.QOTD = {
 clickTooltip: "click to view another item",
 timerTooltip: "auto-timer stopped... 'mouseout' to restart timer",
 timerClickTooltip: "auto-timer stopped... click to view another item, or 'mouseout' to restart timer",
 handler:
 function(place,macroName,params) {
 var tid=params.shift(); // source tiddler containing HR-separated quotes
 var p=params.shift();
 var click=true; // allow click for next item
 var inline=false; // wrap in slider for animation effect
 var random=true; // pick an item at random (default for "quote of the day" usage)
 var folder=false; // use local filesystem folder list
 var cookie=""; // default to no cookie
 var next=0; // default to first item (or random item)
 while (p) {
 if (p.toLowerCase()=="noclick") var click=false;
 if (p.toLowerCase()=="inline") var inline=true;
 if (p.toLowerCase()=="norandom") var random=false;
 if (p.toLowerCase().substr(0,7)=="cookie:") var cookie=p.substr(8);
 if (!isNaN(p)) var delay=p;
 p=params.shift();
 }
 if ((click||delay) && !inline) {
 var panel = createTiddlyElement(null,"div",null,"sliderPanel");
 panel.style.display="none";
 place.appendChild(panel);
 var here=createTiddlyElement(panel,click?"a":"span",null,"QOTD");
 }
 else
 var here=createTiddlyElement(place,click?"a":"span",null,"QOTD");
 here.id=(new Date()).convertToYYYYMMDDHHMMSSMMM()+Math.random().toString(); // unique ID
 // get items from tiddler or file list
 var list=store.getTiddlerText(tid,"");
 if (!list||!list.length) { // not a tiddler... maybe an image directory?
 var list=this.getImageFileList(tid);
 if (!list.length) { // maybe relative path... fixup and try again
 var h=document.location.href;
 var p=getLocalPath(decodeURIComponent(h.substr(0,h.lastIndexOf("/")+1)));
 var list=this.getImageFileList(p+tid);
 }
 }
 if (!list||!list.length) return false; // no contents... nothing to display!
 here.setAttribute("list",list);
 if (delay) here.setAttribute("delay",delay);
 here.setAttribute("random",random);
 here.setAttribute("cookie",cookie);
 if (click) {
 here.title=this.clickTooltip
 if (!inline) here.style.display="block";
 here.setAttribute("href","javascript:;");
 here.onclick=function(event)
 { config.macros.QOTD.showNextItem(this); }
 }
 if (config.options["txtQOTD_"+cookie]!=undefined) next=parseInt(config.options["txtQOTD_"+cookie]);
 here.setAttribute("nextItem",next);
 config.macros.QOTD.showNextItem(here);
 if (delay) {
 here.title=click?this.timerClickTooltip:this.timerTooltip
 here.onmouseover=function(event)
 { clearTimeout(this.ticker); };
 here.onmouseout=function(event)
 { this.ticker=setTimeout("config.macros.QOTD.tick('"+this.id+"')",this.getAttribute("delay")); };
 here.ticker=setTimeout("config.macros.QOTD.tick('"+here.id+"')",delay);
 }
 },
 tick: function(id) {
 var here=document.getElementById(id); if (!here) return;
 config.macros.QOTD.showNextItem(here);
 here.ticker=setTimeout("config.macros.QOTD.tick('"+id+"')",here.getAttribute("delay"));
 },
 showNextItem:
 function (here) {
 // hide containing slider panel (if any)
 var p=here.parentNode;
 if (p.className=="sliderPanel") p.style.display = "none"
 // get a new quote
 var index=here.getAttribute("nextItem");
 var items=here.getAttribute("list").split("\n----\n");
 if (index<0||index>=items.length) index=0;
 if (here.getAttribute("random")=="true") index=Math.floor(Math.random()*items.length);
 var txt=items[index];
 // re-render quote display element, and advance index counter
 removeChildren(here); wikify(txt,here);
 index++; here.setAttribute("nextItem",index);
 var cookie=here.getAttribute("cookie");
 if (cookie.length) {
 config.options["txtQOTD_"+cookie]=index.toString();
 saveOptionCookie("txtQOTD_"+cookie);
 }
 // redisplay slider panel (if any)
 if (p.className=="sliderPanel") {
 if(anim && config.options.chkAnimate)
 anim.startAnimating(new Slider(p,true,false,"none"));
 else p.style.display="block";
 }
 },
 getImageFileList: function(cwd) { // returns HR-separated list of image files
 function isImage(fn) {
 var ext=fn.substr(fn.length-3,3).toLowerCase();
 return ext=="jpg"||ext=="gif"||ext=="png";
 }
 var files=[];
 if (config.browser.isIE) {
 cwd=cwd.replace(/\//g,"\\");
 // IE uses ActiveX to read filesystem info
 var fso = new ActiveXObject("Scripting.FileSystemObject");
 if(!fso.FolderExists(cwd)) return [];
 var dir=fso.GetFolder(cwd);
 for(var f=new Enumerator(dir.Files); !f.atEnd(); f.moveNext())
 if (isImage(f.item().path)) files.push("[img[%0]]".format(["file:///"+f.item().path.replace(/\\/g,"/")]));
 } else {
 // FireFox (mozilla) uses "components" to read filesystem info
 // get security access
 if(!window.Components) return;
 try { netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); }
 catch(e) { alert(e.description?e.description:e.toString()); return []; }
 // open/validate directory
 var file=Components.classes["@mozilla.org/file/local;1"].createInstance(Components.interfaces.nsILocalFile);
 try { file.initWithPath(cwd); } catch(e) { return []; }
 if (!file.exists() || !file.isDirectory()) { return []; }
 var folder=file.directoryEntries;
 while (folder.hasMoreElements()) {
 var f=folder.getNext().QueryInterface(Components.interfaces.nsILocalFile);
 if (f instanceof Components.interfaces.nsILocalFile)
 if (isImage(f.path)) files.push("[img[%0]]".format(["file:///"+f.path.replace(/\\/g,"/")]));
 }
 }
 return files.join("\n----\n");
 }
}
//}}}
/% |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
!end
!show
<<tiddler {{
 var here=story.findContainingTiddler(place); if (here) {
  var nodes=here.getElementsByTagName("*");
  for (var i=0; i<nodes.length; i++) if (hasClass(nodes[i],"title"))
   { removeChildren(nodes[i]); wikify("$1",nodes[i]); break; }
 }
'';}}>>
!end
%/<<tiddler {{'.ReplaceTiddlerTitle##'+('$1'=='$'+'1'?'info':'show')}} with: [[$1]]>>
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements|
*/
//{{{
version.extensions.SinglePageModePlugin= {major: 2, minor: 9, revision: 7, date: new Date(2010,11,30)};
//}}}
//{{{
config.paramifiers.SPM = { onstart: function(v) {
 config.options.chkSinglePageMode=eval(v);
 if (config.options.chkSinglePageMode && config.options.chkSinglePagePermalink && !config.browser.isSafari) {
 config.lastURL = window.location.hash;
 if (!config.SPMTimer) config.SPMTimer=window.setInterval(function() {checkLastURL();},1000);
 }
} };
//}}}
//{{{
if (config.options.chkSinglePageMode==undefined)
 config.options.chkSinglePageMode=false;
if (config.options.chkSinglePagePermalink==undefined)
 config.options.chkSinglePagePermalink=true;
if (config.options.chkSinglePageKeepFoldedTiddlers==undefined)
 config.options.chkSinglePageKeepFoldedTiddlers=false;
if (config.options.chkSinglePageKeepEditedTiddlers==undefined)
 config.options.chkSinglePageKeepEditedTiddlers=false;
if (config.options.chkTopOfPageMode==undefined)
 config.options.chkTopOfPageMode=false;
if (config.options.chkBottomOfPageMode==undefined)
 config.options.chkBottomOfPageMode=false;
if (config.options.chkSinglePageAutoScroll==undefined)
 config.options.chkSinglePageAutoScroll=false;
//}}}
//{{{
config.SPMTimer = 0;
config.lastURL = window.location.hash;
function checkLastURL()
{
 if (!config.options.chkSinglePageMode)
 { window.clearInterval(config.SPMTimer); config.SPMTimer=0; return; }
 if (config.lastURL == window.location.hash) return; // no change in hash
 var tids=decodeURIComponent(window.location.hash.substr(1)).readBracketedList();
 if (tids.length==1) // permalink (single tiddler in URL)
 story.displayTiddler(null,tids[0]);
 else { // restore permaview or default view
 config.lastURL = window.location.hash;
 if (!tids.length) tids=store.getTiddlerText("DefaultTiddlers").readBracketedList();
 story.closeAllTiddlers();
 story.displayTiddlers(null,tids);
 }
}
if (Story.prototype.SPM_coreDisplayTiddler==undefined)
 Story.prototype.SPM_coreDisplayTiddler=Story.prototype.displayTiddler;
Story.prototype.displayTiddler = function(srcElement,tiddler,template,animate,slowly)
{
 var title=(tiddler instanceof Tiddler)?tiddler.title:tiddler;
 var tiddlerElem=story.getTiddler(title); // ==null unless tiddler is already displayed
 var opt=config.options;
 var single=opt.chkSinglePageMode && !startingUp;
 var top=opt.chkTopOfPageMode && !startingUp;
 var bottom=opt.chkBottomOfPageMode && !startingUp;
 if (single) {
 story.forEachTiddler(function(tid,elem) {
 // skip current tiddler and, optionally, tiddlers that are folded.
 if ( tid==title
 || (opt.chkSinglePageKeepFoldedTiddlers && elem.getAttribute("folded")=="true"))
 return;
 // if a tiddler is being edited, ask before closing
 if (elem.getAttribute("dirty")=="true") {
 if (opt.chkSinglePageKeepEditedTiddlers) return;
 // if tiddler to be displayed is already shown, then leave active tiddler editor as is
 // (occurs when switching between view and edit modes)
 if (tiddlerElem) return;
 // otherwise, ask for permission
 var msg="'"+tid+"' is currently being edited.\n\n";
 msg+="Press OK to save and close this tiddler\nor press Cancel to leave it opened";
 if (!confirm(msg)) return; else story.saveTiddler(tid);
 }
 story.closeTiddler(tid);
 });
 }
 else if (top)
 arguments[0]=null;
 else if (bottom)
 arguments[0]="bottom";
 if (single && opt.chkSinglePagePermalink && !config.browser.isSafari) {
 window.location.hash = encodeURIComponent(String.encodeTiddlyLink(title));
 config.lastURL = window.location.hash;
 document.title = wikifyPlain("SiteTitle") + " - " + title;
 if (!config.SPMTimer) config.SPMTimer=window.setInterval(function() {checkLastURL();},1000);
 }
 if (tiddlerElem && tiddlerElem.getAttribute("dirty")=="true") { // editing... move tiddler without re-rendering
 var isTopTiddler=(tiddlerElem.previousSibling==null);
 if (!isTopTiddler && (single || top))
 tiddlerElem.parentNode.insertBefore(tiddlerElem,tiddlerElem.parentNode.firstChild);
 else if (bottom)
 tiddlerElem.parentNode.insertBefore(tiddlerElem,null);
 else this.SPM_coreDisplayTiddler.apply(this,arguments); // let CORE render tiddler
 } else
 this.SPM_coreDisplayTiddler.apply(this,arguments); // let CORE render tiddler
 var tiddlerElem=story.getTiddler(title);
 if (tiddlerElem&&opt.chkSinglePageAutoScroll) {
 // scroll to top of page or top of tiddler
 var isTopTiddler=(tiddlerElem.previousSibling==null);
 var yPos=isTopTiddler?0:ensureVisible(tiddlerElem);
 // if animating, defer scroll until after animation completes
 var delay=opt.chkAnimate?config.animDuration+10:0;
 setTimeout("window.scrollTo(0,"+yPos+")",delay);
 }
}
if (Story.prototype.SPM_coreDisplayTiddlers==undefined)
 Story.prototype.SPM_coreDisplayTiddlers=Story.prototype.displayTiddlers;
Story.prototype.displayTiddlers = function() {
 // suspend single/top/bottom modes when showing multiple tiddlers
 var opt=config.options;
 var saveSPM=opt.chkSinglePageMode; opt.chkSinglePageMode=false;
 var saveTPM=opt.chkTopOfPageMode; opt.chkTopOfPageMode=false;
 var saveBPM=opt.chkBottomOfPageMode; opt.chkBottomOfPageMode=false;
 this.SPM_coreDisplayTiddlers.apply(this,arguments);
 opt.chkBottomOfPageMode=saveBPM;
 opt.chkTopOfPageMode=saveTPM;
 opt.chkSinglePageMode=saveSPM;
}
//}}}
/* |Author|SaqImtiaz|Version|2.02.2008.01.25|License|[[Creative Commons Attribution-ShareAlike 3.0 License|http://creativecommons.org/licenses/by-sa/3.0/]]| */
{{{
//!BEGIN-PLUGIN-CODE
config.tableSorting = {
 darrow: "\u2193",
 uarrow: "\u2191",
 getText : function (o) {
  var p = o.cells[SORT_INDEX];
  return p.innerText || p.textContent || '';
 },
 sortTable : function (o,rev) {
  SORT_INDEX = o.getAttribute("index");
  var c = config.tableSorting;
  var T = findRelated(o.parentNode,"TABLE");
  if(T.tBodies[0].rows.length<=1)
   return;
  var itm = "";
  var i = 0;
  while (itm == "" && i < T.tBodies[0].rows.length) {
   itm = c.getText(T.tBodies[0].rows[i]).trim();
   i++;
  }
  if (itm == "")
   return;
  var r = [];
  var S = o.getElementsByTagName("span")[0];
  c.fn = c.sortAlpha;
  if(!isNaN(Date.parse(itm)))
   c.fn = c.sortDate;
  else if(itm.match(/^[$|£|€|\+|\-]{0,1}\d*\.{0,1}\d+$/))
   c.fn = c.sortNumber;
  else if(itm.match(/^\d*\.{0,1}\d+[K|M|G]{0,1}b$/))
   c.fn = c.sortFile;
  for(i=0; i<T.tBodies[0].rows.length; i++) {
    r[i]=T.tBodies[0].rows[i];
  }
  r.sort(c.reSort);
  if(S.firstChild.nodeValue==c.darrow || rev) {
   r.reverse();
   S.firstChild.nodeValue=c.uarrow;
  }
  else
   S.firstChild.nodeValue=c.darrow;
  var thead = T.getElementsByTagName('thead')[0];
  var headers = thead.rows[thead.rows.length-1].cells;
  for(var k=0; k<headers.length; k++) {
   if(!hasClass(headers[k],"nosort"))
    addClass(headers[k].getElementsByTagName("span")[0],"hidden");
  }
  removeClass(S,"hidden");
  for(i=0; i<r.length; i++) {
   T.tBodies[0].appendChild(r[i]);
   c.stripe(r[i],i);
   for(var j=0; j<r[i].cells.length;j++){
    removeClass(r[i].cells[j],"sortedCol");
   }
   addClass(r[i].cells[SORT_INDEX],"sortedCol");
  }
 },
 stripe : function (e,i){
  var cl = ["oddRow","evenRow"];
  i&1? cl.reverse() : cl;
  removeClass(e,cl[1]);
  addClass(e,cl[0]);
 },
 sortNumber : function(v) {
  var x = parseFloat(this.getText(v).replace(/[^0-9.-]/g,''));
  return isNaN(x)? 0: x;
 },
 sortDate : function(v) {
  return Date.parse(this.getText(v));
 },
 sortAlpha : function(v) {
  return this.getText(v).toLowerCase();
 },
 sortFile : function(v) {
  var j, q = config.messages.sizeTemplates, s = this.getText(v);
  for (var i=0; i<q.length; i++) {
   if ((j = s.toLowerCase().indexOf(q[i].template.replace("%0\u00a0","").toLowerCase())) != -1)
    return q[i].unit * s.substr(0,j);
  }
  return parseFloat(s);
 },
 reSort : function(a,b){
  var c = config.tableSorting;
  var aa = c.fn(a);
  var bb = c.fn(b);
  return ((aa==bb)? 0 : ((aa<bb)? -1:1));
 }
};
Story.prototype.tSort_refreshTiddler = Story.prototype.refreshTiddler;
Story.prototype.refreshTiddler = function(title,template,force,customFields,defaultText){
 var elem = this.tSort_refreshTiddler.apply(this,arguments);
 if(elem){
  var tables = elem.getElementsByTagName("TABLE");
  var c = config.tableSorting;
  for(var i=0; i<tables.length; i++){
   if(hasClass(tables[i],"sortable")){
    var x = null, rev, table = tables[i], thead = table.getElementsByTagName('thead')[0], headers = thead.rows[thead.rows.length-1].cells;
    for (var j=0; j<headers.length; j++){
     var h = headers[j];
     if (hasClass(h,"nosort"))
      continue;
     h.setAttribute("index",j);
     h.onclick = function(){c.sortTable(this); return false;};
     h.ondblclick = stopEvent;
     if(h.getElementsByTagName("span").length == 0)
      createTiddlyElement(h,"span",null,"hidden",c.uarrow);
     if(!x && hasClass(h,"autosort")) {
      x = j;
      rev = hasClass(h,"reverse");
     }
    }
    if(x)
     c.sortTable(headers[x],rev);
   }
  }
 }
 return elem;
};
setStylesheet("table.sortable span.hidden {visibility:hidden;}\n"+
 "table.sortable thead {cursor:pointer;}\n"+
 "table.sortable .nosort {cursor:default;}\n"+
 "table.sortable td.sortedCol {background:#ffc;}","TableSortingPluginStyles");
function stopEvent(e){
 var ev = e? e : window.event;
 ev.cancelBubble = true;
 if (ev.stopPropagation) ev.stopPropagation();
 return false;
}
config.macros.nosort={
 handler : function(place){
  addClass(place,"nosort");
 }
};
config.macros.autosort={
 handler : function(place,m,p,w,pS){
  addClass(place,"autosort"+" "+pS);
 }
};
}}}
/* |Author|Eric Shulman|License|http://www.TiddlyTools.com/#LegalStatements| */
//{{{
version.extensions.WikifyPlugin= {major: 1, minor: 1, revision: 4, date: new Date(2009,3,29)};
config.macros.wikify={
 handler: function(place,macroName,params,wikifier,paramString,tiddler) {
  var fmt=params.shift();
  var values=[];
  var out="";
  if (!fmt.match(/\%[0-9]/g) && params.length) // format has no markers, just join all params with spaces
   out=fmt+" "+params.join(" ");
  else { // format param has markers, get values and perform substitution
   while (p=params.shift()) values.push(this.getFieldReference(place,p));
   out=fmt.format(values);
  }
  if (macroName=="wikiCalc") out=eval(out).toString();
  wikify(out.unescapeLineBreaks(),place,null,tiddler);
 },
 getFieldReference: function(place,p) { // "slicename::tiddlername" or "fieldname@tiddlername" or "fieldname"
  if (typeof p != "string") return p; // literal non-string value... just return it...
  var parts=p.split(config.textPrimitives.sliceSeparator);
  if (parts.length==2) {// maybe a slice reference?
   var tid=parts[0]; var slice=parts[1];
   if (!tid || !tid.length || tid=="here") { // no target (or "here"), use containing tiddler
    tid=story.findContainingTiddler(place);
    if (tid) tid=tid.getAttribute("tiddler")
    else tid="SiteSlices"; // fallback for 'non-tiddler' areas (e.g, header, sidebar, etc.)
   }
   var val=store.getTiddlerSlice(tid,slice); // get tiddler slice value
  }
  if (val==undefined) {// not a slice, or slice not found, maybe a field reference?
   var parts=p.split("@");
   var field=parts[0];
   if (!field || !field.length) field="checked"; // missing fieldname, fallback: checked@tiddlername
   var tid=parts[1];
   if (!tid || !tid.length || tid=="here") { // no target (or "here"), use containing tiddler
    tid=story.findContainingTiddler(place);
    if (tid) tid=tid.getAttribute("tiddler")
    else tid="SiteFields"; // fallback for 'non-tiddler' areas (e.g, header, sidebar, etc.)
   }
   var val=store.getValue(tid,field);
  }
  // not a slice or field, or slice/field not found... return value unchanged
  return val===undefined?p:val;
 }
}
//}}}
//{{{
// define alternative macroName for triggering pre-rendering call to eval()
config.macros.wikiCalc=config.macros.wikify;
//}}}
<!--{{{-->
<span class='yourSearchNumber' macro='foundTiddler number'></span>
<span class='yourSearchTitle' macro='foundTiddler title text 100'/></span> —
<span class='yourSearchTags' macro='foundTiddler field tags 0'/></span>
<!--}}}-->
/* |YourSearchPlugin v2.1.6 (2012-04-19)|http://tiddlywiki.abego-software.de/#YourSearchPlugin|https://github.com/abego/YourSearchPlugin|
|Author|UdoBorkowski (ub [at] abego-software [dot] de)|[[BSD open source license|http://www.abego-software.de/legal/apl-v10.html]]| */
///%
if(!version.extensions.YourSearchPlugin){version.extensions.YourSearchPlugin={major:2,minor:1,revision:6,source:"http://tiddlywiki.abego-software.de/#YourSearchPlugin",licence:"[[BSD open source license (abego Software)|http://www.abego-software.de/legal/apl-v10.html]]",copyright:"Copyright (c) abego Software GmbH, 2005-2012 (www.abego-software.de)"};if(!window.abego){window.abego={}}if(!Array.forEach){Array.forEach=function(c,e,d){for(var b=0,a=c.length;b<a;b++){e.call(d,c[b],b,c)}};Array.prototype.forEach=function(d,c){for(var b=0,a=this.length;b<a;b++){d.call(c,this[b],b,this)}}}abego.toInt=function(b,a){if(!b){return a}var c=parseInt(b);return(c==NaN)?a:c};abego.createEllipsis=function(a){var b=createTiddlyElement(a,"span");b.innerHTML="&hellip;"};abego.shallowCopy=function(b){if(!b){return b}var a={};for(var c in b){a[c]=b[c]}return a};abego.copyOptions=function(a){return !a?{}:abego.shallowCopy(a)};abego.countStrings=function(d,c){if(!c){return 0}var a=c.length;var f=0;var e=0;while(true){var b=d.indexOf(c,e);if(b<0){return f}f++;e=b+a}return f};abego.getBracedText=function(j,e,a){if(!e){e=0}var k=/\{([^\}]*)\}/gm;k.lastIndex=e;var d=k.exec(j);if(d){var l=d[1];var b=abego.countStrings(l,"{");if(!b){if(a){a.lastIndex=k.lastIndex}return l}var g=j.length;for(var f=k.lastIndex;f<g&&b;f++){var h=j.charAt(f);if(h=="{"){b++}else{if(h=="}"){b--}}}if(!b){if(a){a.lastIndex=f-1}return j.substring(d.index+1,f-1)}}};abego.select=function(d,c,b,a){if(!a){a=[]}d.forEach(function(e){if(c.call(b,e)){a.push(e)}});return a};abego.consumeEvent=function(a){if(a.stopPropagation){a.stopPropagation()}if(a.preventDefault){a.preventDefault()}a.cancelBubble=true;a.returnValue=true};abego.TiddlerFilterTerm=function(d,b){if(!b){b={}}var c=d;if(!b.textIsRegExp){c=d.escapeRegExp();if(b.fullWordMatch){c="\\b"+c+"\\b"}}var a=new RegExp(c,"m"+(b.caseSensitive?"":"i"));this.tester=new abego.MultiFieldRegExpTester(a,b.fields,b.withExtendedFields)};abego.TiddlerFilterTerm.prototype.test=function(a){return this.tester.test(a)};abego.parseNewTiddlerCommandLine=function(c){var a=/(.*?)\.(?:\s+|$)([^#]*)(#.*)?/.exec(c);if(!a){a=/([^#]*)()(#.*)?/.exec(c)}if(a){var d;if(a[3]){var b=a[3].replace(/#/g,"");d=b.parseParams("tag")}else{d=[[]]}var e=a[2]?a[2].trim():"";d.push({name:"text",value:e});d[0].text=[e];return{title:a[1].trim(),params:d}}else{return{title:c.trim(),params:[[]]}}};abego.parseTiddlerFilterTerm=function(queryText,offset,options){var re=/\s*(?:(?:\{([^\}]*)\})|(?:(=)|([#%!])|(?:(\w+)\s*\:(?!\/\/))|(?:(?:("(?:(?:\\")|[^"])+")|(?:\/((?:(?:\\\/)|[^\/])+)\/)|(\w+\:\/\/[^\s]+)|([^\s\)\-\"]+)))))/mg;var shortCuts={"!":"title","%":"text","#":"tags"};var fieldNames={};var fullWordMatch=false;re.lastIndex=offset;while(true){var i=re.lastIndex;var m=re.exec(queryText);if(!m||m.index!=i){throw"Word or String literal expected"}if(m[1]){var lastIndexRef={};var code=abego.getBracedText(queryText,0,lastIndexRef);if(!code){throw"Invalid {...} syntax"}var f=Function("tiddler","return ("+code+");");return{func:f,lastIndex:lastIndexRef.lastIndex,markRE:null}}if(m[2]){fullWordMatch=true}else{if(m[3]){fieldNames[shortCuts[m[3]]]=1}else{if(m[4]){fieldNames[m[4]]=1}else{var textIsRegExp=m[6];var text=m[5]?window.eval(m[5]):m[6]?m[6]:m[7]?m[7]:m[8];options=abego.copyOptions(options);options.fullWordMatch=fullWordMatch;options.textIsRegExp=textIsRegExp;var fields=[];for(var n in fieldNames){fields.push(n)}if(fields.length==0){options.fields=options.defaultFields}else{options.fields=fields;options.withExtendedFields=false}var term=new abego.TiddlerFilterTerm(text,options);var markREText=textIsRegExp?text:text.escapeRegExp();if(markREText&&fullWordMatch){markREText="\\b"+markREText+"\\b"}return{func:function(tiddler){return term.test(tiddler)},lastIndex:re.lastIndex,markRE:markREText?"(?:"+markREText+")":null}}}}}};abego.BoolExp=function(i,c,j){this.s=i;var h=j&&j.defaultOperationIs_OR;var e=/\s*\)/g;var f=/\s*(?:(and|\&\&)|(or|\|\|))/gi;var b=/\s*(\-|not)?(\s*\()?/gi;var a;var d=function(p){b.lastIndex=p;var l=b.exec(i);var o=false;var k=null;if(l&&l.index==p){p+=l[0].length;o=l[1];if(l[2]){var n=a(p);e.lastIndex=n.lastIndex;if(!e.exec(i)){throw"Missing ')'"}k={func:n.func,lastIndex:e.lastIndex,markRE:n.markRE}}}if(!k){k=c(i,p,j)}if(o){k.func=(function(m){return function(q){return !m(q)}})(k.func);k.markRE=null}return k};a=function(s){var n=d(s);while(true){var p=n.lastIndex;f.lastIndex=p;var k=f.exec(i);var o;var q;if(k&&k.index==p){o=!k[1];q=d(f.lastIndex)}else{try{q=d(p)}catch(r){return n}o=h}n.func=(function(t,m,l){return l?function(u){return t(u)||m(u)}:function(u){return t(u)&&m(u)}})(n.func,q.func,o);n.lastIndex=q.lastIndex;if(!n.markRE){n.markRE=q.markRE}else{if(q.markRE){n.markRE=n.markRE+"|"+q.markRE}}}};var g=a(0);this.evalFunc=g.func;if(g.markRE){this.markRegExp=new RegExp(g.markRE,j.caseSensitive?"mg":"img")}};abego.BoolExp.prototype.exec=function(){return this.evalFunc.apply(this,arguments)};abego.BoolExp.prototype.getMarkRegExp=function(){return this.markRegExp};abego.BoolExp.prototype.toString=function(){return this.s};abego.MultiFieldRegExpTester=function(b,a,c){this.re=b;this.fields=a?a:["title","text","tags"];this.withExtendedFields=c};abego.MultiFieldRegExpTester.prototype.test=function(b){var d=this.re;for(var a=0;a<this.fields.length;a++){var c=store.getValue(b,this.fields[a]);if(typeof c=="string"&&d.test(c)){return this.fields[a]}}if(this.withExtendedFields){return store.forEachField(b,function(e,g,f){return typeof f=="string"&&d.test(f)?g:null},true)}return null};abego.TiddlerQuery=function(b,a,d,c,e){if(d){this.regExp=new RegExp(b,a?"mg":"img");this.tester=new abego.MultiFieldRegExpTester(this.regExp,c,e)}else{this.expr=new abego.BoolExp(b,abego.parseTiddlerFilterTerm,{defaultFields:c,caseSensitive:a,withExtendedFields:e})}this.getQueryText=function(){return b};this.getUseRegExp=function(){return d};this.getCaseSensitive=function(){return a};this.getDefaultFields=function(){return c};this.getWithExtendedFields=function(){return e}};abego.TiddlerQuery.prototype.test=function(a){if(!a){return false}if(this.regExp){return this.tester.test(a)}return this.expr.exec(a)};abego.TiddlerQuery.prototype.filter=function(a){return abego.select(a,this.test,this)};abego.TiddlerQuery.prototype.getMarkRegExp=function(){if(this.regExp){return"".search(this.regExp)>=0?null:this.regExp}return this.expr.getMarkRegExp()};abego.TiddlerQuery.prototype.toString=function(){return(this.regExp?this.regExp:this.expr).toString()};abego.PageWiseRenderer=function(){this.firstIndexOnPage=0};merge(abego.PageWiseRenderer.prototype,{setItems:function(a){this.items=a;this.setFirstIndexOnPage(0)},getMaxPagesInNavigation:function(){return 10},getItemsCount:function(a){return this.items?this.items.length:0},getCurrentPageIndex:function(){return Math.floor(this.firstIndexOnPage/this.getItemsPerPage())},getLastPageIndex:function(){return Math.floor((this.getItemsCount()-1)/this.getItemsPerPage())},setFirstIndexOnPage:function(a){this.firstIndexOnPage=Math.min(Math.max(0,a),this.getItemsCount()-1)},getFirstIndexOnPage:function(){this.firstIndexOnPage=Math.floor(this.firstIndexOnPage/this.getItemsPerPage())*this.getItemsPerPage();return this.firstIndexOnPage},getLastIndexOnPage:function(){return Math.min(this.getFirstIndexOnPage()+this.getItemsPerPage()-1,this.getItemsCount()-1)},onPageChanged:function(a,b){},renderPage:function(a){if(a.beginRendering){a.beginRendering(this)}try{if(this.getItemsCount()){var d=this.getLastIndexOnPage();var c=-1;for(var b=this.getFirstIndexOnPage();b<=d;b++){c++;a.render(this,this.items[b],b,c)}}}finally{if(a.endRendering){a.endRendering(this)}}},addPageNavigation:function(c){if(!this.getItemsCount()){return}var k=this;var g=function(n){if(!n){n=window.event}abego.consumeEvent(n);var i=abego.toInt(this.getAttribute("page"),0);var m=k.getCurrentPageIndex();if(i==m){return}var l=i*k.getItemsPerPage();k.setFirstIndexOnPage(l);k.onPageChanged(i,m)};var e;var h=this.getCurrentPageIndex();var f=this.getLastPageIndex();if(h>0){e=createTiddlyButton(c,"Précédent","Page précédente (Raccourci: Alt-'<')",g,"prev");e.setAttribute("page",(h-1).toString());e.setAttribute("accessKey","<")}for(var d=-this.getMaxPagesInNavigation();d<this.getMaxPagesInNavigation();d++){var b=h+d;if(b<0){continue}if(b>f){break}var a=(d+h+1).toString();var j=b==h?"currentPage":"otherPage";e=createTiddlyButton(c,a,"Aller page %0".format([a]),g,j);e.setAttribute("page",(b).toString())}if(h<f){e=createTiddlyButton(c,"Suivant","Page suivante (Raccourci: Alt-'>')",g,"next");e.setAttribute("page",(h+1).toString());e.setAttribute("accessKey",">")}}});abego.LimitedTextRenderer=function(){var l=40;var c=4;var k=function(p,z,v){var q=p.length;if(q==0){p.push({start:z,end:v});return}var u=0;for(;u<q;u++){var w=p[u];if(w.start<=v&&z<=w.end){var o;var s=u+1;for(;s<q;s++){o=p[s];if(o.start>v||z>w.end){break}}var x=z;var y=v;for(var t=u;t<s;t++){o=p[t];x=Math.min(x,o.start);y=Math.max(y,o.end)}p.splice(u,s-u,{start:x,end:y});return}if(w.start>v){break}}p.splice(u,0,{start:z,end:v})};var d=function(n){var q=0;for(var p=0;p<n.length;p++){var o=n[p];q+=o.end-o.start}return q};var b=function(n){return(n>="a"&&n<="z")||(n>="A"&&n<="Z")||n=="_"};var f=function(p,r){if(!b(p[r])){return null}for(var o=r-1;o>=0&&b(p[o]);o--){}var q=o+1;var t=p.length;for(o=r+1;o<t&&b(p[o]);o++){}return{start:q,end:o}};var a=function(o,q,p){var n;if(p){n=f(o,q)}else{if(q<=0){return q}n=f(o,q-1)}if(!n){return q}if(p){if(n.start>=q-c){return n.start}if(n.end<=q+c){return n.end}}else{if(n.end<=q+c){return n.end}if(n.start>=q-c){return n.start}}return q};var j=function(r,q){var n=[];if(q){var u=0;do{q.lastIndex=u;var o=q.exec(r);if(o){if(u<o.index){var p=r.substring(u,o.index);n.push({text:p})}n.push({text:o[0],isMatch:true});u=o.index+o[0].length}else{n.push({text:r.substr(u)});break}}while(true)}else{n.push({text:r})}return n};var i=function(p){var n=0;for(var o=0;o<p.length;o++){if(p[o].isMatch){n++}}return n};var h=function(v,u,q,t,o){var w=Math.max(Math.floor(o/(t+1)),l);var n=Math.max(w-(q-u),0);var r=Math.min(Math.floor(q+n/3),v.length);var p=Math.max(r-w,0);p=a(v,p,true);r=a(v,r,false);return{start:p,end:r}};var m=function(r,y,o){var n=[];var v=i(r);var u=0;for(var p=0;p<r.length;p++){var x=r[p];var w=x.text;if(x.isMatch){var q=h(y,u,u+w.length,v,o);k(n,q.start,q.end)}u+=w.length}return n};var g=function(t,p,o){var n=o-d(p);while(n>0){if(p.length==0){k(p,0,a(t,o,false));return}else{var q=p[0];var v;var r;if(q.start==0){v=q.end;if(p.length>1){r=p[1].start}else{k(p,v,a(t,v+n,false));return}}else{v=0;r=q.start}var u=Math.min(r,v+n);k(p,v,u);n-=(u-v)}}};var e=function(p,x,w,n,o){if(n.length==0){return}var u=function(z,I,D,F,C){var H;var G;var E=0;var B=0;var A=0;for(;B<D.length;B++){H=D[B];G=H.text;if(F<E+G.length){A=F-E;break}E+=G.length}var y=C-F;for(;B<D.length&&y>0;B++){H=D[B];G=H.text.substr(A);A=0;if(G.length>y){G=G.substr(0,y)}if(H.isMatch){createTiddlyElement(z,"span",null,"marked",G)}else{createTiddlyText(z,G)}y-=G.length}if(C<I.length){abego.createEllipsis(z)}};if(n[0].start>0){abego.createEllipsis(p)}var q=o;for(var r=0;r<n.length&&q>0;r++){var t=n[r];var v=Math.min(t.end-t.start,q);u(p,x,w,t.start,t.start+v);q-=v}};this.render=function(p,q,o,t){if(q.length<o){o=q.length}var r=j(q,t);var n=m(r,q,o);g(q,n,o);e(p,q,r,n,o)}};(function(){function alertAndThrow(msg){alert(msg);throw msg}if(version.major<2||(version.major==2&&version.minor<1)){alertAndThrow("YourSearchPlugin requires TiddlyWiki 2.1 or newer.\n\nCheck the archive for YourSearch plugins\nsupporting older versions of TiddlyWiki.\n\nArchive: http://tiddlywiki.abego-software.de/archive")}abego.YourSearch={};var lastResults=undefined;var lastQuery=undefined;var setLastResults=function(array){lastResults=array};var getLastResults=function(){return lastResults?lastResults:[]};var getLastResultsCount=function(){return lastResults?lastResults.length:0};var matchInTitleWeight=4;var precisionInTitleWeight=10;var matchInTagsWeight=2;var getMatchCount=function(s,re){var m=s.match(re);return m?m.length:0};var standardRankFunction=function(tiddler,query){var markRE=query.getMarkRegExp();if(!markRE){return 1}var matchesInTitle=tiddler.title.match(markRE);var nMatchesInTitle=matchesInTitle?matchesInTitle.length:0;var nMatchesInTags=getMatchCount(tiddler.getTags(),markRE);var lengthOfMatchesInTitle=matchesInTitle?matchesInTitle.join("").length:0;var precisionInTitle=tiddler.title.length>0?lengthOfMatchesInTitle/tiddler.title.length:0;var rank=nMatchesInTitle*matchInTitleWeight+nMatchesInTags*matchInTagsWeight+precisionInTitle*precisionInTitleWeight+1;return rank};var findMatches=function(store,searchText,caseSensitive,useRegExp,sortField,excludeTag){lastQuery=null;var candidates=store.reverseLookup("tags",excludeTag,false);try{var defaultFields=[];if(config.options.chkSearchInTitle){defaultFields.push("title")}if(config.options.chkSearchInText){defaultFields.push("text")}if(config.options.chkSearchInTags){defaultFields.push("tags")}lastQuery=new abego.TiddlerQuery(searchText,caseSensitive,useRegExp,defaultFields,config.options.chkSearchExtendedFields)}catch(e){return[]}var results=lastQuery.filter(candidates);var rankFunction=abego.YourSearch.getRankFunction();for(var i=0;i<results.length;i++){var tiddler=results[i];var rank=rankFunction(tiddler,lastQuery);tiddler.searchRank=rank}if(!sortField){sortField="title"}var sortFunction=function(a,b){var searchRankDiff=a.searchRank-b.searchRank;if(searchRankDiff==0){if(a[sortField]==b[sortField]){return(0)}else{return(a[sortField]<b[sortField])?-1:+1}}else{return(searchRankDiff>0)?-1:+1}};results.sort(sortFunction);return results};var maxCharsInTitle=80;var maxCharsInTags=50;var maxCharsInText=250;var maxCharsInField=50;var itemsPerPageDefault=25;var itemsPerPageWithPreviewDefault=10;var yourSearchResultID="yourSearchResult";var yourSearchResultItemsID="yourSearchResultItems";var lastSearchText=null;var resultElement=null;var searchInputField=null;var searchButton=null;var lastNewTiddlerButton=null;var initStylesheet=function(){if(version.extensions.YourSearchPlugin.styleSheetInited){return}version.extensions.YourSearchPlugin.styleSheetInited=true;setStylesheet(store.getTiddlerText("YourSearchStyleSheet"),"yourSearch")};var isResultOpen=function(){return resultElement!=null&&resultElement.parentNode==document.body};var closeResult=function(){if(isResultOpen()){document.body.removeChild(resultElement)}};var closeResultAndDisplayTiddler=function(e){closeResult();var title=this.getAttribute("tiddlyLink");if(title){var withHilite=this.getAttribute("withHilite");var oldHighlightHack=highlightHack;if(withHilite&&withHilite=="true"&&lastQuery){highlightHack=lastQuery.getMarkRegExp()}story.displayTiddler(this,title);highlightHack=oldHighlightHack}return(false)};var adjustResultPositionAndSize=function(){if(!searchInputField){return}var root=searchInputField;var rootLeft=findPosX(root);var rootTop=findPosY(root);var rootHeight=root.offsetHeight;var popupLeft=rootLeft;var popupTop=rootTop+rootHeight;var winWidth=findWindowWidth();if(winWidth<resultElement.offsetWidth){resultElement.style.width=(winWidth-100)+"px";winWidth=findWindowWidth()}var popupWidth=resultElement.offsetWidth;if(popupLeft+popupWidth>winWidth){popupLeft=winWidth-popupWidth-30}if(popupLeft<0){popupLeft=0}resultElement.style.left=popupLeft+"px";resultElement.style.top=popupTop+"px";resultElement.style.display="block"};var scrollVisible=function(){if(resultElement){window.scrollTo(0,ensureVisible(resultElement))}if(searchInputField){window.scrollTo(0,ensureVisible(searchInputField))}};var ensureResultIsDisplayedNicely=function(){adjustResultPositionAndSize();scrollVisible()};var indexInPage=undefined;var currentTiddler=undefined;var pager=new abego.PageWiseRenderer();var MyItemRenderer=function(parent){this.itemHtml=store.getTiddlerText(".YourSearchItemTemplate");if(!this.itemHtml){alertAndThrow(".YourSearchItemTemplate not found")}this.place=document.getElementById(yourSearchResultItemsID);if(!this.place){this.place=createTiddlyElement(parent,"div",yourSearchResultItemsID)}};merge(MyItemRenderer.prototype,{render:function(pager,object,index,indexOnPage){indexInPage=indexOnPage;currentTiddler=object;var item=createTiddlyElement(this.place,"div",null,"yourSearchItem");item.innerHTML=this.itemHtml;applyHtmlMacros(item,null);refreshElements(item,null)},endRendering:function(pager){currentTiddler=null}});var refreshResult=function(){if(!resultElement||!searchInputField){return}var html=store.getTiddlerText("YourSearchResultTemplate");if(!html){html="<b>Tiddler YourSearchResultTemplate not found</b>"}resultElement.innerHTML=html;applyHtmlMacros(resultElement,null);refreshElements(resultElement,null);var itemRenderer=new MyItemRenderer(resultElement);pager.renderPage(itemRenderer);ensureResultIsDisplayedNicely()};pager.getItemsPerPage=function(){var n=(config.options.chkPreviewText)?abego.toInt(config.options.txtItemsPerPageWithPreview,itemsPerPageWithPreviewDefault):abego.toInt(config.options.txtItemsPerPage,itemsPerPageDefault);return(n>0)?n:1};pager.onPageChanged=function(){refreshResult()};var reopenResultIfApplicable=function(){if(searchInputField==null||!config.options.chkUseYourSearch){return}if((searchInputField.value==lastSearchText)&&lastSearchText&&!isResultOpen()){if(resultElement&&(resultElement.parentNode!=document.body)){document.body.appendChild(resultElement);ensureResultIsDisplayedNicely()}else{abego.YourSearch.onShowResult(true)}}};var invalidateResult=function(){closeResult();resultElement=null;lastSearchText=null};var isDescendantOrSelf=function(self,e){while(e!=null){if(self==e){return true}e=e.parentNode}return false};var onDocumentClick=function(e){if(e.target==searchInputField){return}if(e.target==searchButton){return}if(resultElement&&isDescendantOrSelf(resultElement,e.target)){return}closeResult()};var onDocumentKeyup=function(e){if(e.keyCode==27){closeResult()}};addEvent(document,"click",onDocumentClick);addEvent(document,"keyup",onDocumentKeyup);var myStorySearch=function(text,useCaseSensitive,useRegExp){lastSearchText=text;setLastResults(findMatches(store,text,useCaseSensitive,useRegExp,"title","excludeSearch"));abego.YourSearch.onShowResult()};var myMacroSearchHandler=function(place,macroName,params,wikifier,paramString,tiddler){initStylesheet();lastSearchText="";var searchTimeout=null;var doSearch=function(txt){if(config.options.chkUseYourSearch){myStorySearch(txt.value,config.options.chkCaseSensitiveSearch,config.options.chkRegExpSearch)}else{story.search(txt.value,config.options.chkCaseSensitiveSearch,config.options.chkRegExpSearch)}lastSearchText=txt.value};var clickHandler=function(e){doSearch(searchInputField);return false};var keyHandler=function(e){if(!e){e=window.event}searchInputField=this;switch(e.keyCode){case 13:if(e.ctrlKey&&lastNewTiddlerButton&&isResultOpen()){lastNewTiddlerButton.onclick.apply(lastNewTiddlerButton,[e])}else{doSearch(this)}break;case 27:if(isResultOpen()){closeResult()}else{this.value="";clearMessage()}break}if(String.fromCharCode(e.keyCode)==this.accessKey||e.altKey){reopenResultIfApplicable()}if(this.value.length<3&&searchTimeout){clearTimeout(searchTimeout)}if(this.value.length>2){if(this.value!=lastSearchText){if(!config.options.chkUseYourSearch||config.options.chkSearchAsYouType){if(searchTimeout){clearTimeout(searchTimeout)}var txt=this;searchTimeout=setTimeout(function(){doSearch(txt)},500)}}else{if(searchTimeout){clearTimeout(searchTimeout)}}}if(this.value.length==0){closeResult()}};var focusHandler=function(e){this.select();clearMessage();reopenResultIfApplicable()};var args=paramString.parseParams("list",null,true);var buttonAtRight=getFlag(args,"buttonAtRight");var sizeTextbox=getParam(args,"sizeTextbox",this.sizeTextbox);var txt=createTiddlyElement(null,"input",null,"txtOptionInput searchField",null);if(params[0]){txt.value=params[0]}txt.onkeyup=keyHandler;txt.onfocus=focusHandler;txt.setAttribute("size",sizeTextbox);txt.setAttribute("accessKey",this.accessKey);txt.setAttribute("autocomplete","off");if(config.browser.isSafari){txt.setAttribute("type","search");txt.setAttribute("results","5")}else{if(!config.browser.isIE){txt.setAttribute("type","text")}}var btn=createTiddlyButton(null,this.label,this.prompt,clickHandler);if(place){if(!buttonAtRight){place.appendChild(btn)}place.appendChild(txt);if(buttonAtRight){place.appendChild(btn)}}searchInputField=txt;searchButton=btn};var openAllFoundTiddlers=function(){closeResult();var results=getLastResults();var n=results.length;if(n){var titles=[];for(var i=0;i<n;i++){titles.push(results[i].title)}story.displayTiddlers(null,titles)}};var createOptionWithRefresh=function(place,optionParams,wikifier,tiddler){invokeMacro(place,"option",optionParams,wikifier,tiddler);var elem=place.lastChild;var oldOnClick=elem.onclick;elem.onclick=function(e){var result=oldOnClick.apply(this,arguments);refreshResult();return result};return elem};var removeTextDecoration=function(s){var removeThis=["''","{{{","}}}","//","<<<","/***","***/"];var reText="";for(var i=0;i<removeThis.length;i++){if(i!=0){reText+="|"}reText+="("+removeThis[i].escapeRegExp()+")"}return s.replace(new RegExp(reText,"mg"),"").trim()};var getShortCutNumber=function(){var i=indexInPage;return(i>=0&&i<=9)?(i<9?(i+1):0):-1};var limitedTextRenderer=new abego.LimitedTextRenderer();var renderLimitedText=function(place,s,maxLen){limitedTextRenderer.render(place,s,maxLen,lastQuery.getMarkRegExp())};var oldTiddlyWikiSaveTiddler=TiddlyWiki.prototype.saveTiddler;TiddlyWiki.prototype.saveTiddler=function(title,newTitle,newBody,modifier,modified,tags,fields){oldTiddlyWikiSaveTiddler.apply(this,arguments);invalidateResult()};var oldTiddlyWikiRemoveTiddler=TiddlyWiki.prototype.removeTiddler;TiddlyWiki.prototype.removeTiddler=function(title){oldTiddlyWikiRemoveTiddler.apply(this,arguments);invalidateResult()};config.macros.yourSearch={label:"yourSearch",prompt:"Gives access to the current/last YourSearch result",handler:function(place,macroName,params,wikifier,paramString,tiddler){if(params.length==0){return}var name=params[0];var func=config.macros.yourSearch.funcs[name];if(func){func(place,macroName,params,wikifier,paramString,tiddler)}},tests:{"true":function(){return true},"false":function(){return false},found:function(){return getLastResultsCount()>0},previewText:function(){return config.options.chkPreviewText}},funcs:{itemRange:function(place){if(getLastResultsCount()){var lastIndex=pager.getLastIndexOnPage();var s="%0 - %1".format([pager.getFirstIndexOnPage()+1,lastIndex+1]);createTiddlyText(place,s)}},count:function(place){createTiddlyText(place,getLastResultsCount().toString())},query:function(place){if(lastQuery){createTiddlyText(place,lastQuery.toString())}},version:function(place){var t="YourSearch %0.%1.%2".format([version.extensions.YourSearchPlugin.major,version.extensions.YourSearchPlugin.minor,version.extensions.YourSearchPlugin.revision]);var e=createTiddlyElement(place,"a");e.setAttribute("href","http://tiddlywiki.abego-software.de/#YourSearchPlugin");e.innerHTML='<font color="black" weight="bold" face="Arial, Helvetica, sans-serif">'+t+"<font>"},copyright:function(place){var e=createTiddlyElement(place,"a");e.setAttribute("href","http://www.abego-software.de");e.innerHTML='<font color="black" face="Arial, Helvetica, sans-serif">&copy; 2005-2019 <b><font color="blue">abego</font></b> Software<font>'},newTiddlerButton:function(place){if(lastQuery){var r=abego.parseNewTiddlerCommandLine(lastQuery.getQueryText());var btn=config.macros.newTiddler.createNewTiddlerButton(place,r.title,r.params,"","",null,"text");var oldOnClick=btn.onclick;btn.onclick=function(){closeResult();oldOnClick.apply(this,arguments)};lastNewTiddlerButton=btn}},linkButton:function(place,macroName,params,wikifier,paramString,tiddler){if(params<2){return}var tiddlyLink=params[1];var text=params<3?tiddlyLink:params[2];var tooltip=params<4?text:params[3];var accessKey=params<5?null:params[4];var btn=createTiddlyButton(place,text,tooltip,closeResultAndDisplayTiddler,null,null,accessKey);btn.setAttribute("tiddlyLink",tiddlyLink)},closeButton:function(place,macroName,params,wikifier,paramString,tiddler){createTiddlyButton(place,"Fermer","Fermer la zone de recherche (touche \'ESC\')",closeResult)},openAllButton:function(place,macroName,params,wikifier,paramString,tiddler){var n=getLastResultsCount();if(n==0){return}var title=n==1?"open tiddler":"Ouvrir les %0 articles".format([n]);var button=createTiddlyButton(place,title,"Ouvrir tous les articles (Raccourci : Alt-O)",openAllFoundTiddlers);button.setAttribute("accessKey","O")},naviBar:function(place,macroName,params,wikifier,paramString,tiddler){pager.addPageNavigation(place)},"if":function(place,macroName,params,wikifier,paramString,tiddler){if(params.length<2){return}var testName=params[1];var negate=(testName=="not");if(negate){if(params.length<3){return}testName=params[2]}var test=config.macros.yourSearch.tests[testName];var showIt=false;try{if(test){showIt=test(place,macroName,params,wikifier,paramString,tiddler)!=negate}else{showIt=(!eval(testName))==negate}}catch(ex){}if(!showIt){place.style.display="none"}},chkPreviewText:function(place,macroName,params,wikifier,paramString,tiddler){var elem=createOptionWithRefresh(place,"chkPreviewText",wikifier,tiddler);elem.setAttribute("accessKey","P");elem.title="Prévisualisation des articles (Raccourci : Alt-P)";return elem}}};config.macros.foundTiddler={label:"foundTiddler",prompt:"Provides information on the tiddler currently processed on the YourSearch result page",handler:function(place,macroName,params,wikifier,paramString,tiddler){var name=params[0];var func=config.macros.foundTiddler.funcs[name];if(func){func(place,macroName,params,wikifier,paramString,tiddler)}},funcs:{title:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}var shortcutNumber=getShortCutNumber();var tooltip=shortcutNumber>=0?"Ouvrir l\'article (Raccourci : Alt-%0)".format([shortcutNumber.toString()]):"Open tiddler";var btn=createTiddlyButton(place,null,tooltip,closeResultAndDisplayTiddler,null);btn.setAttribute("tiddlyLink",currentTiddler.title);btn.setAttribute("withHilite","true");renderLimitedText(btn,currentTiddler.title,maxCharsInTitle);if(shortcutNumber>=0){btn.setAttribute("accessKey",shortcutNumber.toString())}},tags:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}renderLimitedText(place,currentTiddler.getTags(),maxCharsInTags)},text:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}renderLimitedText(place,removeTextDecoration(currentTiddler.text),maxCharsInText)},field:function(place,macroName,params,wikifier,paramString,tiddler){if(!currentTiddler){return}var name=params[1];var len=params.length>2?abego.toInt(params[2],maxCharsInField):maxCharsInField;var v=store.getValue(currentTiddler,name);if(v){renderLimitedText(place,removeTextDecoration(v),len)}},number:function(place,macroName,params,wikifier,paramString,tiddler){var numberToDisplay=getShortCutNumber();if(numberToDisplay>=0){var text="%0)".format([numberToDisplay.toString()]);createTiddlyElement(place,"span",null,"shortcutNumber",text)}}}};var opts={chkUseYourSearch:true,chkPreviewText:true,chkSearchAsYouType:true,chkSearchInTitle:true,chkSearchInText:true,chkSearchInTags:true,chkSearchExtendedFields:true,txtItemsPerPage:itemsPerPageDefault,txtItemsPerPageWithPreview:itemsPerPageWithPreviewDefault};for(var n in opts){if(config.options[n]==undefined){config.options[n]=opts[n]}}config.shadowTiddlers.AdvancedOptions+="\n<<option chkUseYourSearch>> Use 'Your Search' ";config.shadowTiddlers.YourSearchStyleSheet="/***\n!~YourSearchResult Stylesheet\n***/\n/*{{{*/\n.yourSearchResult {\n\tposition: absolute;\n\twidth: 800px;\n\n\tpadding: 0.2em;\n\tlist-style: none;\n\tmargin: 0;\n\n\tbackground: #f0f8ff;\n\tborder: 1px solid DarkGray;\n}\n\n/*}}}*/\n/***\n!!Summary Section\n***/\n/*{{{*/\n.yourSearchResult .summary {\n\tborder-bottom-width: thin;\n\tborder-bottom-style: solid;\n\tborder-bottom-color: #999999;\n\tpadding-bottom: 4px;\n}\n\n.yourSearchRange, .yourSearchCount, .yourSearchQuery   {\n\tfont-weight: bold;\n}\n\n.yourSearchResult .summary .button {\n\tfont-size: 10px;\n\n\tpadding-left: 0.3em;\n\tpadding-right: 0.3em;\n}\n\n.yourSearchResult .summary .chkBoxLabel {\n\tfont-size: 10px;\n\n\tpadding-right: 0.3em;\n}\n\n/*}}}*/\n/***\n!!Items Area\n***/\n/*{{{*/\n.yourSearchResult .marked {\n\tbackground: none;\n\tfont-weight: bold;\n}\n\n.yourSearchItem {\n\tmargin-top: 2px;\n}\n\n.yourSearchNumber {\n\tcolor: #0000FF;\n}\n\n\n.yourSearchTags {\n\tcolor: #3333ff;\n}\n\n.yourSearchText {\n\tcolor: #000080;\n\tmargin-bottom: 6px;\n}\n\n/*}}}*/\n/***\n!!Footer\n***/\n/*{{{*/\n.yourSearchFooter {\n\tmargin-top: 8px;\n\tborder-top-width: thin;\n\tborder-top-style: solid;\n\tborder-top-color: #999999;\n}\n\n.yourSearchFooter a:hover{\n\tbackground: none;\n\tcolor: none;\n}\n/*}}}*/\n/***\n!!Navigation Bar\n***/\n/*{{{*/\n.yourSearchNaviBar a {\n\tfont-size: 16px;\n\tmargin-left: 4px;\n\tmargin-right: 4px;\n\tcolor: black;\n\ttext-decoration: underline;\n}\n\n.yourSearchNaviBar a:hover {\n\tbackground-color: none;\n}\n\n.yourSearchNaviBar .prev {\n\tfont-weight: bold;\n\tcolor: blue;\n}\n\n.yourSearchNaviBar .currentPage {\n\tcolor: #0000FF;\n\ttext-decoration: none;\n}\n\n.yourSearchNaviBar .next {\n\tfont-weight: bold;\n\tcolor: blue;\n}\n/*}}}*/\n";config.shadowTiddlers.YourSearchResultTemplate='<!--\n{{{\n-->\n<span macro="yourSearch if found">\n<!-- The Summary Header ============================================ -->\n<table class="summary" border="0" width="100%" cellspacing="0" cellpadding="0"><tbody>\n  <tr>\n\t<td align="left">\n\t\tYourSearch Result <span class="yourSearchRange" macro="yourSearch itemRange"></span>\n\t\t&nbsp;of&nbsp;<span class="yourSearchCount" macro="yourSearch count"></span>\n\t\tfor&nbsp;<span class="yourSearchQuery" macro="yourSearch query"></span>\n\t</td>\n\t<td class="yourSearchButtons" align="right">\n\t\t<span macro="yourSearch newTiddlerButton"></span>\n\t\t<span macro="yourSearch openAllButton"></span>\n\t\t<span macro="yourSearch closeButton"></span>\n\t</td>\n  </tr>\n</tbody></table>\n\n<!-- The List of Found Tiddlers ============================================ -->\n<div id="yourSearchResultItems" itemsPerPage="25" itemsPerPageWithPreview="10"></div>\n\n<!-- The Footer (with the Navigation) ============================================ -->\n<table class="yourSearchFooter" border="0" width="100%" cellspacing="0" cellpadding="0"><tbody>\n  <tr>\n\t<td align="left">\n\t\tNombre de pages : <span class="yourSearchNaviBar" macro="yourSearch naviBar"></span>\n\t</td>\n\t<td align="right"><span macro="yourSearch version"></span>, <span macro="yourSearch copyright"></span>\n\t</td>\n  </tr>\n</tbody></table>\n<!-- end of the \'tiddlers found\' case =========================================== -->\n</span>\n\n\n<!-- The "No tiddlers found" case =========================================== -->\n<span macro="yourSearch if not found">\n<table class="summary" border="0" width="100%" cellspacing="0" cellpadding="0"><tbody>\n  <tr>\n\t<td align="left">\n\t\tRecherche infructueuse: aucun article trouvé pour <span class="yourSearchQuery" macro="yourSearch query"></span>.\n\t</td>\n\t<td class="yourSearchButtons" align="right">\n\t\t<span macro="yourSearch closeButton"></span>\n\t</td>\n  </tr>\n</tbody></table>\n</span>\n\n\n<!--\n}}}\n-->\n';config.shadowTiddlers.YourSearchItemTemplate="<!--\n{{{\n-->\n<span class='yourSearchNumber' macro='foundTiddler number'></span>\n<span class='yourSearchTitle' macro='foundTiddler title'/></span>&nbsp;-&nbsp;\n<span class='yourSearchTags' macro='foundTiddler field tags 50'/></span>\n<span macro=\"yourSearch if previewText\"><div class='yourSearchText' macro='foundTiddler field text 250'/></div></span>\n<!--\n}}}\n-->";config.shadowTiddlers.YourSearch="<<tiddler [[YourSearch Help]]>>";config.shadowTiddlers["YourSearch Result"]="The popup-like window displaying the result of a YourSearch query.";config.macros.search.handler=myMacroSearchHandler;var checkForOtherHijacker=function(){if(config.macros.search.handler!=myMacroSearchHandler){alert("Message from YourSearchPlugin:\n\n\nAnother plugin has disabled the 'Your Search' features.\n\n\nYou may disable the other plugin or change the load order of \nthe plugins (by changing the names of the tiddlers)\nto enable the 'Your Search' features.")}};setTimeout(checkForOtherHijacker,5000);abego.YourSearch.getStandardRankFunction=function(){return standardRankFunction};abego.YourSearch.getRankFunction=function(){return abego.YourSearch.getStandardRankFunction()};abego.YourSearch.getCurrentTiddler=function(){return currentTiddler};abego.YourSearch.closeResult=function(){closeResult()};abego.YourSearch.getFoundTiddlers=function(){return lastResults};abego.YourSearch.getQuery=function(){return lastQuery};abego.YourSearch.onShowResult=function(useOldResult){highlightHack=lastQuery?lastQuery.getMarkRegExp():null;if(!useOldResult){pager.setItems(getLastResults())}if(!resultElement){resultElement=createTiddlyElement(document.body,"div",yourSearchResultID,"yourSearchResult")}else{if(resultElement.parentNode!=document.body){document.body.appendChild(resultElement)}}refreshResult();highlightHack=null}})()};
//%/
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title+"]] \"Consulter ["+tiddler.title+"]\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"////"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title.substr(0,4)+"]] \""+tiddler.title+"\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"////"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title.substr(0,7)+"]] \""+tiddler.title+"\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"////"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '"* [["+tiddler.title+"]] \n"'>><<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title+"]] \"Consulter ["+tiddler.title+"]\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"//Aucun élément pour le moment//"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '" [["+tiddler.title.substr(0,10)+"]] \"["+tiddler.title+"]\" [["+tiddler.title+"]] "' begin '"<<tabs tAutoTab "' end '">"+">"' none '"//Aucun élément pour le moment//"'>>
<<forEachTiddler where 'tiddler.tags.containsAll(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '"* [["+tiddler.title+"]]\n"' begin '""' end '""' none '"* Aucune publication pour le moment\n"'>>
<<forEachTiddler where 'tiddler.tags.containsAny(["$1"])' sortBy 'tiddler.title.toUpperCase()' descending write '(index < 24) ? "|"+tiddler.title.substr(0,10)+"|[["+tiddler.title.substr(13,254)+"|"+tiddler.title+"]]|\n" : ""' begin '"|Date|!$2 |\n"' end '""' none '"* Aucune publication\n"'>>
[[Accueil]]
{{floatL{
|@@color:#00F;<html><i class="fa fa-home" aria-hidden="true"></i></html>@@|__[[Accueil]]__ ^^[img[iCSF/flag_fr.png][https://CloudSecurityAlliance.fr]]^^|
|@@color:#00F;<html><i class="fa fa-chalkboard-teacher" aria-hidden="true"></i></html>@@|__[[CSA FR|Chapitre Français]]__|
|@@color:#00F;<html><i class="fa fa-info-circle" aria-hidden="true"></i></html>@@|__[[Actualités]]__|
|@@color:#00F;<html><i class="fa fa-blog" aria-hidden="true"></i></html>@@|__[[Blog]]__|
|@@color:#00F;<html><i class="fa fa-book" aria-hidden="true"></i></html>@@|__[[Publications]]__|
|@@color:#00F;<html><i class="fa fa-eye" aria-hidden="true"></i></html>@@|__[[Veille Web]]__|
|@@color:#00F;<html><i class="fa fa-pencil-alt" aria-hidden="true"></i></html>@@|__[[Newsletters]]__|
|@@color:#00F;<html><i class="fa fa-book-reader" aria-hidden="true"></i></html>@@|__[[Références]]__|
|@@color:#00F;<html><i class="fa fa-tools" aria-hidden="true"></i></html>@@|__[[Outils]]__|
|@@color:#00F;<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html>@@|__[[Alertes|Alertes et Vulnérabilités]]__|
|@@color:#00F;<html><i class="fa fa-archive" aria-hidden="true"></i></html>@@|__[[Archives]]__|
|TablNoBord|k
|^^→^^|^^[[Contact]]^^|
[img[LinkedIN|iCSF/In.png][LinkedIN]][img[Slack|iCSF/Slack_icon2.png][Slack]][img[Twitter|iCSF/Twitter_icon.png][Twitter]]
<<search 'Moteur de Recherche'>>[img(50%,1px)[iCSF/BluePixel.gif]]<<tiddler RollLeftCol>>[img(50%,1px)[iCSF/BluePixel.gif]]}}}
Chapitre Français •<<tiddler .ToggleLeftSidebar>>•
Cloud Security Alliance
[[myCSS]]
<!--{{{-->
<div class='toolbar' macro='toolbar [[ToolbarCommands::ViewToolbar]]'></div>
<div class='title' macro='view title'></div>
<div class='viewer' macro='view text wikified'></div>
<div class='viewer' macro='tiddler ReplaceDoubleClick'></div>
<div class='tagClear'></div>
<!--}}}-->

|  |!0|!1|!2|!3|!4|!5|!6|!7|!8|!9|
|!0| 0| 1| 2| 3| 4| 5| 6| 7| 8| 9|
|!1| a| b| c| d| e| f| g| h| i| j|
|!2| k| l| m| n| o| p| q| r| s| t|
|!3| u| v| w| x| y| z| A| B| C| D|
|!4| E| F| G| H| I| J| K| L| M| N|
|!5| O| P| Q| R| S| T| U| V| W| X|
|!6| Y| Z| +| =| -| (| )||||
+++*[T0D0] <<tiddler fAll2Tabs with: T0D0>>=== • +++*[AdvancedOptions] <<tiddler AdvancedOptions>>=== •
|2018.11...|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Microsoft Certifié Hébergeur de Donnees de Santé en France|https://www.lemondeinformatique.fr/actualites/lire-microsoft-certifie-hebergeur-de-donnees-de-sante-en-france-73347.html]]|Azure Healthcare France|
|201.......|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[AWS Certifié Hébergeur de Donnees de Santé en France, Oui mais...|https://www.lemondeinformatique.fr/actualites/lire-aws-certifie-hebergeur-de-donnees-de-sante-oui-mais-maj-74667.html]]|AWS Healthcare France|
“” %/
//{{{
config.options.txtUserName='CSA-FR';
config.options.chkAnimate=false;
config.options.chkRegExpSearch=false;
config.options.chkCaseSensitiveSearch=false;
config.options.chkOpenInNewWindow=true;
config.messages.tiddlerLinkTooltip="→ %0";
config.messages.externalLinkTooltip="→ %0";
config.options.chkHideSiteTitles=true;
config.macros.search.prompt="Recherche sur ce site";
config.macros.search.successMsg="%1 → %0 article(s)";
config.macros.search.failureMsg="%0 → Aucun article";
config.macros.search.label="Recherche";
merge(config.views.wikified,{ dateFormat: "0DD.0MM.YYYY",});
merge(config.macros.search,{ label: "", prompt: "Moteur de recherche local",});
config.options.chkUseYourSearch=true;
config.options.chkPreviewText=false;
config.options.chkSearchAsYouType=true;
config.options.chkSearchInTitle=true;
config.options.chkSearchInText=true;
config.options.chkSearchInTags=true;
config.options.chkSearchExtendedFields=false;
config.options.txtItemsPerPage=10;
config.options.txtItemsPerPageWithPreview=10;
config.options.chkShowLeftSidebar=true;
config.options.chkDisableWikiLinks=true;
config.options.chkAllowLinksFromShadowTiddlers=true;
config.options.chkDisableNonExistingWikiLinks=true;
config.options.chkSinglePageAutoScroll=true;
config.options.chkSinglePagePermalink=false;
config.options.chkSinglePageMode=false;
config.options.chkTopOfPageMode=true;
config.options.chkBottomOfPageMode=false;
config.options.chkShowBreadcrumbs=true;
config.options.txtBreadcrumbsLimit=8;
config.options.chkReorderBreadcrumbs=true;
config.options.txtBreadcrumbsCrumbSeparator="  <html><i class='fa fa-shoe-prints' aria-hidden='true'></i><i class='fa fa-shoe-prints' aria-hidden='true'></i></html>  ";
config.options.chkBreadcrumbsSave=false;
config.options.chkShowStartupBreadcrumbs=false;
config.options.chkBreadcrumbsReverse=false;
config.options.chkBreadcrumbsLimitOpenTiddlers=true;
config.options.txtBreadcrumbsLimitOpenTiddlers=20;
config.options.chkBreadcrumbsHideHomeLink=false;
config.options.chkCreateDefaultBreadcrumbs=true;
readOnly=true;
config.options.chkHttpReadOnly=true;
config.options.chkBackstage=false;
showBackstage=false;
merge(config.shadowTiddlers,{ ToolbarCommands: '|~ViewToolbar|closeTiddler closeOthers|\n|~EditToolbar|+saveTiddler -cancelTiddler deleteTiddler|',});
merge(config.commands.closeTiddler,{ text: "[fermer]", tooltip: "Fermer cet article" });
merge(config.commands.closeOthers,{ text: "[isoler]", tooltip: "Fermer les autres articles" });
//}}}
/*{{{*/
.col30 {width:30%; float:left; margin-left:1%; margin-right:1%; border-color:#00F; border-style:solid; border-width:3px; }
.col40 {width:40%; float:left; margin-left:1%;}
.col45 {width:45%; float:left; margin-left:1%;}
.col50 {width:50%; float:left; margin-left:1%;}
.clear {clear:both;}
.TablNoBord,
.TablNoBord table,
.TablNoBord td,
.TablNoBord tr,
.TablNoBord th,
.TablNoBord tbody
{ border:0 !important; }
/* {font-size:.70em;} */
body {font-size:.8em;font-family:Verdana,times,serif; margin:0; padding:0;}
pre, .tagged, .tagging, #messageArea, .popup, .tiddlyLink, .button { border-radius: 5px; }
.tiddlyLink { padding: 0px 2px; margin: 0 -2px; }
img[align="left"] { margin-right: .5em; }
img[align="right"] { margin-left: .5em; }
.toolbar {text-align:left; font-size:.7em;}
img {border:2px solid [[ColorPalette::Background]];}
.headerShadow {position:relative; padding:0.5em 0em 1em 1em; left:-1px; top:-1px;}
.headerForeground {position:absolute; padding:0.5em 0em 1em 1em; left:0px; top:0px;}
.headerShadow .right { position: absolute; top: 0; }
.headerShadow .right { right: 0; }
.headerForeground .right { display: none; }
/* InlineTabs */
.tabSelected{ font-weight:bold; font-size:125%; color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::TertiaryPale]]; border-left:2px solid [[ColorPalette::PrimaryMid]]; border-top:2px solid [[ColorPalette::PrimaryLight]]; border-right:2px solid [[ColorPalette::PrimaryMid]]; border-bottom-style:2px solid [[ColorPalette::PrimaryMid]]; }
.tabContents {color:[[ColorPalette::PrimaryDark]]; background:[[ColorPalette::Background]]; border:2px solid [[ColorPalette::PrimaryMid]];}
/* StyleSheetFirstLetter */
.firstletter{ float:left; width:0.6em; font-size:250%; font-family:Verdana,times,serif; line-height:60%; color:#00f !important; background:inherit !important; }
.firstletterC{ float:center; width:0.6em; font-size:250%; line-height:60%; color:#00f !important; background:inherit !important; }
.FirstLetter{ width:0.6em; font-size:150%; font-family:Verdana,times,serif; line-height:60%; !important; background:inherit !important; }
/* StyleSheetTableList */
.viewer ul {margin-top: 0; margin-bottom: 0;}
.viewer {text-align: justify;}
.viewer th {background:[[ColorPalette::TertiaryPale]]; color:[[ColorPalette::PrimaryMid]];}
/* Alignement */
.floatL { display:block;text-align:left; }
.floatR { display:block;text-align:right; }
.floatC { display:block;text-align:center; }
.Table98{width:98%}
.Table99{width:99%}
/* NestedSlidersPlugin */
.floatingPanel { z-index:700; padding:1em; margin:0em; border:1px solid; -moz-border-radius:1em; font-size:8pt; text-align:left; }
.floatingPanel hr { margin:2px 0 1px 0; padding:0; }
#sidebarOptions .sliderPanel { margin:0; padding:0; font-size:1em; background:transparent; }
#sidebarOptions .sliderPanel a { font-weight:normal; }
#sidebarOptions .sliderPanel blockquote { margin:0;padding:0;margin-left:1em; border-left:1px dotted; padding-left:1em }
.selected .floatingPanel .button,
.selected .floatingPanel a:link,
.selected .floatingPanel a:hover,
.selected .floatingPanel a:visited,
.floatingPanel .button,
.floatingPanel a:link,
.floatingPanel a:hover,
.floatingPanel a:visited { color:[[ColorPalette::PrimaryDark]] !important; }
.QOTD { color:#00f !important; background:inherit !important; }
.horizTag li.listTitle { display:none }
.horizTag li { display: inline; font-size:90%; }
.horizTag ul { display:inline; margin:0px; padding:0px;}
.viewer td { vertical-align: top; }
.viewer th { vertical-align: top; }
.viewer dl { margin: 0; }
/*}}}*/
[img(400px,4px)[iCSF/BluePixel.gif]]
[img(200px,auto)[iCSF/Email-CSA_FR.png]]
|Table98|k
| ^^<<tiddler [[Categories]]>>^^ |
| <<tiddler RollHeader>> |
|Table98|k
|>|!Dernière mise à jour du site le @@font-size:125%;@@ |>|!@@color:#00F;font-size:112%;<html><i class="fa fa-question-circle fa-2x" aria-hidden="true"></i></html>@@ Le savez-vous ? |
|>|@@color:#00F;<html><i class="fa fa-eye fa-2x" aria-hidden="true"></i></html>@@ __@@color:#009;font-size:112%;''[[Veille Web Janvier 2020|2020.01.31 - Veille - Janvier 2020]]''@@__ 

<<tiddler fAll2List with: '202001","_Show_' >> |>|<<tiddler RollMainW>> | |>|>|>| Archives du site et historique : → [[ici|Archives]] ← | <<tiddler .ReplaceTiddlerTitle with: [[Bienvenue en 2020 sur le site du Chapitre Français de la Cloud Security Alliance]]>>
[img(50%,1px)[iCSF/BluePixel.gif]]
<<tabs tHisto 'Archives 2020' 'Archives 2020' [[Archives 2020]] 'Archives 2019' 'Archives 2019' [[Archives 2019]] 'Archives 2018' 'Archives 2018' [[Archives 2018]] 'Archives 2017' 'Archives 2017' [[Archives 2017]] 'Archives 2016' 'Archives 2016' [[Archives 2016]] 'Archives 2015' 'Archives 2015' [[Archives 2015]] 'Archives 2014' 'Archives 2014' [[Archives 2014]] 'Archives 2013' 'Archives 2013' [[Archives 2013]] 'Archives 2012' 'Archives 2012' [[Archives 2012]] 'Archives 2011' 'Archives 2011' [[Archives 2011]] 'Archives 2010' 'Archives 2010' [[Archives 2010]] >> 
<<tiddler fAll2Tabs7 with: _Histo20>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2020]]>>
<<tiddler fAll2Tabs7 with: _Histo19>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2019]]>>
<<tiddler fAll2Tabs7 with: _Histo18>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2018]]>>
Les archives ''2017'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo17>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2017]]>>
Les archives ''2016'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo16>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2016]]>>
Les archives ''2015'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo15>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2015]]>>
Les archives ''2014'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo14>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2014]]>>
Les archives ''2013'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo13>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2013]]>>
Les archives ''2012'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo12>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2012]]>>
Les archives ''2011'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo11>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2011]]>>
Les archives ''2010'' sont en cours de reconstruction
<<tiddler fAll2Tabs7 with: _Histo10>><<tiddler .ReplaceTiddlerTitle with: [[Archives 2010]]>>
Catégories : [[CAIQ]] • [[CCAK]] • [[CCM]] • [[CCSK]] • [[Cryptographie]] • [[ERP]] • [[Incidents]] • [[IoT]] • [[Menaces]] • [[Panorama]] • [[RGPD]] • [[Santé|Publications - Santé]] • [[SDP]] • [[STAR]] • [[Vulnérabilités]] •
Prochainement, la communauté [[Circle|Circle CSA]] de partage de la ''Cloud Security Alliance'' va s'ouvrir... → à suivre...
[img(40%,1px)[iCSF/BluePixel.gif]]
[img[iCSA/CircleCSA.png]]
[img(40%,1px)[iCSF/BluePixel.gif]]
[img(800px,auto)[iCSA/CircleCSA.jpg]]
[img(40%,1px)[iCSF/BluePixel.gif]]
!Le [[Chapitre Français|CSA-FR]] de la [[Cloud Security Alliance]]
[>img(200px,auto)[iCSF/cloud-security-alliance.png]]
Le [[Chapitre Français|CSA-FR]] de la [[Cloud Security Alliance]] a été créé en décembre 2010 par ''[[Olivier Caleff|https://www.linkedin.com/in/caleff]]'' et ''[[Pierre Vacherand|https://www.linkedin.com/in/pierrevacherand/]]''.
Après un bon début, le [[Chapitre français|CSA-FR]] a tourné au ralenti entre 2013 et 2017.
Les activités se sont concentrées autour de participations et contributions à des événements de la [[Cloud Security Alliance]] en Europe, à des participations dans des groupes de travail de la [[Cloud Security Alliance]], et à une participation très active dans le domaine de la formation (voir ci-dessous)
En 2018, les activités reprennent avec :
* La participation à deux salons (Mars et Novembre 2018)
* La poursuite des partenariats pour les activités de formation
* L'animation du groupe LinkedIn : https://www.linkedin.com/groups/3758242
* La préparation de la relance des réunions des membres du [[Chapitre français|CSA-FR]]
__Contact :__ https://CloudSecurityAlliance.fr et [img(200px,auto)[iCSF/Email-CSA_FR.png]]
!Les partenariats
<<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>
[>img(200px,auto)[iCSF/cloud-security-alliance.png]]La [[Cloud Security Alliance]] (CSA) est une organisation à but non lucratif qui a pour mission :
* de promouvoir de bonnes pratiques en matière d'assurance de la sécurité dans le Cloud Computing
* de fournir des formations sur les utilisations du Cloud Computing pour aider à sécuriser toutes les autres formes d'informatique
La [[Cloud Security Alliance]] est dirigée par une vaste coalition de praticiens de l'industrie, d'entreprises, d'associations et d'autres intervenants clés.
[img(25%,1px)[iCSF/BluePixel.gif]]
__Historique__
[>img[CSA|iCSA/CSA.ico]]Les enjeux et opportunités du cloud computing ont fait l'objet d'une attention particulière en 2008 au sein de la communauté de la sécurité de l'information.
Lors du forum CISO de l'ISSA à Las Vegas, en novembre 2008, le concept de d'une Alliance pour la sécurité du Cloud Computing ([[Cloud Security Alliance]]) a vu le jour. Après une présentation des tendances émergentes par ''[[Jim Reavis|https://www.linkedin.com/in/jimreavis/]]'', dont un appel à l'action pour la sécurisation du cloud computing, ''Jim Reavis'' et ''[[Nils Puhlmann|https://www.linkedin.com/in/npuhlmann/]]'' ont présenté la mission et la stratégie initiales de la CSA. Une série de réunions organisationnelles avec des chefs de file de l'industrie au début de décembre 2008 a officialisé la fondation de la CSA.
Le travail de sensibilisation auprès de la communauté de la sécurité de l'information pour créer un support de travail initial en vue de la Conférence RSA 2009 a donné lieu à des échanges entre des dizaines de bénévoles pour la recherche, l'auteur, la rédaction et la révision du premier livre blanc.
[img(25%,1px)[iCSF/BluePixel.gif]]
__Mission__
[>img[CSA|iCSA/CSA.ico]]Promouvoir l'utilisation des meilleures pratiques pour fournir une assurance de sécurité dans le Cloud Computing, et fournir de l'éducation sur les utilisations du Cloud Computing pour aider à sécuriser toutes les autres formes d'informatique.
[img(25%,1px)[iCSF/BluePixel.gif]]
|!Objet|!→ Liens|
|''Site Web ''CSA''
 • Flux RSS''|''→ https://CloudSecurityAlliance.org
→ https://cloudsecurityalliance.org/feed/ ''| |Annonces|→ https://cloudsecurityalliance.org/articles/ | |Presse|→ https://blog.cloudsecurityalliance.org/press-coverage/ | |Blog|→ https://blog.cloudsecurityalliance.org/ | |Recherche
 • Commentaires|→ https://cloudsecurityalliance.org/research/
→ https://cloudsecurityalliance.org/research/contribute/ | |Groupes de travail|→ https://cloudsecurityalliance.org/meetings/ | |Publications|→ https://cloudsecurityalliance.org/research/artifacts/ | |Registre ''STAR''|→ https://cloudsecurityalliance.org/star/registry/ | |Aspects ''RGPD''|→ https://gdpr.cloudsecurityalliance.org/ | |Formation ''CCAK''|→ https://cloudsecurityalliance.org/education/ccak/ | |Formation ''CCSK''|→ https://ccsk.cloudsecurityalliance.org/ | |!|!| |Profil __LinkedIN__|→ https://www.linkedin.com/groups/1864210/profile | |Flux __Twitter__|→ https://twitter.com/cloudsa |
{{floatC{[img(400px,auto)[iCSF/Email-CSA_FR.png]]
[img(100px,auto)[iCSF/Cloud_Question.png]]
@@font-size:75%;@@
}}}
[img(40%,1px)[iCSF/BluePixel.gif]][img[iCSF/In.png][https://www.linkedin.com/groups/3758242]] [img(40%,1px)[iCSF/BluePixel.gif]]
Lien vers le groupe ''LinkedIN'' du [[Chapitre Français]] de la [[Cloud Security Alliance]]
:→ https://www.linkedin.com/groups/3758242
[>img(200px,auto)[iCSF/cloud-security-alliance.png]]Le [[Chapitre Français]] de la [[Cloud Security Alliance]] est une association formée pour faire la promotion des meilleures pratiques de sécurité au sein des infrastructures Cloud Computing.
Il se charge notamment :
* d'adapter certains documents de la [[Cloud Security Alliance]] aux spécificités françaises (notamment réglementaires)
* de favoriser les bonnes pratiques de sécurité auprès des prestataires et founisseurs de Cloud français et auprès des Entreprises qui batissent des Clouds Privés
* de publier de nouvelles recommandations de sécurité relatives au Cloud Computing
* de traduire certains documents de la [[Cloud Security Alliance]] en français
* de mener des actions pour former et évangéliser sur la sécurité du Cloud Computing
* de participer à la communauté des chapitres européens regroupés sous l'appellation "''CSA EMEA''"[>img(200px,auto)[iCSF/CSA-EMEA.png]]
* d'établir des relations avec la presse et avec des groupes de travail similaires traitant soit du Cloud Computing, soit de la Sécurité
* de participer à tout type d'événements ou de conférences liés à la sécurité du Cloud Computing
[img(25%,1px)[iCSF/BluePixel.gif]]
Le site du [[Chapitre Français]] de la [[Cloud Security Alliance]] est https://www.CloudSecurityAlliance.fr/
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>
Le site de la [[Cloud Security Alliance]] est https://www.CloudSecurityAlliance.org/
[img(25%,1px)[iCSF/BluePixel.gif]]
<<QOTD RolledHeader 1852 noclick norandom>>
<<QOTD RolledLeftCol 3704 noclick norandom>>
<<QOTD RolledMainW 9250 noclick norandom>>
[img(40%,1px)[iCSF/BluePixel.gif]][img[Lien vers l'espace Slack du Chapitre Français|iCSF/Slack_ani.gif][https://csafr.slack.com/]] [img(40%,1px)[iCSF/BluePixel.gif]]
Lien vers l'espace ''Slack'' du [[Chapitre Français]] de la [[Cloud Security Alliance]]
:→'' https://csafr.slack.com ''
[img(40%,1px)[iCSF/BluePixel.gif]][img[Lien vers le compte Twitter du Chapitre Français|iCSF/Twitter_icon.png][https://twitter.com/cloudsaFR]] [img(40%,1px)[iCSF/BluePixel.gif]]
Lien vers le flux Twitter du [[Chapitre Français]] de la [[Cloud Security Alliance]]
:→ https://twitter.com/cloudsaFR
[img(40%,1px)[iCSF/BluePixel.gif]][img[Lien vers le compte Twitter du Chapitre Français|iCSF/Twitter_icon.png][https://twitter.com/cloudsaFR]] [img(40%,1px)[iCSF/BluePixel.gif]]
__Autres flux Twitter à suivre :__
* Flux de la [[Cloud Security Alliance]]
:→ https://twitter.com/cloudsa
* Flux ''CSACloudbytes''
:→ https://twitter.com/hashtag/CSACloudbytes
<<tiddler fAll2Tabs7 with: _Veille19>><<tiddler .ReplaceTiddlerTitle with: "Veille Web Cloud et Sécurité">>
<<tiddler [[Veille.20xx.Archives]]>>
<<tiddler fAll2Tabs4 with: _Veille1x>>
Les archives sont organisées par année, de 2018 à 2009.
__[[Veille Cloud et Sécurité|2020.01.31 - Veille - Janvier 2020]]__ → l'actualité
----
__[[Actualités CSA|2020.01.Actu]]__ → l'actualité Cloud Security Alliance France et monde
----
__[[Alertes Cloud et Sécurité|2020.01.31 - Alertes]]__ → les alertes
----
__[[Publications CSA|2020.01.Publ]]__ → les publications de la Cloud Security Alliance
----
__[[Newsletters Hebdomadaires|2020.01.NewsL]]__ → nouveautés et veille hebdomadaire
----
__[[Blog CSA|2020.01.Blog]]__ → les articles de Blog du [[Chapitre Français]] et de la [[Cloud Security Alliance]]
----
__[[Sécurité@Cloud|Forum Sécurité@Cloud]]__ → Salon et conférences les 18 et 19 mars 2020 à Paris
----
Espace [[Slack]] du [[Chapitre Français]] : ''[[csafr.slack.com|https://csafr.slack.com/]]''
[img[Lien vers l'espace Slack du Chapitre Français|iCSF/Slack_ani.gif][https://csafr.slack.com/]]''[[csafr.slack.com|https://csafr.slack.com/]]''
----
L'espace __[[Slack]]__ du [[Chapitre Français]] de la [[Cloud Security Alliance]]
----
''[[Sécurité@Cloud|https://cloudsecurityalliance.fr/go/k3iE/]]''
18/19 mars 2020
Paris, France
[img(125px,auto)[Sécurité@Cloud|iCSF/ForumSecuriteCloud-2.jpg]]
----
__Références__
[[Cloud Controls Matrix]]
[img(125px,auto)[CCM|iCSA/CAOBCCM.png][Cloud Controls Matrix]]
|<<tiddler [[LatestWeeklyNewsletter]]>> |
----
<<tiddler [[LatestMonthlyUpdates]]>>
----
|<<tiddler [[Top Articles]]>> |
----
|TablNoBord|k
|>|background-color:#00F; @@color:#FFF;''La galaxie CSA''@@ |
|background-color:#EEF;[img(100px,auto)[CCM|iCSA/CAOBCCM.png][CCM]]|background-color:#EEF;[img(100px,auto)[Menaces|iCSA/TopThreats_logo.png][Menaces]]|
|background-color:#EEF;[img(100px,auto)[CCSK|iCSA/H8UBCCSK.png][CCSK]]|background-color:#EEF;[img(100px,auto)[CAIQ|iCSA/CSA-CAI.png][CAIQ]]|
|background-color:#EEF;[img(100px,auto)[CCSK|iCSA/CCAK.png][CCAK]]|background-color:#EEF;|
----
''La galaxie CSA''
[img(400px,auto)[iCSA_/CSAGalaxy.png]]
----
<<tiddler [[CCM - Domaines]]>>
----
<<tiddler [[CCM - Référentiels]]>>
----
@@color:#00F;font-size:112%;<html><i class="fa fa-arrow-circle-right fa-2x" aria-hidden="true"></i></html>@@ Vous pouvez nous joindre sur [[LinkedIN]] et [[Slack]]
<<tiddler [[LinkedIN]]>>
<<tiddler [[Slack]]>>
!Les articles les plus lus en 2019 :
# 2019.05.14 : [[Analyse du DHS/CISA sur les risques liés à Office 365|2019.05.14 - Blog : Analyse du DHS/CISA sur les risques liés à Office 365]]+++*[»]> <<tiddler [[2019.05.14 - Blog : Analyse du DHS/CISA sur les risques liés à Office 365]]>>=== 
# 2019.10.25 : [[Modèle MITRE ATT&CK adapté au Cloud|2019.10.25 - Actu : Modèle MITRE ATT&CK adapté au Cloud]]
# 2019.08.06 : [[Top Threats to Cloud Computing: Egregious Eleven|2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']]+++*[»]> <<tiddler [[2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']]>>=== 
# 2019.08.03 : [[Mise à jour et compléments pour la CCM v3.0.1|2019.08.03 - Publication : Mise à jour et compléments pour la CCM v3.0.1]]+++*[»]> <<tiddler [[2019.08.03 - Publication : Mise à jour et compléments pour la CCM v3.0.1]]>>=== 
# 2019.07.01 : [[Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs|2019.07.01 - Blog : Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs]]+++*[»]> <<tiddler [[2019.07.01 - Blog : Utiliser CAIQ-Lite pour évaluer des prestataires ou fournisseurs]]>>=== 
# 2019.02.16 : [[Compromission de Visma, prestataire Cloud en Norvège|2019.02.16 - Blog : Compromission de Visma, prestataire Cloud en Norvège]]+++*[»]> <<tiddler [[2019.02.16 - Blog : Compromission de Visma, prestataire Cloud en Norvège]]>>=== 
<<tiddler [[2020.01.26 - Newsletter Hebdomadaire]]>>
<<tiddler fAny2List16 with: '202002","202001","201912' 'Dernières mises à jour'>>
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 202001>>
<<tiddler fAll2Tabs10 with: VeilleM","_202001>>
|!Janvier|!Sources|!Titres et Liens|!Keywords|
|>|>|>|Aucune alerte pour le moment|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Janvier 2020]]>>
<<tiddler fAll2LiTabs with: NewsL","202001>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Janvier 2020]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Janvier 2020]]>><<tiddler fAll2LiTabs with: 'Actu","202001'>>
<<tiddler fAll2LiTabs with: 'Blog","202001'>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Janvier 2020]]>>
<<tiddler fAll2LiTabs with: 'Publ","202001'>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Janvier 2020]]>>
!1 - Les nouveautés CSA de la semaine du 20 au 26 janvier 2020
* Actu : Clap de fin pour ''Cloudwatt'' +++*[»]> <<tiddler [[2020.01.26 - Actu : Clap de fin pour Cloudwatt]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : ''Blockchain et règlementation'', un sujet à creuser +++*[»]> <<tiddler [[2020.01.23 - Blog : 'Can you arrest a decentralized autonomous organization that lives in outer space?']]>>=== 
* Appel à Commentaires : document "''The Six Pillars of DevSecOps: Collective Responsibility''" +++*[»]> <<tiddler [[2020.01.21 - Actu : Appel à commentaires : 'The Six Pillars of DevSecOps: Collective Responsibility']]>>=== 
* Appel à Commentaires : document "''Cloud Industrial IoT - ICS Security Glossary''" +++*[»]> <<tiddler [[2020.01.15 - Actu : Appel à commentaires : 'Cloud Industrial IoT - ICS Security Glossary']]>>=== 
* Appel à Commentaires : document sur la ''gestion des risques pour les équipements médicaux connectés au Cloud'' +++*[»]> <<tiddler [[2020.01.20 - Actu : Appel à commentaires : 'Managing the Risk for Medical Devices Connected to the Cloud']]>>=== 
!2 - Veille Web
La [[Veille Web|2020.01.26 - Veille Hebdomadaire]] avec seulement une cinquantaine de liens dont :
* A lire : Disponibilité de ''Azure Security Benchmark v1 (ASB)'' +++*[»]> 
|2020.01.23|//Microsoft Azure//|![[Azure Security Benchmark - 90 security and compliance best practices for your workloads in Azure|https://www.microsoft.com/security/blog/2020/01/23/azure-security-benchmark-90-security-compliance-best-practices-azure-workloads/]]|Azure Benchmark|
|2020.01.23|//Microsoft Azure//| → [[Azure security benchmarks documentation|https://docs.microsoft.com/en-us/azure/security/benchmarks/]]|Azure Benchmark|
===, document de la ''NSA'' sur les vulnérabilités du Cloud +++*[»]> 
|2020.01.22|NSA|![[Mitigating Cloud Vulnerabilities|https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF]]|Mitigation Best_Practices|
=== 
* Fuites de données : plusieurs cas avec AWS +++*[»]> 
|2020.01.24|VPNmentor|[[Report: Adult Site Leaks Extremely Sensitive Data|https://www.vpnmentor.com/blog/report-pussycash-leak/]]|Data_Leak AWS_S3|
|>|>|>|!|
|2020.01.22|VPNmentor|[[Report: Cannabis Users’ Sensitive Data Exposed in Data Breach|https://www.vpnmentor.com/blog/report-thsuite-breach/]]|Data_Leak AWS_S3|
|2020.01.23|The Register| → [[Sorry to be blunt about this... Open AWS S3 storage bucket just made 30,000 potheads' privacy go up in smoke|https://www.theregister.co.uk/2020/01/23/thsuite_data_exposed/]]|Data_Leak AWS_S3|
|>|>|>|!|
|2020.01.20|Computer Weekly|[[Exposed AWS buckets again implicated in multiple data leaks|https://www.computerweekly.com/news/252476870/Exposed-AWS-buckets-again-implicated-in-multiple-data-leaks]]|Data_Leaks AWS|
|>|>|>|!|
|2020.01.23|//Upguard//|[[Identity and Access Misstep: How an Amazon Engineer Exposed Credentials and More|https://www.upguard.com/breaches/identity-and-access-misstep-how-an-amazon-engineer-exposed-credentials-and-more]]|DataLeak AWS|
|2020.01.23|The Register| → [[Hapless AWS engineer spilled passwords, keys, confidential internal training info, customer messages on public GitHub|https://www.theregister.co.uk/2020/01/23/aws_engineer_credentials_github/]]|DataLeak AWS|
===, Azure +++*[»]> 
|2020.01.22|//Microsoft Azure//|![[Access Misconfiguration for Customer Support Database|https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/]]|DataLeak Azure|
|2020.01.23|//Comparitech//| → [[Report: 250 million Microsoft customer service and support records exposed on the web|https://www.comparitech.com/blog/information-security/microsoft-customer-service-data-leak/]]|DataLeak Azure|
|2020.01.22|Redmond Channel partner| → [[Azure Misconfiguration Exposes 250 Million Microsoft Customer Accounts|https://rcpmag.com/articles/2020/01/22/azure-misconfiguration-exposes-250-million.aspx]]|DataLeak Azure|
|2020.01.23|Security Boulevard| → [[Microsoft Leaks 250M Customer Details in Azure Fat-Finger Faux Pas|https://securityboulevard.com/2020/01/microsoft-leaks-250m-customer-details-in-azure-fat-finger-faux-pas/]]|DataLeak Azure|
=== 
* Panne : AWS en Australie +++*[»]> 
|2020.01.23|CRN AU|[[AWS cloud issues hit Sydney region|https://www.crn.com.au/news/aws-cloud-issues-hit-sydney-region-536921]]|Outage AWS Australia|
|2020.01.23|CRN AU| → [[AWS reveals rollback required to restore Sydney outage|https://www.crn.com.au/news/aws-reveals-rollback-required-to-restore-sydney-outage-536969]]|Outage AWS Australia|
== 
* Rapport : croissance de Kubernetes selon le rapport annuel du CNCF +++*[»]> 
|2020.01.21|Container Journal|[[CNCF Annual Report Shows Kubernetes Growth|https://containerjournal.com/topics/container-ecosystems/cncf-annual-report-shows-kubernetes-growth/]]|Report Kubernetes|
=== 
* Divers : cloud et DRP +++*[»]> 
|2020.01.24|Computer Weekly|![[Disaster recovery failover choices: Synchronous mirrors, P2V and the cloud|https://www.computerweekly.com/news/252477296/Disaster-recovery-failover-choices-Synchronous-mirrors-P2V-and-the-cloud]]|DRP|
===, Conformité, Forensique dans le Cloud +++*[»]> 
|2020.01.24|Forensic Focus|![[Industry Roundup: Cloud Forensics|https://articles.forensicfocus.com/2020/01/24/industry-roundup-cloud-forensics/]]|Forensics|
===, Kubernetes, et Sécurisation AWS
!3 - Contacts
Rejoignez nous sur [[Slack]] (si vous êtes déjà membre de notre groupe sur [[LinkedIN]]), et d'ici quelques semaines, sur [[Circle|Circle CSA]].
|!Janvier|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2020.01.24|
|2020.01.24|Forensic Focus|![[Industry Roundup: Cloud Forensics|https://articles.forensicfocus.com/2020/01/24/industry-roundup-cloud-forensics/]]|Forensics|
|2020.01.24|CyberDefense Mag|[[Moving Network Security to The Cloud|https://www.cyberdefensemagazine.com/moving-network-security-to-the-cloud/]]|SASE|
|2020.01.24|Computer Weekly|![[Disaster recovery failover choices: Synchronous mirrors, P2V and the cloud|https://www.computerweekly.com/news/252477296/Disaster-recovery-failover-choices-Synchronous-mirrors-P2V-and-the-cloud]]|DRP|
|2020.01.24|VPNmentor|[[Report: Adult Site Leaks Extremely Sensitive Data|https://www.vpnmentor.com/blog/report-pussycash-leak/]]|Data_Leak AWS_S3|
|2020.01.24|//Veracode//|[[Forrester Study on the Benefits of Cloud vs. On-Premises AppSec|https://www.veracode.com/blog/research/forrester-study-benefits-cloud-vs-premises-appsec-1]] ([[rapport|https://info.veracode.com/analyst-report-forrester-tei-report-saas-based-appsec-platform.html]]|Report|
|2020.01.24|//Rapid7//|[[Seven Tips for Better Cloud Security in 2020|https://blog.rapid7.com/2020/01/24/seven-tips-for-better-cloud-security-in-2020/]]|Best_Practices|
|2020.01.24|//Compare the Cloud//|[[IoT in the Cloud: Azure vs AWS|https://www.comparethecloud.net/articles/cloud/iot-in-the-cloud-azure-vs-aws/]]|IoT AWS Azure|
|>|>|>|!2020.01.23|
|2020.01.23|Silicon[>img[iCSF/flag_fr.png]]|[[Collaboratif : Slack localise les données en France|https://www.silicon.fr/collaboratif-slack-localise-les-donnees-en-france-333235.html]]|Slack|
|2020.01.23|KitPloit|[[AlertResponder - Automatic Security Alert Response Framework By AWS Serverless Application Model|https://www.kitploit.com/2020/01/alertresponder-automatic-security-alert.html]]|AWS Alerting|
|2020.01.23|CRN AU|[[AWS cloud issues hit Sydney region|https://www.crn.com.au/news/aws-cloud-issues-hit-sydney-region-536921]]|Outage AWS Australia|
|2020.01.23|CRN AU| → [[AWS reveals rollback required to restore Sydney outage|https://www.crn.com.au/news/aws-reveals-rollback-required-to-restore-sydney-outage-536969]]|Outage AWS Australia|
|2020.01.23|Data Privacy + Security Insider|[[Crime-as-a-Service Targets Popular Platforms|https://www.dataprivacyandsecurityinsider.com/2020/01/crime-as-a-service-targets-popular-platforms/]]|Crime-as-a-Service|
|2020.01.23|//Upguard//|[[Identity and Access Misstep: How an Amazon Engineer Exposed Credentials and More|https://www.upguard.com/breaches/identity-and-access-misstep-how-an-amazon-engineer-exposed-credentials-and-more]]|DataLeak AWS|
|2020.01.23|The Register| → [[Hapless AWS engineer spilled passwords, keys, confidential internal training info, customer messages on public GitHub|https://www.theregister.co.uk/2020/01/23/aws_engineer_credentials_github/]]|DataLeak AWS|
|2020.01.23|//Microsoft Azure//|![[Azure Security Benchmark - 90 security and compliance best practices for your workloads in Azure|https://www.microsoft.com/security/blog/2020/01/23/azure-security-benchmark-90-security-compliance-best-practices-azure-workloads/]]|Azure Benchmark|
|2020.01.23|//Microsoft Azure//| → [[Azure security benchmarks documentation|https://docs.microsoft.com/en-us/azure/security/benchmarks/]]|Azure Benchmark|
|2020.01.23|//Cloud Academy//|[[Learn Cloud Computing: Prerequisites|https://cloudacademy.com/blog/prerequisites-to-learn-cloud-computing-introduction/]]|Misc|
|2020.01.23|//Security Intelligence//|[[Head in the Clouds: Scaling Business Workloads Without Scaling Risk|https://securityintelligence.com/posts/head-in-the-clouds-scaling-business-workloads-without-scaling-risk/]]|Workloads|
|>|>|>|!2020.01.22|
|2020.01.22|Silicon[>img[iCSF/flag_fr.png]]|[[Accès à privilèges dans le cloud : l’évidence de la sécurisation|https://www.silicon.fr/avis-expert/acces-a-privileges-dans-le-cloud-levidence-de-la-securisation]]|Access_Controls|
|2020.01.22|NSA|![[Mitigating Cloud Vulnerabilities|https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF]]|Mitigation Best_Practices|
|2020.01.23|Dark Reading| → [[NSA Offers Guidance on Mitigating Cloud Flaws|https://www.darkreading.com/cloud/nsa-offers-guidance-on-mitigating-cloud-flaws/d/d-id/1336871]]|Mitigation Best_Practices|
|2020.01.22|VPNmentor|[[Report: Cannabis Users’ Sensitive Data Exposed in Data Breach|https://www.vpnmentor.com/blog/report-thsuite-breach/]]|Data_Leak AWS_S3|
|2020.01.23|The Register| → [[Sorry to be blunt about this... Open AWS S3 storage bucket just made 30,000 potheads' privacy go up in smoke|https://www.theregister.co.uk/2020/01/23/thsuite_data_exposed/]]|Data_Leak AWS_S3|
|2020.01.22|HelpNet Security|[[Container security requires continuous security in new DevSecOps models|https://www.helpnetsecurity.com/2020/01/22/container-security-continuous-security/]]|Containers DevSecOps|
|2020.01.22|Computer Weekly|[[Spread of Kubernetes spurs backup and disaster recovery products|https://www.computerweekly.com/feature/Spread-of-Kubernetes-spurs-backup-and-disaster-recovery-products]]|DRP Kubernetes|
|2020.01.22|Kubernetes|[[KubeInvaders - Gamified Chaos Engineering Tool for Kubernetes|https://kubernetes.io/blog/2020/01/22/kubeinvaders-gamified-chaos-engineering-tool-for-kubernetes/]]|Kubernetes Chaos_Engineering|
|2020.01.22|//Gremlin//|[[Democratizing Chaos Engineering and Progressing From Why to How|https://www.gremlin.com/blog/year-in-review/]]|Chaos_Engineering|
|2020.01.22|//Microsoft Azure//|![[Access Misconfiguration for Customer Support Database|https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/]]|DataLeak Azure|
|2020.01.23|//Comparitech//| → [[Report: 250 million Microsoft customer service and support records exposed on the web|https://www.comparitech.com/blog/information-security/microsoft-customer-service-data-leak/]]|DataLeak Azure|
|2020.01.22|Redmond Channel partner| → [[Azure Misconfiguration Exposes 250 Million Microsoft Customer Accounts|https://rcpmag.com/articles/2020/01/22/azure-misconfiguration-exposes-250-million.aspx]]|DataLeak Azure|
|2020.01.23|Security Boulevard| → [[Microsoft Leaks 250M Customer Details in Azure Fat-Finger Faux Pas|https://securityboulevard.com/2020/01/microsoft-leaks-250m-customer-details-in-azure-fat-finger-faux-pas/]]|DataLeak Azure|
|2020.01.22|//Security Intelligence//|[[Which Incident Response Investments Are You Prioritizing in 2020?|https://securityintelligence.com/articles/which-incident-response-investments-are-you-prioritizing-in-2020/]]|Incident Investments|
|2020.01.22|//Rapid7//|[[Vulnerability Management in the Cloud: Addressing the AWS Shared Responsibility Model|https://blog.rapid7.com/2020/01/22/vulnerability-management-in-the-cloud-addressing-the-aws-shared-responsibility-model/]]|Vulnerability_Management AWS|
|2020.01.22|//Octarine//|[[Octarine Adds 2 Open Source Projects to Secure Kubernetes|https://containerjournal.com/topics/container-security/octarine-adds-2-open-source-projects-to-secure-kubernetes/]]|Kubernetes|
|2020.01.22|//Octarine//|[[kube-scan - Octarine k8s cluster risk assessment tool|https://github.com/octarinesec/kube-scan]]|Tools|
|2020.01.22|//Octarine//|[[KCCSS - Kubernetes Common Configuration Scoring System|https://github.com/octarinesec/kccss]]|Tools|
|2020.01.22|//QuickHeal//|[[First Node.js-based Ransomware : Nodera|https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/]]|Node.js Ransomware|
|2020.01.22|//Checkpoint//|[[The Challenge of Compliance in the Cloud|https://blog.checkpoint.com/2020/01/22/the-challenge-of-compliance-in-the-cloud/]]|Compliance|
|>|>|>|!2020.01.21|
|2020.01.21|CRN AU|[[AWS slashes DR prices by 80 percent|https://www.crn.com.au/news/aws-slashes-dr-prices-by-80-percent-536795]]|AWS DRP|
|2020.01.21|Container Journal|[[CNCF Annual Report Shows Kubernetes Growth|https://containerjournal.com/topics/container-ecosystems/cncf-annual-report-shows-kubernetes-growth/]]|Report Kubernetes|
|2020.01.21|//Radware//|[[The Move to Multiple Public Clouds Creates Security Silos|https://blog.radware.com/security/2020/01/the-move-to-multiple-public-clouds-creates-security-silos/]]|Public_Cloud|
|2020.01.21|//Portshift//|[[Techniques and strategies to overcome Kubernetes security challenges|https://www.helpnetsecurity.com/2020/01/21/kubernetes-security-challenges/]]|Kubernetes|
|2020.01.21|//Compare the Cloud//|[[Demystifying the cloud for CFOs|https://www.comparethecloud.net/articles/cfos-last-cloud-holdouts/]]|Misc|
|2020.01.21|//Cisco//|[[How DNS-Layer Security Can Improve Cloud Workloads|https://umbrella.cisco.com/blog/2020/01/23/how-dns-layer-security-can-improve-cloud-workloads/]]|DNS|
|2020.01.21|//Cisco//|[[What is Cloud Security?|https://umbrella.cisco.com/blog/2020/01/21/what-is-cloud-security/]]|Misc|
|2020.01.21|//Armor//|[[How to Secure AWS: Advanced Strategies and Best Practices|https://www.armor.com/blog/secure-aws/]]|AWS Best_Practices|
|2020.01.21|//Cloud Academy//|[[Kubernetes: The Current and Future State of K8s in the Enterprise|https://cloudacademy.com/blog/kubernetes-the-current-and-future-state-of-k8s-in-the-enterprise/]]|Kubernetes|
|2020.01.21|//Orca//|[[Unlocking the Key to the Cloud|https://blog.orca.security/unlocking-the-key-to-the-cloud]]|Key_Management|
|2020.01.21|//StackRox//|[[Using Containers and Kubernetes to Increase the Efficacy of Anomaly Detection|https://www.cncf.io/blog/2020/01/21/using-containers-and-kubernetes-to-increase-the-efficacy-of-anomaly-detection/]]|Detection|
|>|>|>|!2020.01.20|
|2020.01.20|Rick's Cloud|[[IoT Devices and Cloud Computing: Friends or Foes? (infographie)|https://rickscloud.com/infographic-iot-devices-and-cloud-computing-friends-or-foes/]]|IoT|
|2020.01.20|Computer Weekly|[[Exposed AWS buckets again implicated in multiple data leaks|https://www.computerweekly.com/news/252476870/Exposed-AWS-buckets-again-implicated-in-multiple-data-leaks]]|Data_Leaks AWS|
|2020.01.20|CSO|[[How Adobe monitors cloud deployments to control shadow IT|https://www.csoonline.com/article/3514449/how-adobe-monitors-cloud-deployments-to-control-shadow-it.html#tk.rss_cloudsecurity]]|Shadow_IT|
|2020.01.20|Solutions Review|[[Preparing Your Cloud Solutions for CCPA: Three Steps to Follow|https://solutionsreview.com/cloud-platforms/preparing-your-cloud-solutions-for-ccpa-three-steps-to-follow/]]|Compliance|
[>img(200px,auto)[iCSF/Cloudwatt.jpg]]Cloudwatt, 6 septembre 2012 - 31 janvier 2020.
Comme le précise la "FAQ - Fermeture de la plateforme" :
* "''[...] la plateforme Cloudwatt sera désactivée à compter du 1er février 2020 et sans action de votre part vos données seront définitivement effacées et non récupérables.''"
* Il ne vous reste plus que quelques jours pour "''transférer le plus rapidement possible vos applications et/ou vos données vers un autre service et à fermer votre compte.''"

Voici quelques liens pour les quelques jours qui restent, et pour se replonger dans une histoire malheureuse commencée il y a plus d'une décennie avec ''Andromède''.
||Twitter[>img[iCSF/flag_fr.png]]|le compte [[Cloudwatt|https://twitter.com/cloudwatt]]|<<tiddler RollCloudwatt>>|
||Twitter|le hashtag [[#cloudwatt|https://twitter.com/hashtag/cloudwatt]]|~|
||Wikipedia[>img[iCSF/flag_fr.png]]|[[Cloudwatt|https://fr.wikipedia.org/wiki/Cloudwatt]]|~|
||Wikipedia[>img[iCSF/flag_fr.png]]|[[Andromède|https://fr.wikipedia.org/wiki/Androm%C3%A8de_(cloud)]]|~|
||Cloudwatt[>img[iCSF/flag_fr.png]]|![[FAQ - Fermeture de la plateforme|https://support.cloudwatt.com/kb/faq/fermeture/]]|~|
|2019.08.29|Rude baguette[>img[iCSF/flag_fr.png]]|[[Cloudwatt : vie et mort du premier « cloud souverain » de la France|https://www.rudebaguette.com/2019/08/cloudwatt-orange-cloud-souverain-fin/]]||
|2019.08.01|Les Echos[>img[iCSF/flag_fr.png]]|[[Une page se tourne pour le cloud souverain français|https://www.lesechos.fr/tech-medias/hightech/une-page-se-tourne-pour-le-cloud-souverain-francais-1118112]]|~|
|2019.07.31|le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Cloudwatt : arrêt définitif de service en février 2020|https://www.lemondeinformatique.fr/actualites/lire-cloudwatt-arret-definitif-de-service-en-fevrier-2020-76055.html]]|~|
|2019.07.31|ZDnet[>img[iCSF/flag_fr.png]]|[[Cloudwatt : arrêt du service en février prochain|https://www.zdnet.fr/actualites/cloudwatt-arret-du-service-en-fevrier-prochain-39888593.htm]]|~|
|2016.12.20|ZDnet[>img[iCSF/flag_fr.png]]|[[Retour vers le futur - Cloudwatt et Numergy, les souverains descendent du nuage|https://www.zdnet.fr/actualites/retour-vers-le-futur-cloudwatt-le-souverain-descend-de-son-nuage-39813666.htm]]|~|
|2015.03.21|Direction Générale des Entreprises[>img[iCSF/flag_fr.png]]|[[Acquisition par Orange de Cloudwatt|https://www.entreprises.gouv.fr/dge/acquisition-par-orange-cloudwatt]] ([[Communiqué .pdf|https://www.entreprises.gouv.fr/files/files/directions_services/secteurs-professionnels/numerique/cloud-computing.pdf]])|~|
|2015.03.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloudwatt sur les rails de la croissance d'Orange Business Services|https://www.silicon.fr/cloudwatt-sur-les-rails-de-la-croissance-dorange-business-services-111309.html]]|~|
|2015.03.17|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Numergy et Cloudwatt : embrouilles sur le financement étatique|https://www.silicon.fr/numergy-et-cloudwatt-embrouilles-sur-le-financement-etatique-111295.html]]|~|
|2015.03.03|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Le faux départ du Cloud souverain (tribune)|https://www.silicon.fr/faux-depart-cloud-souverain-109780.html]]|~|
|2015.03.24|Les Echos[>img[iCSF/flag_fr.png]]|[[Cloud souverain, un gâchis à la française|https://www.lesechos.fr/2015/02/cloud-souverain-un-gachis-a-la-francaise-1105856]]|~|
|2014.09.24|Next INpact[>img[iCSF/flag_fr.png]]|Cloud souverain : deux ans après, on fait le point ([[1|https://www.nextinpact.com/dossier/734-cloud-souverain-deux-ans-apres-on-fait-le-point/1.htm]]) ([[2|https://www.nextinpact.com/dossier/734-cloud-souverain-deux-ans-apres-on-fait-le-point/2.htm]]) ([[3|https://www.nextinpact.com/dossier/734-cloud-souverain-deux-ans-apres-on-fait-le-point/3.htm]])|~|
|2012.09.06|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Projet Andromède : Orange et Thales matérialisent leur alliance avec Cloudwatt|https://www.silicon.fr/projet-andromede-orange-et-thales-materialisent-leur-alliance-avec-cloudwatt-78219.html]]|~|
[img[iCSF/flag_fr.png]]oc[img(50%,1px)[iCSF/BluePixel.gif]]
<<QOTD RolledCloudwatt 1852 noclick norandom>>
[img(100px,auto)[iCSF/Cloudwatt.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_1.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_2.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_3.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_4.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_5.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_4.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_3.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_2.png]]
----
[img(100px,auto)[iCSF/Cloudwatt_1.png]]
!"//Can you arrest a decentralized autonomous organization that lives in outer space?//"
[>img(150px,auto)[iCSA/K1NBC.jpg]]Article de blog publié le 23 janvier 2020 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//One aspect of the modern world is that lawbreaking has gotten more and more ambiguous. If I ship a pile of electronic scooters to some random city and pay contractors to drop them off around the city, have I just committed some bizarre act of littering? What about creating a website that lets people list their spare bedroom for rent and connect with people who want to rent it, typically something that isn’t regulated in most places. But what if people start subletting apartments via this site and essentially turn their apartments into short term hotels, an industry that tends to be highly regulated? Well it turns out it’s pretty simple, regulators simply define new terms or redefine old terms and create new regulations and laws to cover these new activities (“But it’s a horseless taxi! Totally different!”).

The same logic has generally been used to apply to jurisdiction. Even where you have a missing jurisdiction (“the Zone of Death”), you usually have some legal entity responsible for what is going on (a person or a company) that does reside in some jurisdiction somewhere (e.g. ships in international waters are registered in a country). Even if they live outside your jurisdiction, at least it gives you someone or something to talk to and negotiate with.

But what if the legal entity is a smart contract running on a blockchain, controlled by a technical voting process that usually boils down to voting based on how many units of the entity is owned by a voting organization. Oh and ownership of this obviously support anonymous and pseudonymous modes, assuming they even have any record-keeping or KYC (“Know Your Customer”) going on. A regulator could attempt to make contact with the owners of the DAO, if they can figure out who that is, and even then you’d still have to convince a majority of the DAO owners to vote in favor of whatever is being proposed. Again traditionally one way to deal with this is to talk to the Blockchain that runs the workload; however, as this is rapidly going away, it turns out that building security into these smart contract systems keeps not only the bad guys out, but also deflects regulation.

Conclusion: if you think things are weird and messy now, just wait until a billionaire starts tweeting via a communications platform in outer space. Oh wait:// [>img(300px,auto)[iCSA/K1NBC.png]]
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1nb/]] sur le blog de la CSA.
!"//The Six Pillars of DevSecOps: Collective Responsibility//"
<<<
//The DevSecOps Working Group identified and defined six focus areas critical to integrating DevSecOps into an organization, in accordance with the six pillars described in CSA’s Reflexive Security Framework.
More detailed research and guidance across each of the six pillars of DevSecOps will be revisited and established over time in order to maintain industry specific standards.
This paper is part of a planned series and will focus on the area that is arguably the foundation for all others – collective responsibility. Fostering a sense of collective security responsibility is not only an essential element of driving security into a DevOps environment, but it is also one of the most challenging.
It requires cultivating a change to the organization’s mindset, its ideas and its customs and behaviors regarding software security.
In this paper, we refer to this effort as building a security-supportive culture.//
<<<
La date limite pour faire les commentaires est fixée au ''5 février 2020''.
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1la/]] sur le site de la CSA.
!"//Managing the Risk for Medical Devices Connected to the Cloud//"
<<<
//With the increased number of Internet of Things devices, Healthcare Delivery Organizations are experiencing a digital transformation bigger than anything in the past.
The new breed of connected medical devices brings the promise of improved patient care, better clinical data, improved efficiency, and reduced costs; however, they also bring increased security risks.
The goal of this paper is to present the concept of managing medical devices based on their proximity to the patient and introduce practices to secure the use of cloud computing for medical devices.//
<<<
La date limite pour faire les commentaires est fixée au ''14 février 2020''.
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1ka/]] sur le site de la CSA.
!1 - Les nouveautés CSA de la semaine du 13 au 19 janvier 2020
* Blog : Les prévisions de ''Jim Reavis'' pour 2020 +++*[»]> <<tiddler [[2020.01.17 - Blog : Les prévisions de Jim Reavis pour 2020]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : Dans les coulisses du groupe de travail CSA ''IoT'' +++*[»]> <<tiddler [[2020.01.15 - Blog : 'Behind the Scenes: IoT Working Group']]>>=== 
* Appel à Commentaires : document "''Cloud Industrial IoT - ICS Security Glossary''" +++*[»]> <<tiddler [[2020.01.15 - Actu : Appel à commentaires : 'Cloud Industrial IoT - ICS Security Glossary']]>>=== 
!2 - Veille Web
La [[Veille Web|2020.01.19 - Veille Hebdomadaire]] avec seulement une quarantaine de liens dont
* A lire : Certificat ISO 27701 pour Azure +++*[»]>
|2020.01.13|//Microsoft Azure//|[[Azure is now certified for the ISO/IEC 27701 privacy standard|https://azure.microsoft.com/en-us/blog/azure-is-now-certified-for-the-iso-iec-27701-privacy-standard/?cdn=disable]]|Azure privacy ISO_27701|
===, Nouveau Benchmark CIS pour Kubernetes +++*[»]>
|2020.01.15|//Google Cloud//|[[Exploring container security: Announcing the CIS Google Kubernetes Engine Benchmark|https://cloud.google.com/blog/products/containers-kubernetes/gke-cis-benchmarks-deliver-security-best-practices]]|Kubernetes Benchmark Best_Practices|
|2020.01.15|Center for Internet Security|![[CIS Kubernetes Benchmark version 1.5.0|https://www.cisecurity.org/benchmark/]]|Kubernetes Benchmark Best_Practices|
=== 
* Attaques : JhoneRAT +++*[»]>
|2020.01.16|Talos|[[JhoneRAT: Cloud based python RAT targeting Middle Eastern countries|https://blog.talosintelligence.com/2020/01/jhonerat.html]]|Attacks|
|2020.01.20|GBHackers on Security| → [[JhoneRAT – Hackers Launching New Cloud-based Python RAT to Steal Data From Google Drive, Twitter & Google Forms|https://gbhackers.com/jhonerat/]]|Attacks|
=== 
* Divers : Annonce du Bug Bounty Kubernetes, conférence Cloud et Sécurité en 2020, impact sur les données lors de la faillite d'un CSP, Sécurité du Multi-cloud, extrait d'un livre sur les tests d'intrusion AWS avec Kali
|!Janvier|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2020.01.19|
|2020.01.19|//Cloudhelix//|[[Multicloud Gets Real, Virtual Machines Reboot, Security Goes Vertical: Are You Ready for Cloud 2020|https://www.cbronline.com/cloud/cloud-2020-outlook/]]|Predictions|
|2020.01.19|Nino Crudele|![[Azure tools: Aziverso is being refactored|https://ninocrudele.com/azure-tools-aziverso-being-refactored]]|Azure Scanning|
|>|>|>|!2020.01.17|
|2020.01.17|Le MagIT[>img[iCSF/flag_fr.png]]|[[Azure AD Premium P1 ou P2 : lequel vous convient le mieux ?|https://www.lemagit.fr/conseil/Azure-AD-Premium-P1-ou-P2-lequel-vous-convient]]|AzureAD|
|2020.01.17|//Checkpoint//|[[Achieving Continuous Compliance at the Speed of Cloud|https://blog.checkpoint.com/2020/01/17/achieving-continuous-compliance-at-the-speed-of-cloud/]]|Compliance|
|2020.01.17|//Checkpoint//|[[Cloud Native Security: What it Means|https://blog.checkpoint.com/2020/01/17/cloud-native-security-what-it-means/]]|Cloud_Native|
|2020.01.17|//ParkMyCloud//|[[Cloud Certification Guide: How to Master & Showcase Your Expertise in AWS, Azure, & Google Cloud|https://www.parkmycloud.com/blog/cloud-certification/]]|Certifications|
|2020.01.17|//Compare the Cloud//|[[Cloud service provider: Which questions should you be asking your CSP?|https://www.comparethecloud.net/articles/cloud-service-provider-questions/]]|Misc|
|2020.01.17|//Rancher//|[[Find Security Vulnerabilities in Kubernetes Clusters|https://rancher.com/blog/2020/kubernetes-security-vulnerabilities/]]|Kubernetes Vulnerabilities|
|2020.01.17|Cloud Security Alliance|[[CSA 2019 Year in Review and look into 2020 with Co-Founder & CEO Jim Reavis|https://www.buzzsprout.com/303731/2513809-csa-2019-year-in-review-and-look-into-2020-with-co-founder-ceo-jim-reavis]] ([[audio|https://episodes.buzzsprout.com/1yo09wjdy3o6dxermt10lnq3gaer]])|CSA Predictions|
|>|>|>|!2020.01.16|
|2020.01.16|Maarten Goet|[[Detecting CVE-2020–0601 and other attempts to exploit known vulnerabilities using Azure Sentinel|https://medium.com/wortell/detecting-cve-2020-0601-and-other-attempts-to-exploit-known-vulnerabilities-using-azure-sentinel-652fbcc0364c]]|Vulnerability CVE-2020-0601 Azure|
|2020.01.16|ThreatStack|[[The Best Cloud Security Conferences to Attend in 2020|https://www.threatstack.com/blog/the-best-cloud-security-conferences-to-attend-in-2020]]|Conference|
|2020.01.16|InsiderPro|[[Why multicloud security is your next big challenge|https://www.idginsiderpro.com/article/3514669/why-multicloud-security-is-your-next-big-challenge.html]]|Multi_Cloud|
|2020.01.16|Security Infowatch|[[Debunking 4 of the biggest cloud myths|https://www.securityinfowatch.com/video-surveillance/hosted-managed-video-surveillance/article/21121726/debunking-4-of-the-biggest-cloud-myths]]|Misc|
|2020.01.16|Talos|[[JhoneRAT: Cloud based python RAT targeting Middle Eastern countries|https://blog.talosintelligence.com/2020/01/jhonerat.html]]|Attacks|
|2020.01.17|ZDNet| → [[JhoneRAT exploits cloud services to attack Middle Eastern countries|https://www.zdnet.com/article/jhonerat-exploits-microsoft-office-cloud-services-to-attack-middle-eastern-countries/]]|Attacks|
|2020.01.20|GBHackers on Security| → [[JhoneRAT – Hackers Launching New Cloud-based Python RAT to Steal Data From Google Drive, Twitter & Google Forms|https://gbhackers.com/jhonerat/]]|Attacks|
|2020.01.16|//Recorded Future//|[[How Security Intelligence Enhances Cloud Security|https://www.recordedfuture.com/cloud-security-intelligence/]]|Threat_Intelligence|
|2020.01.16|//PaloAlto Networks//|[[Getting Cloud Smart: Security for Hybrid and Public Federal Clouds|https://blog.paloaltonetworks.com/2020/01/cloud-federal-clouds/]]|Hybrid_Cloud Government|
|>|>|>|!2020.01.15|
|2020.01.15|TradePub|"Hands-on AWS Penetration Testing with Kali Linux" : chapitre [[Exploitation on the Cloud using Kali Linux|https://sf.tradepub.com/free-offer/aws-penetration-testing-with-kali-linux--free-sample-chapters/w_pacb109]]|PenTest|
|2020.01.15|MSSP Alert|[[AWS Cloud Data Leak: UK Consulting Firms’ Sensitive Information Exposed|https://www.msspalert.com/cybersecurity-breaches-and-attacks/aws-data-leak-uk-consulting-exposures/]]|Data_Leak AWS|
|2020.01.15|The Sneak Life|[[Une nouvelle ère de Sécurité du cloud marché est en croissance dans la demande énorme en 2020|https://www.thesneaklife.com/2020/01/15/une-nouvelle-ere-de-securite-du-cloud-marche-est-en-croissance-dans-la-demande-enorme-en-2020-trend-micro-inc-mcafee-llc-symantec-corporation-international-business-machines-corporation/]]|Market_Analysis|
|2020.01.15|//Microsoft Azure//|![[New Azure blueprint for CIS Benchmark|https://azure.microsoft.com/en-us/blog/new-azure-blueprint-for-cis-benchmark/]]|Azure Benchmark|
|2020.01.15|//Google Cloud//|[[Exploring container security: Announcing the CIS Google Kubernetes Engine Benchmark|https://cloud.google.com/blog/products/containers-kubernetes/gke-cis-benchmarks-deliver-security-best-practices]]|Kubernetes Benchmark Best_Practices|
|2020.01.15|Center for Internet Security|![[CIS Kubernetes Benchmark version 1.5.0|https://www.cisecurity.org/benchmark/]]|Kubernetes Benchmark Best_Practices|
|2020.01.15|//Catalogic Software//|[[Catalogic Software Announces KubeDR - Open Source Kubernetes Disaster Recovery|https://vmblog.com/archive/2020/01/15/catalogic-software-announces-kubedr-open-source-kubernetes-disaster-recovery.aspx]]|Kubernetes DRP|
|2020.01.15|//PaloAlto Networks//|[[Your SaaS Security Checklist|https://blog.paloaltonetworks.com/2020/01/cloud-saas-security/]]|SaaS|
|2020.01.15|//Tripwire//|[[Key Cloud Security Challenges and Strategies to Overcome Them|https://www.tripwire.com/state-of-security/security-data-protection/cloud/key-cloud-security-challenges-strategies/]]|Strategies|
|2020.01.15|//Nuage Networks//|[[How SD-WAN Helps Achieve Data Security and Threat Protection|https://www.darkreading.com/cloud/how-sd-wan-helps-achieve-data-security-and-threat-protection-/a/d-id/1336724]]|SDWAN|
|>|>|>|!2020.01.14|
|2020.01.14|UK Authority|[[Home Office signs cloud deal with AWS|https://www.ukauthority.com/articles/home-office-signs-cloud-deal-with-aws/]]|Government AWS UK|
|2020.01.14|Blackblaze|[[A Sandbox in the Clouds: Software Testing and Development in Cloud Storage|https://www.backblaze.com/blog/a-sandbox-in-the-clouds-software-testing-and-development-in-cloud-storage/]]|Storage|
|2020.01.14|Kubernetes|![[Announcing the Kubernetes bug bounty program|https://kubernetes.io/blog/2020/01/14/kubernetes-bug-bounty-announcement/]]|Kubernetes Bug_Bounty|
|2020.01.14|Cloud Native Computing Foundation| → [[Introducing the Kubernetes Bug Bounty Program|https://www.cncf.io/blog/2020/01/14/introducing-the-kubernetes-bug-bounty-program/]]|Kubernetes Bug_Bounty|
|2020.01.14|HackerOne| → [[Kubernetes Bug Bounty Program|https://hackerone.com/kubernetes]]|Kubernetes Bug_Bounty|
|2020.01.14|Silicon Angle| → [[CNCF launches Kubernetes bug bounty program |https://siliconangle.com/2020/01/14/cncf-launches-kubernetes-bug-bounty-program/]]|Kubernetes Bug_Bounty|
|2020.01.14|International Journal of Cloud Computing| → [[Secure cloud computing using homomorphic construction|https://www.inderscience.com/info/inarticle.php?artid=104498]]|Encryption Homomorphic|
|2020.01.17|TechXplore|[[Homomorphic encryption for cloud users|https://techxplore.com/news/2020-01-homomorphic-encryption-cloud-users.html]]|Encryption Homomorphic|
|2020.01.14|//Microsoft//|[[The Changing Face of Cloud Threat Intelligence|https://www.securityweek.com/changing-face-cloud-threat-intelligence]]|CTI|
|2020.01.14|//G2//|[[Exploring the Future of Cloud Computing in 2020 and Beyond|https://learn.g2.com/future-of-cloud-computing]]|History|
|2020.01.14|//Kindite//|![[The Last Encryption Gap - Data in Use|https://blog.kindite.com/the-last-encryption-gap-data-in-use]]|Encryption|
|>|>|>|!2020.01.13|
|2020.01.13|AGEFI[>img[iCSF/flag_fr.png]]|[[Données en danger dans la faillite du cloud-provider|http://www.agefi.com/home/acteurs/detail/edition/online/article/donnees-en-danger-dans-la-faillite-du-cloud-provider-493333.html]]|CSP Failure|
|2020.01.13|Silicon[>img[iCSF/flag_fr.png]]|[[Orchestration des conteneurs : pour quels cas d’usage et avec quelles solutions ?|https://www.silicon.fr/avis-expert/orchestration-des-conteneurs-pour-quels-cas-dusage-et-avec-quelles-solutions]]|Containers|
|2020.01.13|CSO|[[Moving security operations to the cloud|https://www.csoonline.com/article/3512589/moving-security-operations-to-the-cloud.html]]|OpSec|
|2020.01.13|CISO Mag|[[5 Threat Predictions for 2020: Are You Prepared?|https://www.cisomag.com/threat-predictions-for-2020/]]|Predictions|
|2020.01.13|Hackin9|[[AWS Report - a tool for analyzing amazon resources|https://hakin9.org/aws-report-a-tool-for-analyzing-amazon-resources/]]|Tools AWS|
|2020.01.13|//Microsoft Azure//|[[Azure is now certified for the ISO/IEC 27701 privacy standard|https://azure.microsoft.com/en-us/blog/azure-is-now-certified-for-the-iso-iec-27701-privacy-standard/?cdn=disable]]|Azure privacy ISO_27701|
|2020.01.13|//PaloAlto Networks//|[[Why Cloud Security Seems So Hard, and How to Overcome These Challenges|https://blog.paloaltonetworks.com/2020/01/cloud-security-challenges/]]|Challenges|
!"//2020 Predictions: Hear Me Now and Believe Me Later//"
[>img(150px,auto)[iCSA/K1HB3.jpg]][>img(150px,auto)[iCSA/K1HB2.jpg]]Article de blog publié le 17 janvier 2020 — Rédigé par Jim Reavis, Co-Founder et CEO de la CSA
<<<
//I am typing up my prediction blog using an invisible ink font, to reduce my embarrassment when 2021 rolls by. I know prediction articles can be a dime a dozen and prognosticators pick both easy and vague items to appear smarter than they are. I am all about that!
Before I give you my predictions, here are a few predictions others made about the year 2020:
* In 1994, RAND Corp predicted we would have ape chauffeurs.
* In 1957, Popular Mechanics said roads would be replaced by pneumatic tubes. Hyperloop isn’t quite there yet.
* In 1955, Lewyt Vacuum Company said vacuums would be nuclear powered. Yikes!
* In a 1911 Lecture at the Royal College of Surgeons of England, it was predicted that human feet would become one big toe.
* In 1900, John Elfreth Watkins Jr., the curator at the Smithsonian, said C, X, and Q would not be part of the alphabet. He wouldn’t be a fan of cloud computing.
My predictions won’t be perfect, but they will be better than that. So, here we go.
[>img(150px,auto)[iCSA/JimReavis.jpg]]
''#1 We will see an increase in Cloud Breaches''. This is primarily a function of market adoption, more usage and more data in the cloud. It is going to be caused by ”Bread and Butter” security issues:
* Misconfigured VMs, Containers, Firewalls & Storage Buckets
* Poorly managed credentials, keys, often found through “GitHub scraping.”
* Lack of multifactor authentication & IdM strategy
* API insecurity
* Change control & patching deficiencies
''#2 Artificial Intelligence "Deepfake" Ransomware''. We have already seen Deepfake spearphishing, such as when a UK company was scammed out of $243k by a Deepfake voice message purporting to be that of their German CEO. Deepfakes are getting so good that they will make for a compelling click. I see them being deployed with worm technology and with ransomware being a logical payload.

''#3 2020 US Presidential Election Mischief''. Forget about state actors hacking the election or social media manipulation being used to change the results, that is above my pay grade. I am talking about security attacks on the rest of us due to this being the most controversial and passionate presidential election in modern times. I see three attacks happening. Widespread phishing attacks will be successful due to the high passions and hyperbole. Hacktivists will target businesses appearing to lean towards one party or another. I also see ransomware attacks on government agencies.

''#4 The Year of Serverless Security''. Serverless computing, such as Function-as-a-Service, is all the rage right now. It is easy to see why, you relieve the application developer from a great deal of server management considerations and the generous pricing structure from cloud service providers makes this compelling. We are still in the early days of understanding exactly how we secure Serverless. This can be exacerbated by developers designing applications in a way that expose its weaknesses, such as inadvertently creating frequent unexpected triggering events. Serverless Security will be a big topic, we will see new startups dealing with it and we will leave the year with a better perspective of when to use Serverless and how to secure it.

''#5 Cloud Portability''. Portability of applications in the cloud has become more difficult with each passing year. Cloud service providers have created so many valuable and proprietary services that developers love, leading to a world where applications tend to be tightly coupled with their underlying infrastructure-as-a-service. This is the market at work, and many enterprises I have talked to have said a loss of portability is a trade they are willing to make in exchange for having clear accountability from the provider. Still, I have a suspicion that by the end of the year, there will be an initiative to revisit portability from stakeholders that are concerned about the downsides of lock-in.

Well, I think we will leave it at five as I don’t want to use my incredible powers to give you this year’s Super Bowl winner. I wish you all a happy and prosperous new year, let’s enjoy watching 2020 unfold together!//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1hb/]] sur le blog de la CSA.
&rArr; Écouter [[l'interview|https://CloudSecurityAlliance.fr/go/k1hi/]] de Jim Reavis sur le même sujet
!"//Cloud Industrial Internet of Things (IIoT) - Industrial Control Systems Security Glossary//"
<<<
//The Industrial Control Systems (ICS) Security Glossary is a reference document that brings together ICS and IT/OT related terms and definitions.
Bringing together the terms and definitions in this document is meant to minimize misinterpretation and provide a common ICS and IT/OT language.
A balance has been struck between length of the definitions and understandability with reliance on the reference source as the final arbiter.
The goal is to provide a common language to communicate, understand, debate, conclude, and present the results of the ICS WG’s work.
The intended audience is everyone from the Board to security staff inside an organization to customers and third-party suppliers including cloud service providers.//
<<<
La date limite pour faire les commentaires est fixée au ''15 février 2020''.
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1fa/]] sur le blog de la CSA.
!"//Behind the Scenes: IoT Working Group with Mark Yanalitis//"
[>img(150px,auto)[iCSA/K1FBB.jpg]]Article de blog publié le 15 janvier 2020 — Rédigé par Mark Yanalitis et la CSA
<<<
//Here at CSA, our working groups are the core of what we do. From researching best practices, to tackling challenges on the horizon, they bring together security professionals from diverse backgrounds and experiences to collaborate on research that will benefit the entire industry.
In this blog series we will be interviewing different working group members to help give you an idea of what it looks like to participate in a working group. For our first blog we asked Mark Yanalitis to share his reason for joining the CSA Internet of Things Working Group and what his experience has been like.

__Interview with Mark Yanalitis__
Mark Yanalitis, MS MA CISSP is an independent security researcher, IoT work group member, and former teaching adjunct at Carnegie Mellon University Heinz College of Information Systems and Policy.

The Cloud Security Alliance (CSA) Internet of Things (IoT) work group preceded me. I was a late add. The work group already produced useful and polished works in the areas of IoT control matrix objectives, responses fulfilling National Institutes of Standards (NIST) request for public comment, and recently the distribution of the OWASP Firmware Security Testing Framework. A dedicated cadre of CSA professional backstop work groups, cross-pollinate efforts and manage the humble and essential coordination work. One of the regular challenges of national work groups is not necessarily having volunteer bench strength; it's working in a rapidly expanding data security and information privacy subject area while market adoption and technology uptake have a significant head start.

Many and varied IoT use cases exist for residential consumer, commercial, and industrial applications. Some "wouldn't it be great if" use cases existed but were in a state of dormancy. Industrial IoT (IIoT) embraced sensor-driven manufacturing line management and robotic process automation. The rapid and expansive growth in both mobile and cloud capability resulted in many existing and new IIoT use cases migrating into the commercial and consumer space while spurring the transformation of previously closed proprietary IIoT designs. The resulting rapid expansion of TCPIP and machine learning enabled sensors, assistants, toys, health devices, and home automation capability fundamentally changed threat landscapes, attack surfaces, and disclosure potentials.

The CSA IoT work group is one of several organizational bodies operating in the standards space. ENISA (European Union Agency for CyberSecurity), ESTI (EU Standards organization TC CYBER), IETF/IEEE, Internet Industry Consortium (IIC), NIST, OWASP, and UL (Underwriters Laboratories), represent major information outlets. As a researcher in this area of information security, membership in the CSA IoT work group allows me to make contributions as well as take in the perspectives of professionals who work directly in the IoT and IIoT work space. CSA IoT work group membership affords a low barrier to entry into the center of IoT data security and IoT privacy conversations, and like many other CSA venues and information outlets, CSA work group membership provides a high rate of return.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1fb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 6 au 12 janvier 2020
* Annonce : Nouvelle conférence Cloud et Sécurité "''SECtember''" de la CSA +++*[»]> <<tiddler [[2020.01.09 - Annonce : Nouvelle conférence SECtember de la CSA]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : 'Five ''Predictions'' to Impact Enterprise Network Security in 2020' +++*[»]> <<tiddler [[2020.01.10 - Blog : 'Five Predictions to Impact Enterprise Network Security in 2020']]>>=== 
* Blog : 'We Need More Women Mentors For a More Complete Cybersecurity Workforce' +++*[»]> <<tiddler [[2020.01.07 - Blog : 'We Need More Women Mentors For a More Complete Cybersecurity Workforce']]>>=== 
* Publication : première partie 'Critical Controls Implementation for Systems Applications and Product (SAP)' +++*[»]> <<tiddler [[2020.01.06 - Publication : 'Critical Controls Implementation for Systems Applications and Product (SAP)' (1/2)]]>>=== 
* Blog : 'Enterprise Architecture Cloud Delivery Model - CCM Mapping' +++*[»]> <<tiddler [[2020.01.06 - Blog : 'Enterprise Architecture Cloud Delivery Model - CCM Mapping']]>>=== 
!2 - Veille Web
La [[Veille Web|2020.01.12 - Veille Hebdomadaire]] avec seulement une quarantaine de liens dont
* A lire : Sur AWS, certains certificats expireront début mars 2020 +++*[»]>
|2020.01.07|//AWS//|![[Urgent & Important – Rotate Your Amazon RDS, Aurora, and Amazon DocumentDB (with MongoDB compatibility) Certificates|https://aws.amazon.com/blogs/aws/urgent-important-rotate-your-amazon-rds-aurora-and-documentdb-certificates/]]|AWS Certificates|
|2020.01.08|CBR Online| → [[AWS to DB Users: Download Fresh Certs Urgently, or Risk Applications Breaking|https://www.cbronline.com/cloud/aws-certificate-update/]]|AWS Certificates|
|2020.01.10|Continuity Central| → [[Amazon AWS warns certain users to update certificates or face lost connectivity |https://www.continuitycentral.com/index.php/news/technology/4780-amazon-aws-warns-certain-users-to-update-certificates-or-face-lost-connectivity]]|AWS Certificates|
=== 
* Attaques : Technique de mouvement latéral dans le Cloud +++*[»]>
|2020.01.06|SANS|![[Lateral traffic movement in Virtual Private Clouds|https://www.sans.org/reading-room/whitepapers/cloud/lateral-traffic-movement-virtual-private-clouds-39360]]|Attacks|
=== 
* Divers : AzureAD, Phishing O365, quelques prévisions pour 2020
|!Janvier|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2020.01.12|
|2020.01.12|//Active Directory Security//|[[What is Azure Active Directory?|https://adsecurity.org/?p=4211]]|AzureAD|
|>|>|>|!2020.01.11|
|2020.01.11|TechRadar|[[What is Amazon S3?|https://www.techradar.com/news/what-is-amazon-s3]]|AWS_S3|
|>|>|>|!2020.01.10|
|2020.01.10|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Google Cloud muscle son stockage archive face à AWS et Azure|https://www.silicon.fr/google-cloud-stockage-archive-aws-azure-332259.html]]|Storage|
|2020.01.10|HelpNet Security|[[Office 365 users: Beware of phishing emails pointing to Office Sway|https://www.helpnetsecurity.com/2020/01/10/phishing-office-sway/]]|O365 Attacks|
|2020.01.10|Bleeping_Computer|[[Enables Security Defaults in Azure Active Directory|https://www.bleepingcomputer.com/news/microsoft/microsoft-enables-security-defaults-in-azure-active-directory/]]|BleepingComputer|
|2020.01.10|NextGov|[[Can the Continuous Diagnostics and Mitigation Program Secure a Cloud Smart Government?|https://www.nextgov.com/ideas/2020/01/can-continuous-diagnostics-and-mitigation-program-secure-cloud-smart-government/162367/]]|Misc|
|2020.01.10|Federal News Network|[[Cloud computing and remote workers can reduce cybersecurity|https://federalnewsnetwork.com/federal-drive/2020/01/cloud-computing-and-remote-workers-can-reduce-cybersecurity/]] ([[audio mp3|http://www.podcastone.com/downloadsecurity?url=aHR0cHM6Ly9wZHN0LmZtL2UvY2h0YmwuY29tL3RyYWNrL0UyRzg5NS9hdy5ub3hzb2x1dGlvbnMuY29tL2xhdW5jaHBvZC9mZWRlcmFsLWRyaXZlL21wMy8wMTEwMjBfSGF6YXJfd2ViX3ZuYW9fYmU5N2I4NWMubXAzP2F3Q29sbGVjdGlvbklkPTExNDYmYXdFcGlzb2RlSWQ9ODRlNzBlYTItOTFkOS00MThmLThmYmEtMmI1YWJlOTdiODVjKip8MTU3ODgwODU3ODkyMioqfA==.mp3]])|Misc|
|2020.01.10|The Register|[[UK Home Office opens AWS cash firehose even wider with £100m public cloud services deal|https://www.theregister.co.uk/2020/01/10/home_office_hands_aws_100m_for_public_cloud_services/]]|AWS UK|
|2020.01.10|//Google Cloud//|[[Exploring container security: Navigate the security seas with ease in GKE v1.15|https://cloud.google.com/blog/products/containers-kubernetes/new-kubernetes-security-settings-2019]]|Containers|
|2020.01.10|//Cofense//|[[Phish Fryday – Cloud Services in Phishing Attacks|https://cofense.com/phish-fryday-cloud-services/]]|Attacks Phishing|
|2020.01.10|//Shared Assessments//|[[Ten Third Party Risk Management Trends to (Continuously) Monitor (and 7 resolutions to strengthen TPRM capabilities — and collaborations — in 2020)|https://sharedassessments.org/ten-third-party-risk-management-trends-to-continuously-monitor-and-7-resolutions-to-strengthen-tprm-capabilities-and-collaborations-in-2020/]]|Predictions|
|2020.01.10|//JumpCloud//|[[How To Extend Active Directory To The Cloud Without Azure|https://jumpcloud.com/blog/extend-ad-cloud-without-azure/]]|Active_Directory|
|2020.01.10|//Pen Test Partners//|[[IR & Forensics in the Cloud|https://www.pentestpartners.com/security-blog/ir-forensics-in-the-cloud/]]|Forensics|
|>|>|>|!2020.01.09|
|2020.01.09|Le MagIT[>img[iCSF/flag_fr.png]]|[[Comprendre comment fonctionne le réseau sous Kubernetes|https://www.lemagit.fr/conseil/Les-cles-pour-comprendre-comment-fonctionne-le-reseau-sous-Kubernetes]]|Kubernetes|
|2020.01.09|//Avanan//|[[Cybercriminals Use Microsoft Sway to Phish Office 365 Security and Your Well-Trained Users|https://www.avanan.com/blog/microsoft-sway-phishing]]|O365 Attacks|
|2020.01.09|//JDSupra//|[[Cloud Solutions Allowed for Encrypted, Unclassified Defense Data|https://www.jdsupra.com/legalnews/cloud-solutions-allowed-for-encrypted-52510/]]|Regulations Defense|
|2020.01.09|//Security Intelligence//|[[3 Multicloud Security Considerations for the Modern Enterprise|https://securityintelligence.com/posts/3-multicloud-security-considerations-for-the-modern-enterprise/]]|Multi_Cloud|
|2020.01.09|//Armor//|[[Cloud Security Tools: What You Need to Be Compliant and Secure|https://www.armor.com/blog/cloud-security-tools/]]|Tools|
|>|>|>|!2020.01.08|
|2020.01.08|Le MagIT[>img[iCSF/flag_fr.png]]|[[Comment Azure AD complète Active Directory|https://www.lemagit.fr/conseil/Comment-Azure-AD-complete-Active-Directory]]|AzureAD|
|2020.01.08|SANS|[[Security Visibility in AWS: Authority, Access and Capability|https://www.sans.org/cyber-security-intelligence/2020/01/08/security-visibility-in-aws-authority-access-and-capability]]|AWS|
|2020.01.08|//Microsoft//|[[Government data protection—earning and retaining the public’s trust with Microsoft 365|https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/08/government-data-protection-earning-retaining-public-trust-microsoft-365/]]|Azure O365 Government|
|2020.01.08|//Cyware//|[[Attackers Pick up Nasty Phishing Tactic to Gain Full Access to Users' Data Stored in the Cloud|https://cyware.com/news/attackers-pick-up-nasty-phishing-tactic-to-gain-full-access-to-users-data-stored-in-the-cloud-eaefb105]]|Phishing|
|2020.01.08|//ShiftLeft//|[[Accomplishing SOC 2 Type II in the Cloud-Native Kubernetes Era|https://blog.shiftleft.io/accomplishing-soc-2-type-ii-in-the-cloud-native-kubernetes-era-7786ff8811c3]]|Compliance Kubernetes SOC_2|
|2020.01.08|//Alibaba Cloud//|[[Easy Command-Line Access with Cloud Shell|https://medium.com/@Alibaba_Cloud/easy-command-line-access-with-cloud-shell-8e497624106f]]|Misc|
|>|>|>|!2020.01.07|
|2020.01.07|//AWS//|![[Urgent & Important – Rotate Your Amazon RDS, Aurora, and Amazon DocumentDB (with MongoDB compatibility) Certificates|https://aws.amazon.com/blogs/aws/urgent-important-rotate-your-amazon-rds-aurora-and-documentdb-certificates/]]|AWS Certificates|
|2020.01.08|CBR Online| → [[AWS to DB Users: Download Fresh Certs Urgently, or Risk Applications Breaking|https://www.cbronline.com/cloud/aws-certificate-update/]]|AWS Certificates|
|2020.01.10|Continuity Central| → [[Amazon AWS warns certain users to update certificates or face lost connectivity |https://www.continuitycentral.com/index.php/news/technology/4780-amazon-aws-warns-certain-users-to-update-certificates-or-face-lost-connectivity]]|AWS Certificates|
|>|>|>|!2020.01.06|
|2020.01.06|SANS|![[Lateral traffic movement in Virtual Private Clouds|https://www.sans.org/reading-room/whitepapers/cloud/lateral-traffic-movement-virtual-private-clouds-39360]]|Attacks|
|2020.01.06|Kamran Bilgrami|[[Ethical Hacking Lessons — Building Free Active Directory Lab in Azure|https://medium.com/@kamran.bilgrami/ethical-hacking-lessons-building-free-active-directory-lab-in-azure-6c67a7eddd7f]]|Azure Active_Directory|
|2020.01.06|//PagerDuty//|[[PagerDuty Focuses Incident Response Efforts on the Cloud|https://devops.com/pagerduty-focuses-incident-response-efforts-on-the-cloud/]]|Incident_Handling|
|2020.01.06|//Blissfully//|[[SaaS Security and Compliance for HR|https://www.blissfully.com/blog/saas-security-and-compliance-for-hr/]]|SaaS Compliance|
!"//Five Predictions to Impact Enterprise Network Security in 2020//"
[>img(150px,auto)[iCSA/K1ABF.jpg]]Article de blog publié le 10 janvier 2020 — Rédigé par +++*[Etay Bogner »]> https://linkedin.com/in/etaybogner/ ===, VP, Zero-Trust Products, +++*[Proofpoint »]> https://www.proofpoint.com/ ===
<<<
//Accelerating developments in security are playing a significant role in the evolution of enterprise networking. For years, the industry has relied on a hardware-centric, trust-based model that has become increasingly inflexible and insecure. Employees are no longer sitting in an office every day, working with local data center-based applications – there are now a wide range of popular cloud-based applications broadly deployed. It is not just that the perimeter is dissolving - security paradigms designed around the idea that users on the local area network (LAN) can be trusted are now considered high risk. As this trend continues into 2020, below are five enterprise security predictions expected to impact networking as business needs and threats both continue to evolve:
1. Security Stack Migration to the Cloud
:A fast-moving trend, expected to accelerate over the next 12 months, is that IT professionals will rely less on security protections delivered at the datacenter gateway. Instead, all security intelligence and updates will take place in the cloud. It has been going on for a long time, but now there is a consensus across the industry that the perimeter needs to be defined around the user and data rather than around offices. This means delivering security from the cloud, close to where user workspaces are located. This makes more sense than backhauling user traffic to the data center to consume security services there. Indeed, it eliminates the need to run after vulnerabilities and patch updates. For network security professionals, it’s easier to manage one central policy rather than per-site.
2. Platforms Instead of Products
:IT is gravitating toward centralization. The idea behind a more comprehensive platform that enables security services to be chained is that it will remove the need for complex integrations. In the area of network connectivity, this approach must include both network as a service and security as a service. As large enterprises make the transition, it will require numerous points of presence (PoPs) around the world so that it will always be as close as possible to the user or office in order to provide lower latency. Gartner recently formalized this approach and named it Secure Access Service Edge or SASE, a digital business enabler in the name of speed and agility.
3. Developing Technology from the Bottom Up
:A large number of vendors have announced their support for the SASE approach for several reasons. First, it encourages vendor consolidation to simplify technology acquisition and management. There has always been a debate between buying security from a single vendor for the convenience or buying best-of-breed solutions from multiple vendors. There is an increasing demand for the convergence of these two approaches. Vendors often buy third-party products to make a complete offering, but the integration (if any) is often rough and cumbersome. The new SASE architecture is an opportunity to deliver a complete offering in a way that is efficient for both the vendor and the enterprise. However, it means developing the technology from the bottom up using modern cloud-scale solutions. Many vendors with large legacy product offerings will have a problem with this.
4. Zero-Trust – Increased Focus on Users and Data
:The term Zero-Trust was widely used in 2019. Coined originally by Forrester research in 2010, it referred to a methodology for micro-segmenting the network. Today it has been expanded to a complete ZTX security framework. It makes sense to look at security in terms of what users are doing and what information they are accessing, rather than solely in terms of where their device is connected.
:Zero-trust enables administrators to limit the attack surface, continuously verify that users are who say they are, and ensure they are only accessing the data they really need. For most organizations, this is a long transformational journey and we are only at the beginning.
:Software Defined Perimeters (SDPs) are a great first step. SDPs offer a simple holistic approach where remote users no longer connect to a physical site, but to a global Network as a Service (NaaS) that provides continuously available secure connectivity. SDPs leverage huge technological advances associated with the megatrend of providing all forms of IT functionality as a service. IT resources within the SDP are typically hidden from public discovery and access is restricted by policy as needed. This removal of IT computing and data assets from general public access reduces the surface area in defense against IT security attacks.
5. Greater Convergence of Networking and Security
:The network is now everywhere. Much of the time, the backbone is the internet itself. It is now time to think of the enterprise network as virtual rather than physical and to ensure that the perimeter follows the user no matter where they are. It is no longer possible to separate the network from the security stack. Industry thought leaders are converging architecture and standardizing around this approach.
:While the cloud is the first important step for network security, it is not enough. Cloud networking is essential to delivering those services effectively over a true "virtual private network."
//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k1ab/]] sur le blog de la CSA.
!"//Cloud Security Alliance Announces SECtember, a New Annual Conference for the Future of Cybersecurity//"
<<<
[>img(200px,auto)[iCSA/202009US-Seattle.jpg]]SEATTLE – Jan. 9 2020 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, announced today it is changing the way the cloud and cybersecurity industry meets with the launch of +++*[SECtember »]> https://csacongress.org/event/sectember-2020/ ===, a signature event focused on educating the industry on key issues and trends faced in cloud and cybersecurity. Held in CSA’s home city of Seattle among the giants of cloud computing and the headquarters of several leaders within their respective industries, SECtember will feature in-depth training, networking opportunities and interactive sessions with global experts. ''The inaugural SECtember will be held Sept. 14-17, 2020'', at the Sheraton Grand Seattle.
“In 2009, CSA began defining cloud security before most organizations were in the cloud. In 2020, cloud computing is now the primary mode of computing around the world and is also the foundation for cybersecurity writ large and the means by which we secure all forms of computing, such as the Internet of Things. Seattle is well-established around the world as the center of cloud computing, and with the introduction of SECtember, it can be the focal point of cybersecurity, as well. CSA is making a permanent commitment to bring this signature event to our home city on an annual basis, which is rapidly becoming a magnet for companies in the technology and cloud space,” said Jim Reavis, CEO and co-founder, Cloud Security Alliance.
“SECtember will bring together thought leaders from five continents to provide a global perspective on strategic cloud and cybersecurity issues and will provide state-of-the-art educational activities. We have a great deal of pride in Seattle, and while the topic of our conference is serious, we guarantee that the event will also be fun,” he added.
The annual event will offer attendees an enhanced roster of training, including courses covering the Certificate of Cloud Security Knowledge (CCSK) Foundation (1 day), CCSK Plus (2-day) along with CCSK Plus AWS and Azure, Cloud Governance & Compliance (1 day), Advanced Cloud Security Practitioner (2-day), and Certificate of Cloud Auditing Knowledge (2-day), as well as other training sessions currently in development.
[...]
CSA will issue a Call for Papers for SECtember on February 3.
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k17b/]] sur le site de la CSA.
&rArr; le site de la conférence → ''[[CloudSecurityAlliance.fr/go/k9ee/|https://CloudSecurityAlliance.fr/go/k9ee/]]''
!"//We Need More Women Mentors For a More Complete Cybersecurity Workforce//"
[>img(150px,auto)[iCSA/K17BW.jpg]]Article de blog publié le 7 janvier 2020 — Rédigé par +++*[Sivan Tehila »]> https://www.linkedin.com/in/sivan-tehila/ ===, Director of Solution Architecture, +++*[Perimeter 81 »]> https://www.perimeter81.com/ ===
<<<
//It seems like everyone wants to get into the field of cybersecurity. However, this isn’t the case for women. The cybersecurity industry needs to rethink how to attract more women into the talent pool to bring more order into the gender balance. +++*[Research from Cybersecurity Ventures »]> https://cybersecurityventures.com/women-in-cybersecurity/ === shows that today women make up only 20% of the cybersecurity workforce. When it comes to recruiting women into the workforce, cybersecurity is clearly one of the worst industries for women to men ratios.
The lack of women in the cybersecurity workforce is diminishing the opportunities to fill out security positions.
The question is: how can the security industry successfully improve and increase the hiring of women in security? While there are many different challenges that women face in the security industry, I am here to highlight the different ways the security industry can improve their numbers of women in security moving forward.

__Starting at a Young Age__
The ongoing issue behind the massive gap between women and men in cybersecurity is starting from an initial perception of education at a young age. Until recently, women were not publicly shown as tech or security experts. Girls are being exposed to this idea at a very young age, and this vision and career choice continue with them when deciding which career they choose.
According to a study by +++*[Kaspersky Lab »]> https://usa.kaspersky.com/about/press-releases/2017_kaspersky-lab-study-most-women-decide-against-a-career-in-cybersecurity-before-age-16 ===, 45% of young women are not aware of the different cybersecurity career opportunities and one in six women thinks that a career in cybersecurity would be dull. The study even states that “a third of young women think that cybersecurity professionals are ‘geeks’ and a quarter think they are ‘nerds.’”
Introducing young women to the numerous STEM topics can provide a spark of interest for potential career paths early on. In order to increase the number of women entering the security fields, there needs to be an industry-accepted shift when it comes to women in security. Additionally, it is important to expose women of all ages to positive female role models from within cybersecurity and similar fields in order to change the way they are perceived.

__A Career in Cyber Comes with Benefits__
The first step to increase women in security is to emphasize all the different benefits and pluses that come with a career in cybersecurity. By joining the cybersecurity field, there are endless benefits that come with the job, such as job security, high pay, scholarships, and incentives. While there are thousands of cybersecurity jobs needed to be filled, the industry is seeing organizations seeking diversity in their workplaces, which is presenting more women to be hired in these positions. Due to the demand for skilled security people, pay for a career in cybersecurity is very high when compared to different industries.
Another major reason why women should shift left and join the cybersecurity space is that it is a field that is challenging and intriguing. The cybersecurity space is constantly changing and evolving, providing the opportunity to learn and experience different sectors that are not available or do not exist within other fields and career choices.
This career path allows women to be captivated by the always-changing work lifestyle, which presents different junctures where women can provide their expertise in decision making and strategizing, which will go a long way for their company. While in the end, everyone who works in cybersecurity plays a key role in fighting against cyberattacks - one thing is clear, the industry needs more women and the skills they offer. These different career benefits and motivations will encourage women to take an interest in learning more about the field and choose a career in cybersecurity.

__Team Diversity is Necessary & Beneficial__
Gender diversity in the workplace is +++[proven »]> https://www.gallup.com/workplace/236543/business-benefits-gender-diversity.aspx === to increase performance and turn higher profits. The reason for this is that men and women have different ideas, insights, and perspectives, which gives teams a more balanced attitude and varied approach to problem-solving.
Additionally, many women can feel intimidated breaking into a field that is male-dominated. Seeing other women on the team and in the office will encourage more women to apply and join the cybersecurity space. If women make up more than half of the world’s population, we should also make up at least half of the workforce.

__Women Mentors Needed__
While we are seeing an increase in women joining the cybersecurity field in the past few years, there is still a lack of women mentors in the field. According to a Kaspersky report, the majority of young women who work in security stated they rarely meet fellow women who work in the cybersecurity industry, and when they did meet women in the security workforce, it presented positive feedback on the industry.
So how can having female mentors in security bring more women into the field? Mentoring is important both from the point of view of helping to retain women in the industry, and attracting them to a career in security.
Publicizing different women security leaders and those upcoming in cybersecurity today as role models will encourage young women that cybersecurity is a potential career path. Organizations should take the time and effort to train and coach these role models so they can be mentors for younger women joining the organization and the industry. With the right mentorship and empowerment education, the cybersecurity industry can be one of the most intriguing career paths for women moving forward.

__Moving Forward__
Cybersecurity can be the ideal career path for anyone with the right skills, experience, and drive. By providing the right mix of female mentors in security and educating women in different career opportunities, organizations can take part in closing the skills gap by actively improving gender diversity within the industry. No matter what type of background each person comes from, they can play a huge role in closing the women in security gap in cybersecurity.
On a personal note, I find working in cybersecurity exciting, challenging, and constantly evolving. I wake up every morning and go into work knowing that I am helping protect people and businesses’ important resources, as well as their privacy. I am constantly learning new things and developing new skills in a field that requires me to always be on my toes and keeps my mind engaged.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k17b/]] sur le blog de la CSA.
!"//Enterprise Architecture Cloud Delivery Model | CCM Mapping//"
[>img(150px,auto)[iCSA/K16BE.jpg]]Article de blog publié le 6 janvier 2020 — Rédigé par le groupe de travail "Enterprise Architecture"
<<<
//The Enterprise Architecture working group has been developing a Cloud Service Delivery Model mapping which aims to give businesses who are building out their cloud program an inside look into roles and responsibilities when it comes to IaaS, PaaS, and SaaS and specific areas within each.
This phased approach that links directly from the Cloud Controls Matrix ([[CCM]]), gives a quick glance and delivery model for identifying key areas within a business and determining whether they are the responsibility of the vendor or the cloud consumer.

__Helps eliminate assumptions when migrating to the cloud__
The best part of direct mappings like this built from the Cloud Controls Matrix, is the immense support it can generate for companies who may not quite understand the different complex areas of switching to a cloud environment. It makes it so there are never any assumptions on who within the business, or outside of the business, is responsible for certain delivery methods. Often roles and responsibilities become a blurred line when dealing with SLA’s when venturing into the cloud, and the Enterprise Architecture working group is addressing these areas by eliminating the confusion within the realms of IaaS, PaaS, and SaaS developments. These three areas map directly to the Cloud Control Matrix’s 16 current domains for full coverage.
How the mapping works
To give a quick overview of how this mapping will work, we will look at the first category of the [[CCM]] mapping portion, which in this case would be Application & Interface Security (AIS-01 Control ID from the [[CCM]]). The environment of choice would then be chosen; for instance, SaaS is going to act as our delivery method. We then cross-reference a table with a category of either CSP (Cloud Service Provider) or CSC (Cloud Service Consumer). For this case, there is a “1” annotating “yes” under CSP, and a “0” under CSC annotating a “no” response. These answers lead us to the sole responsibility for this deployment instance. Because application and programming interfaces are designed, developed, deployed, and tested by the vendor for SaaS, the security is ultimately agreed upon that it is the service provider's responsibility.

__Provides a full circle approach__
It may seem like a simplistic approach, but it is one that needs to be provided to consumers and businesses to really begin a course of action into adopting policy and structure for ownership responsibilities within the cloud. This EA delivery model, combined with other CSA items such as the [[CAIQ]] and the Cloud Controls Matrix, can develop a full circle approach to diving into the cloud and beginning to understand the approaches that are needed to become successful in understanding the knowledge surrounding it.
More easily put:
* The [[CAIQ]] would be the questions used to ask a vendor about specific items that a business may need to suffice a request for a service
* The [[CCM]] would then be used to assess the risk associated with cloud delivery models.
* Lastly the EA quick guide mapping would identify the roles and ownership capabilities.
Being able to reference architecture such as this cloud delivery model can allow for a baseline internally and give consumers the peace of mind that they are taking the correct approach.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/k16b/]] sur le blog de la CSA.
!"//Cloud Security Alliance Releases First in a Series of Critical Controls Implementation for SAP Guidelines//"
<<<
[>img(200px,auto)[iCSA/K16AC.png]]//Critical Controls Implementation for SAP
The Critical Controls Implementation for SAP is the first in a series of implementation documents that the CSA ERP Security Working Group aims to develop. These documents will focus on specific ERP technologies, starting with SAP. The Critical Controls Implementation for SAP document will be released in 2 parts. Part 1 will feature the first 10 controls with the second part featuring the rest at a later date. The document takes a technical and granular approach including information such as implementation checklists and SAP transaction numbers.//
<<<
Les 10 premiers controles sont :
# APP01 - //Secure Landscape//
# APP02 - //Baseline Secure Configurations//
# APP03 - //Security Vulnerabilities//
# INT01 - //Secure Integrations and API//
# DAT01 - //Continuous Monitoring//
# DAT02 - //Data Separation//
# DAT03 - //Data Encryption//
# BUS01 - //Inventory of Business Assets, Data and Processes//
# BUS02 - //Business Process Controls//
# BUS03 - //Continuous Compliance//
__Liens :__
* Annonce : → ''[[CloudSecurityAlliance.fr/go/k16a/|https://cloudsecurityalliance.fr/go/k16a/]]''
* Publication : → ''[[CloudSecurityAlliance.fr/go/k16p/|https://cloudsecurityalliance.fr/go/k16p/]]''
* Document "Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers" de juin 2019
** +++*[Annonce »]> <<tiddler [[2019.06.10 - Publication : Top 20 Critical Controls for Cloud Enterprise Resource Planning (ERP) Customers]]>>=== 
** +++*[Téléchargement »]> 
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j6ax/|https://cloudsecurityalliance.fr/go/j6ax/]]''
=== 
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 30 décembre 2019 au 5 janvier 2020
* À lire : ''Bilan 2019 et perspectives 2020'' pour le Chapitre Français de la CSA +++*[»]> <<tiddler [[2020.01.01 - Editorial : Bilan 2019 et perspectives 2020]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Appel à commentaires "''Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS''" +++*[»]> <<tiddler [[2019.12.12 - Actu : Appel à commentaires, document 'Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS']]>>=== 
!2 - Veille Web
La [[Veille Web|2020.01.05 - Veille Hebdomadaire]] avec seulement une trentaine de liens dont
* Attaques : plus de MSSP impactés par Cloud Hopper +++*[»]> 
|2019.12.30|Wall Street Journal|[[Ghosts in the Clouds: Inside China’s Major Corporate Hack|https://www.wsj.com/articles/ghosts-in-the-clouds-inside-chinas-major-corporate-hack-11577729061]]|Attacks APT CloudHopper|
|2019.12.30|infoRisk Today| → [[Report: Cloud Hopper Attacks Affected More MSPs|https://www.inforisktoday.com/report-cloud-hopper-attacks-affected-more-msps-a-13565]]|Attacks APT CloudHopper|
|2020.01.03|Forbes| → [[5 Key Security Lessons From The Cloud Hopper Mega Hack|
=== 
* Faille : Starbucks (clé API exposée) +++*[»]> 
|2020.01.01|Security Affairs|[[Expert finds Starbucks API Key exposed online|https://securityaffairs.co/wordpress/95826/security/starbucks-api-key-exposed-online.html]]|API DataLeaks JumpCloud|
|2019.12.30|//HackerOne//| → [[JumpCloud API Key leaked via Open Github Repository.|https://hackerone.com/reports/716292]]|API DataLeaks JumpCloud|
|2020.01.03|CISO Mag| → [[Indian Researcher Finds Starbucks API Key Exposed Online|https://www.cisomag.com/indian-researcher-finds-starbucks-api-key-exposed-online/]]|API DataLeaks JumpCloud|
=== 
* Outils : S3Tk (pour AWS S3) +++*[»]> 
|2020.01.04|KitPloit|[[S3Tk - A Security Toolkit For Amazon S3|https://www.kitploit.com/2020/01/s3tk-security-toolkit-for-amazon-s3.html]]|[[Tools|Outils-GitHub]] AWS|
=== 
* Publication : première version officielle du document OWASP "API Security Top 10 2019" +++*[»]> 
|2019.12.31|OWASP|[[API Security Top 10 2019|https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf]]|APIs OWASP|
|2020.01.01|DevOps.com| → [[Breaking Down the OWASP API Security Top 10, Part 1|https://devops.com/breaking-down-the-owasp-api-security-top-10-part-1/]] (1/2)|OWASP API|
|2020.01.03|DevOps.com| → [[Breaking Down the OWASP API Security Top 10, Part 2|https://devops.com/breaking-down-the-owasp-api-security-top-10-part-2/]] (2/2)|OWASP API|
|2019.12.31|Information Security Forum |[[Conquering the Cyber Security Challenges of the Cloud|https://www.cpomagazine.com/cyber-security/conquering-the-cyber-security-challenges-of-the-cloud/]]|Challenges|
=== 
* Divers : containers, sondage Barracuda Networks, virtualisation, quelques prévisions pour 2020
|!Janvier|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2020.01.04|
|2020.01.04|KitPloit|[[S3Tk - A Security Toolkit For Amazon S3|https://www.kitploit.com/2020/01/s3tk-security-toolkit-for-amazon-s3.html]]|[[Tools|Outils-GitHub]] AWS|
|>|>|>|!2020.01.03|
|2020.01.03|Fedscoop|[[DHS conducting market research for cloud-based vulnerability disclosure platform|https://www.fedscoop.com/vulnerability-disclosure-cloud-platform-dhs-cisa/]]|Vulnerability_Disclosure|
|2020.01.03|Container Journal|[[Containers vs. VMs: A Closer Look|https://containerjournal.com/topics/container-ecosystems/containers-vs-vms-a-closer-look/]]|Containers VM|
|2020.01.03|//Zscaler//|[[Zscaler’s SASE platform brings security and policy closer to the user in a cloud-delivered service|https://siliconangle.com/2020/01/03/zscalers-sase-platform-brings-security-and-policy-closer-to-the-user-in-a-cloud-delivered-service-cubeconversations/]] '[[vidéo|http://www.youtube.com/watch?v=pE_qlkJRuV0]])|SASE|
|2020.01.03|//Akku//|[[Navigating the World of Data Security in the Cloud: Steps to Ensure Compliance|https://www.akku.work/blog/steps-to-ensure-security-compliance/]]|Compliance|
|2020.01.03|//Netwrix//|[[Organizations May 'Uncloud' Over Security, Budgetary Concerns|https://www.darkreading.com/cloud/organizations-may-uncloud-over-security-budgetary-concerns/a/d-id/1336670]]|Misc|
|2020.01.03|//Gartner//|[[Global Cloud Security Market Size, Status and Forecast 2019-2025|https://garnerinsights.com/Global-Cloud-Security-Market-Size-Status-and-Forecast-2019-2025]]|Market_Analysis|
|>|>|>|!2020.01.02|
|2020.01.02|Federal News Network|[[Many agencies still not using FedRAMP for cloud providers, GAO says|https://federalnewsnetwork.com/federal-drive/2020/01/many-agencies-still-not-using-fedramp-for-cloud-providers-gao-says/]]|FedRAMP Compliance|
|2020.01.02|//Google//[>img[iCSF/flag_fr.png]]|[[Le Cloud en 2020 (et peut-être au-delà)|https://www.journaldunet.com/solutions/expert/72369/le-cloud-en-2020--et-peut-etre-au-dela.shtml]]|Misc|
|2020.01.02|//Optiv//|[[Extending the Hybrid Cloud Lab|https://www.optiv.com/blog/extending-hybrid-cloud-lab]] (2/7)|NIST_SP800-190 Containers|
|2020.01.02|//Extrahop//|[[2020 will be the year of the cloud breach predicts ExtraHop|https://www.continuitycentral.com/index.php/news/technology/4747-2020-will-be-the-year-of-the-cloud-breach-predicts-extrahop]]|Predictions|
|>|>|>|!2020.01.01|
|2020.01.01|DZone|[[Why I Don't Mind Having a European AWS Competitor|https://dzone.com/articles/why-i-dont-mind-to-have-an-european-aws-competitor]]|Sovereign_Cloud Europe|
|2020.01.01|Security Affairs|[[Expert finds Starbucks API Key exposed online|https://securityaffairs.co/wordpress/95826/security/starbucks-api-key-exposed-online.html]]|API DataLeaks JumpCloud|
|2019.12.30|//HackerOne//| → [[JumpCloud API Key leaked via Open Github Repository.|https://hackerone.com/reports/716292]]|API DataLeaks JumpCloud|
|2020.01.03|CISO Mag| → [[Indian Researcher Finds Starbucks API Key Exposed Online|https://www.cisomag.com/indian-researcher-finds-starbucks-api-key-exposed-online/]]|API DataLeaks JumpCloud|
|2020.01.01|//Alibaba Cloud//|[[Six Typical Issues when Constructing a Kubernetes Log System|https://medium.com/datadriveninvestor/six-typical-issues-when-constructing-a-kubernetes-log-system-e1108a01f629]]|Kubernetes Logging|
|>|>|>||
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.31|
|2019.12.31|OWASP|[[API Security Top 10 2019|https://github.com/OWASP/API-Security/raw/master/2019/en/dist/owasp-api-security-top-10.pdf]]|APIs OWASP|
|2020.01.01|DevOps.com| → [[Breaking Down the OWASP API Security Top 10, Part 1|https://devops.com/breaking-down-the-owasp-api-security-top-10-part-1/]] (1/2)|OWASP API|
|2020.01.03|DevOps.com| → [[Breaking Down the OWASP API Security Top 10, Part 2|https://devops.com/breaking-down-the-owasp-api-security-top-10-part-2/]] (2/2)|OWASP API|
|2019.12.31|Information Security Forum |[[Conquering the Cyber Security Challenges of the Cloud|https://www.cpomagazine.com/cyber-security/conquering-the-cyber-security-challenges-of-the-cloud/]]|Challenges|
|2019.12.31|UK Authority|[[Scottish Government aims to boost national cloud take-up|https://www.ukauthority.com/articles/scottish-government-aims-to-boost-national-cloud-take-up/]]|Sovereign_Cloud|
|2019.12.31|VentureBeat|[[Protecting data on public clouds and edges with confidential computing|https://venturebeat.com/2019/12/31/protecting-public-cloud-and-edge-data-with-confidential-computing/]]|Confidential_Computing|
|2019.12.31|XaaS Journal|[[Survey says: Cloud Security Confidence is Growing|https://www.xaasjournal.com/survey-says-cloud-security-confidence-is-growing/]]|Survey|
|2020.01.01|CyberSecurity Insiders| → [[[Cloud Security confidence surging up says Barracuda Networks|https://www.cybersecurity-insiders.com/cloud-security-confidence-surging-up-says-barracuda-networks/]]|Survey|
|2019.12.31|NextGov|[[Survey: Feds View Security as Biggest Hurdle to Cloud Adoption|https://www.nextgov.com/it-modernization/2019/12/survey-feds-view-security-biggest-hurdle-cloud-adoption/162155/]]|Survey|
|2019.12.31|//Microsoft//|[[Zero Hype|https://techcommunity.microsoft.com/t5/azure-active-directory-identity/zero-hype/ba-p/1061413]]|Zero_Trust|
|2019.12.31|//JumpCloud//|[[Manage O365 Users Without The Azure AD Console|https://jumpcloud.com/blog/manage-o365-without-azure/]]|O365 AzureAD|
|2019.12.31|//Spanning//|![[Spanning’s Best of 2019|https://spanning.com/blog/spannings-best-of-2019/]]|Year_Recap|
|2019.12.31|//Fugue//|[[Fugue’s Top 5 Posts of 2019: Cloud-Native Exploits and the Ways Engineers are Preventing Them|https://www.fugue.co/blog/fugues-top-5-posts-of-2019-cloud-native-exploits-and-the-ways-engineers-are-preventing-them]]|Year_Recap|
|2019.12.31|//Cubbit Cell//|[[Next-Generation of Cloud Computing: Distributed Cloud|https://www.interestingengineering.com/next-generation-of-cloud-computing-distributed-cloud]]|Misc|
|2019.12.31|//Kindite//|![[Best Cloud Encryption Practices|https://blog.kindite.com/best-cloud-encryption-practices]]|Encryption|
|>|>|>|!2019.12.30|
|2019.12.30|Wall Street Journal|[[Ghosts in the Clouds: Inside China’s Major Corporate Hack|https://www.wsj.com/articles/ghosts-in-the-clouds-inside-chinas-major-corporate-hack-11577729061]]|Attacks APT CloudHopper|
|2019.12.30|infoRisk Today| → [[Report: Cloud Hopper Attacks Affected More MSPs|https://www.inforisktoday.com/report-cloud-hopper-attacks-affected-more-msps-a-13565]]|Attacks APT CloudHopper|
|2020.01.03|Forbes| → [[5 Key Security Lessons From The Cloud Hopper Mega Hack|
|2019.12.30|GCN|[[How agencies can bake data security into IoT and disaster recovery|https://gcn.com/articles/2019/12/24/software-defined-perimeter-iot-dr.aspx]]|Disaster_Recovery|
|2019.12.30|Cryptosmith|[[Online Course in Cloud Security Basics|https://cryptosmith.com/2019/12/30/online-course-in-cloud-security-basics/]]|Training|
|2019.12.30|MSSP Alert|[[Cloud Service Providers: Emerging As MSSPs?|https://www.msspalert.com/cybersecurity-companies/mssps/cloud-service-providers-emerging-as-mssps/]]|MSSP|
|2019.12.30|MSSP Alert|[[Big MSP Suffers Ransomware Attack: Report|https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/big-msp-sodinokibi-attack/]]|Attack Ransomware CSP|
|2019.12.30|NextGov|[[After Two Years, JEDI is Finally Underway|https://www.nextgov.com/it-modernization/2019/12/after-two-years-jedi-finally-underway/162005/]]|JEDI|
|2019.12.30|//JumpCloud//|[[Identity-as-a-Service (IDaaS) Explained|https://jumpcloud.com/blog/idaas-explained/]]|IDaaS|
|2019.12.30|//MalwareBytes//|[[Explained: edge computing|https://blog.malwarebytes.com/explained/2019/12/explained-edge-computing/]]|Edge_Computing|
|2019.12.30|Informatique News[>img[iCSF/flag_fr.png]]|[[Les tendances 2020 du cloud computing|https://www.informatiquenews.fr/les-tendances-2020-du-cloud-computing-65996]]|Predictions|
<<QOTD Rolled1920 1852 noclick norandom>>
[img(150px,auto)[iCSF/Cloud2019.jpg]]
----
[img(150px,auto)[iCSF/Cloud2020.jpg]]
!1er janvier 2020 : Editorial
|TablNoBord|k
|<<tiddler Roll1920>>|Avec le changement d'année, voici venu le temps du bilan de l'année écoulée, et des bonnes résolutions pour l'année qui commence. 
Voici donc le ''bilan 2019'' assez fourni du ''Chapitre Français'' de la ''Cloud Security Alliance'', ainsi que les ''perspectives et des propositions d'objectifs pour 2020''.
Des actions sont d'ors et déjà engagées et vous devriez voir les premiers effets au cours du premier trimestre.| !!1 -- Bilan 2019 !!!1.1 -- Les actions du [[Chapitre Français]] # participation à 2 salons et conférences : [>img(150px,auto)[iCSF/Cloud2019.jpg]] ## en mars 2019, participation à la "Cloud Computing Expo Europe" et plus particulièrement au cycle de conférence "Forum Securité@Cloud" +++*[»]> [img(auto,100px)[iCSF/ForumSecuriteCloud-2019.png]][img(auto,100px)[iCSF/CCWE-2019.png]]=== ## en novembre 2019, participation au salon "Cloud & Cyber Security Paris" et plus particulièrement au cycle de conférence associé avec l'animation d'une table ronde +++*[»]> [img(200px,auto)[iCSF/CCSEP2019.png]]=== # participation à plusieurs groupes de travail de la [[Cloud Security Alliance]] # participation à l'animation et à des formations dans le cadre du partenariat avec l'ISEP Formation Continue +++*[»]> <<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>=== pour ## le ''[[Mastères Spécialisés® Expertise Cloud Computing|https://cloudsecurityalliance.fr/go/McCC/]]'' pour la 7^^ème^^ fois ## le ''[[Mastères Spécialisés® Architecture Cybersécurité et Intégration|https://cloudsecurityalliance.fr/go/McCS/]]'' pour la 2^^ème^^ fois !!!1.2 -- Le site Web [[CloudSecurityAlliance.fr|https://CloudSecurityAlliance.fr]] # le site Web est mis à jour une à deux fois par semaine avec les dernières actualités, annonces, et publications de la CSA [>img(150px,auto)[iCSF/Cloud2019.jpg]] # de gros efforts ont été faits sur ''le fond'' et la ''founiture d'informations pertinentes'' # des adaptations ont été faites tout au long de l'année, même si la forme va encore évoluer # l'ajout d'une rubrique "''Références''" +++*[»]> <<tiddler [[Références]]>>=== avec : ## des documents pertinents publiés par des agences nationales ou internationales de sécurité telles que l'ACSC (AU), l'ANSSI, le BSI (DE), le Clou.gov (US), le DoD (US), l'ENISA (EU), le NCSC (UK)... ## des documents pertinents publiés par des entités ou des organismes traitant de la sécurité et du Cloud telles que : le CIS, la CNIL, GEANT, Horizon 2020, l'ISO, l'IETF, le MITRE, le NIST, l'OWASP, PCI DSS... ## des documents pertinents publiés par des Prestataires de Services Cloud tels que : Amazon (AWS), Google (GCP), Microsoft (Azure) # l'ajout d'une rubrique "''Outils''" +++*[»]> <<tiddler [[Outils]]>>=== avec : ## des tableaux de bord de ''l'état de services Cloud'' et les pages "sécurité" des //fournisseurs d'énergie Cloud// +++*[»]> <<tiddler Outils##EtatServices>>=== ## des listes d'outils disponibles sur ''GitHub'' +++*[»]> <<tiddler Outils##GitHub>>=== ## des listes de sites avec des ''challenges'' sécurité ou de composants à tester sur +++*[»]> <<tiddler Outils##Challenges>>=== ## des références de ''sites'' +++*[»]> <<tiddler Outils##Sites>>=== ## des ''ports'' TCP ou UDP de références +++*[»]> <<tiddler Outils##Ports>>=== # l'intégration d'une partie des archives : ## complètes pour 2019 ## presque complètes pour 2018 ## très partielles pour les années précédentes # la mise en place d'un réducteur/minimiseur de liens/URLs +++*[»]> liens en //''CloudSecurityAlliance.fr/go/XXXX''// === ** la plupart des articles rédigés à partir de la mi-2019 de ce site l'utilisent !!!1.3 -- Autres points positifs # la ''lettre hebdomadaire'' +++*[»]> <<tiddler [[Newsletters]]>>=== a été publiée toutes les semaines depuis son lancement, début Mars 2019 ## vous pouvez la retrouver sur le site [[CloudSecurityAlliance.fr|https://CloudSecurityAlliance.fr]] (rubrique [[Newsletters]]) ## elle est publiée tous les dimanches sur notre groupe LinkedIN "Cloud Security Alliance, French Chapter" # la ''veille Web Cloud et Sécurité'' +++*[»]> <<tiddler [[Veille Web]]>>=== a été publiée toutes les semaines depuis son lancement, début Mars 2019 ## elle est publiée tous les dimanches sur le site [[CloudSecurityAlliance.fr|https://CloudSecurityAlliance.fr]] (rubrique [[Veille Web]]) # sur ''LinkedIN'', notre groupe "''Cloud Security Alliance, French Chapter''" +++*[»]> <<tiddler [[LinkedIN]]>>=== continue de croître avec près de 300 membres !!!1.4 -- Quelques points négatifs # aucun un "événement CSA" n'a été organisé en France [>img(150px,auto)[iCSF/Cloud2019.jpg]] # le comité de pilotage du [[Chapitre Français]] n'a pas pu être réactivé, malgré quelques tentatives # aucune formation ''CCSK''+++*[»]> <<tiddler [[CCSK]]>>===n'a été organisée, malgré quelques tentatives, mais cela pourrait déboucher en 2020 # très faible utilisation du compte ''Twitter'' +++*[»]> <<tiddler [[Twitter]]>>=== ... mais ce n'est que partie remise ! !!2 -- Et pour 2020 !!!2.1 -- Continuité des actions engagées # la poursuite des publications actuelles : newsletters et veille Web hebdomadaires [>img(150px,auto)[iCSF/Cloud2020.jpg]] # la poursuite des actions d'animation et de formation dans les Mastères Spécialisés de l'ISEP Formation Continue # la poursuite de l'intégration des archives antérieures à 2018 !!!2.2 -- Relance des actions non engagées en 2019 # la réactivation du Comité de pilotage du [[Chapitre Français]] au cours du premier trimestre 2020 [>img(150px,auto)[iCSF/Cloud2020.jpg]] # une utilisation plus forte du compte Twitter # la préparation d'une formation CCSK en France # l'organisation d'un événement "Sécurité du Cloud" !!!2.3 -- Nouvelles actions [>img(150px,auto)[iCSA/CircleCSA.png]]Après quelques tests complémentaires, un portail va être ouvert pour les membres du [[Chapitre Français]] et géré directement par la Cloud Security Alliance. * ce portail est une plateforme de partage collaborative avec liste de diffusion, possibilité de partage de documents, ... * nous serons parmi l'un des premiers Chapitres à l'utiliser avant son déploiement par la CSA à tous les autres * plus d'informations seront communiquées pendant le premier trismestre 2020 !!!2.4 -- Dates à retenir 2 dates sont déjà à inscrire sur votre agenda [>img(150px,auto)[iCSF/Cloud2020.jpg]] # ''18 et 19 mars 2020'' : "Forum Securité@Cloud" dans le cadre de la "Cloud Computing World Expo" à Paris, Porte de Versailles +++*[»]> <<tiddler [[Forum Sécurité@Cloud]]>>=== # ''17 et 18 novembre 2020'' : "Cloud & Cyber Security Paris" à Paris, Porte de Versailles Quant au "CSA EMEA Congress", il devrait avoir lieu soit en octobre, soit en novembre 2020, à Bruxelles ou à Berlin. !!3 -- Contacts Si vous souhaitez participer activement au [[Chapitre Français]], ou simplement découvrir les travaux de la [[Cloud Security Alliance]], contactez nous * par [[email|Contact]] * via [[LinkedIn|https://www.linkedin.com/groups/3758242]] * via l'espace [[Slack]] [img[iCSF/flag_fr.png]][img(50%,1px)[iCSF/BluePixel.gif]]
!"//​Prevent security misconfigurations in a multi-cloud environment//"
[>img(100px,auto)[iCSA/K1KBP.jpg]]^^Article publié le 20 janvier sur le blog de la CSA, et après l'avoir été 7 jours auparavant sur le site de la société CipherCloud.
Même s'il adresse un sujet intéressant, cet article à pour principal objectif de faire participer le lecteur à un Webcast.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/blog/2020/01/20/prevent-security-misconfigurations-in-a-multi-cloud-environment/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.ciphercloud.com/prevent-security-misconfigurations-in-a-multi-cloud-environment/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201912>>
<<tiddler fAll2Tabs10 with: VeilleM","_201912>>
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|Aucune alerte pour le moment|
|2019.12.26|//Checkpoint//|[[Kubernetes API Server Denial Of Service (CVE-2019-11253)|https://www.checkpoint.com/defense/advisories/public/2019/cpai-2019-1443.html]]|Kubernetes Vulnerability|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Décembre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201912>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Décembre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Décembre 2019]]>><<tiddler fAll2LiTabs with: Actu","201912>>
<<tiddler fAll2LiTabs with: Blog","201912>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Décembre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201912>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Décembre 2019]]>>
!1 - Les nouveautés CSA de la semaine du 23 au 29 décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Appel à commentaires, document "''Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS''" +++*[»]> <<tiddler [[2019.12.12 - Actu : Appel à commentaires, document 'Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.12.29 - Veille Hebdomadaire]] avec plus de 30 liens
* Bilan 2019 et prévisions 2020 : //Alcide//, Computer Weekly, //Productiv//, Silicon Angle
* Etudes : //Coalfire// +++*[»]> 
|2019.12.26|MSSP Alert|[[Study: Midmarket Businesses Face Cloud Migration Cyber Risks|https://www.msspalert.com/cybersecurity-research/midmarket-cyber-risks/]]|Study Risks|
|2019.12.11|//Coalfire//| → [[Penetration Risk Report|https://www.coalfire.com/Resources/White-Papers/2019-Coalfire-Penetration-Risk-Report]]|Study Risks|
===, ESG +++*[»]> 
|2019.12.23|ESG|![[ESG Research Report: The rise of cloud-based security analytics and operations technologies|https://www.esg-global.com/research/esg-research-report-the-rise-of-cloud-based-security-analytics-and-operations-technologies]]|Report|
=== 
* Divers : Effets des attaques contre le Cloud +++*[»]> 
|2019.12.27|//Catchpoint//|![[Containing the ripple effect of cloud cyberattacks|https://www.scmagazine.com/home/opinion/executive-insight/containing-the-ripple-effect-of-cloud-cyberattacks/]]|Cyberattacks Best_Practices|
===, politique de conservation des données
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.29|
|2019.12.29|//Tripwire//|![[AWS vs. Azure vs. Google - What’s the Difference from a Cloud Security Standpoint?|https://www.tripwire.com/state-of-security/security-data-protection/cloud/aws-azure-google-difference-cloud-security-standpoint/]]|AWS Azure GCP|
|2019.12.29|NBC News|[[How online 'cloud buckets' are exposing private photos and other sensitive data|https://www.nbcnews.com/tech/internet/how-online-cloud-buckets-are-exposing-private-photos-other-sensitive-n1105056]]|Data_Leaks|
|>|>|>|!2019.12.28|
|2019.12.28|Silicon Angle|[[Predictions 2020: Cloud, Kubernetes and cybersecurity will rule|https://siliconangle.com/2019/12/28/predictions-2020-cloud-kubernetes-cybersecurity-will-rule/]]|Predictions|
|2019.12.28|TechRadar Pro|[[Emerging technologies securing the cloud|https://www.techradar.com/news/emerging-technologies-securing-the-cloud]]|Misc|
|>|>|>|!2019.12.27|
|2019.12.27|Computer Weekly|[[Top 10 cloud stories of 2019|https://www.computerweekly.com/news/252475348/Top-10-cloud-stories-of-2019]]|Year_Recap|
|2019.12.27|//Catchpoint//|![[Containing the ripple effect of cloud cyberattacks|https://www.scmagazine.com/home/opinion/executive-insight/containing-the-ripple-effect-of-cloud-cyberattacks/]]|Cyberattacks Best_Practices|
|2019.12.27|//Alibaba Cloud//|[[The Open Application Model from Alibaba’s Perspective|https://medium.com/@Alibaba_Cloud/the-open-application-model-from-alibabas-perspective-2352f89ad845]]|Alibaba OAM|
|2019.12.27|//Productiv//|[[Productiv 2020 Predictions: SaaS applications in 2020|https://vmblog.com/archive/2019/12/27/productiv-2020-predictions-saas-applications-in-2020.aspx]]|Predictions|
|2019.12.27|//Whois API, Inc//|[[Mitigating Phishing Attacks on Cloud/File Storage Services through Domain Reputation API|http://www.circleid.com/posts/20191227_mitigating_phishing_cloud_file_storage_services_through_domain_rep/]]|Phishing|
|2019.12.27|Cloud.Gov|![[Security Incident Response Guide|https://cloud.gov/docs/ops/security-ir/]]|Incident_Response|
|2019.12.27|Cloud.Gov| → [[Security Incident Response checklist|https://cloud.gov/docs/ops/security-ir-checklist/]]|Incident_Response|
|2019.12.27|DZone|[[A Brief Guide to Kubernetes and Containers|https://dzone.com/articles/definitive-guide-to-kubernetes]]|Kubernetes Containers|
|>|>|>|!2019.12.26|
|2019.12.26|Les Echos[>img[iCSF/flag_fr.png]]|[[La souveraineté européenne face au Cloud Act|https://www.lesechos.fr/idees-debats/cercle/opinion-la-souverainete-europeenne-face-au-cloud-act-1159010]]|CLOUD_Act Europe|
|2019.12.26|Le Mag IT[>img[iCSF/flag_fr.png]]|[[Cloud : pourquoi adopter une politique de conservation des données|https://www.lemagit.fr/conseil/Cloud-pourquoi-adopter-une-politique-de-conservation-des-donnees]]|Data Policy|
|2019.12.26|IT World Canada|[[Videoconference system stored data in open AWS bucket, says new report|https://www.itworldcanada.com/article/videoconference-system-stored-data-in-open-aws-bucket-says-new-report/425319]]|Data_Leak|
|2019.12.26|CISO Mag|[[Securing the Hybrid Cloud Environment: A New Paradigm Using Zero Trust|https://www.cisomag.com/securing-the-hybrid-cloud-environment-a-new-paradigm-using-zero-trust/]]|Hybrid_Cloud Zero_Trust|
|2019.12.26|MSSP Alert|[[Study: Midmarket Businesses Face Cloud Migration Cyber Risks|https://www.msspalert.com/cybersecurity-research/midmarket-cyber-risks/]]|Study Risks|
|2019.12.11|//Coalfire//| → [[Penetration Risk Report|https://www.coalfire.com/Resources/White-Papers/2019-Coalfire-Penetration-Risk-Report]]|Study Risks|
|2019.12.26|SecureCloud.blog|[[Reddit Thread Answer: Azure AD – Autologon endpoint|https://securecloud.blog/2019/12/26/reddit-thread-answer-azure-ad-autologon-endpoint/]]|AzureAD|
|2019.12.26|//Checkpoint//|[[Kubernetes API Server Denial Of Service (CVE-2019-11253)|https://www.checkpoint.com/defense/advisories/public/2019/cpai-2019-1443.html]]|Kubernetes Vulnerability|
|2019.12.26|//JumpCloud//|[[Bridge Active Directory To The Cloud|https://jumpcloud.com/blog/ad-cloud-bridge/]]|Active_Directory|
|2019.12.26|//Security Intelligence//|[[Demystifying Security in an Open, Hybrid Multicloud Environment|https://securityintelligence.com/posts/demystifying-security-in-an-open-hybrid-multicloud-environment/]]|Multi_Cloud|
|>|>|>|!2019.12.25|
|2019.12.25|Cyber Security Hub|[[Public Cloud Platforms - A Honey Pot For Threat Actors - Building An Understanding Of Risk And Configuration|https://www.cshub.com/cloud/articles/public-cloud-platforms-a-honey-pot-for-threat-actors]]|Risks HoneyPot|
|>|>|>|!2019.12.24|
|2019.12.24|01 Business[>img[iCSF/flag_fr.png]]|[[Cloud de confiance en France : la recette existe|https://www.linkedin.com/pulse/cloud-de-confiance-en-france-la-recette-existe-fr%C3%A9d%C3%A9ric-simottel/]]|Sovereign_Cloud|
|2019.12.24|Reddit|[[Synoptek Issues|https://www.reddit.com/r/sysadmin/comments/ef2egh/synoptek_issues/]]|Attack Ransomware CSP|
|2019.12.27|Krebs on Security| → [[Ransomware at IT Services Provider Synoptek|https://krebsonsecurity.com/2019/12/ransomware-at-it-services-provider-synoptek/]]|Attack Ransomware CSP|
|2019.12.24|Container Journal|[[5 Common Container Mistakes to Avoid|https://containerjournal.com/topics/container-management/5-common-container-mistakes-to-avoid/]]|Containers|
|2019.12.24|CSO|[[How to use Microsoft Compliance Score to improve data protection|https://www.csoonline.com/article/3490238/how-to-use-microsoft-compliance-score-to-improve-data-protection.html]]|O365 Compliance|
|2019.12.24|//Alcide//|[[Kubernetes Security Leader Alcide Releases 2020 Predictions: Kubernetes on the Edge, Intelligent and Automated K8s Security and the Rise of Distributed Tracing|https://vmblog.com/archive/2019/12/24/kubernetes-security-leader-alcide-releases-2020-predictions-kubernetes-on-the-edge-intelligent-and-automated-k8s-security-and-the-rise-of-distributed-tracing.aspx]]|Predictions|
|2019.12.24|//Alibaba Cloud//|[[From Confused to Proficient: Kubernetes Authentication and Scheduling|https://medium.com/@Alibaba_Cloud/from-confused-to-proficient-kubernetes-authentication-and-scheduling-39a058af5103]]|Kubernetes Authentication|
|2019.12.24|//Alibaba Cloud//|[[From Confused to Proficient: Analysis of Failure to Delete a Kubernetes Cluster Namespace|https://medium.com/@Alibaba_Cloud/from-confused-to-proficient-analysis-of-failure-to-delete-a-kubernetes-cluster-namespace-62c31bc1a2ac]]|Kubernetes|
|2019.12.24|DZone|[[6 Enterprise Kubernetes Takeaways from KubeCon San Diego|https://dzone.com/articles/6-enterprise-kubernetes-takeaways-from-kubecon-san]]|Kubernetes Conference|
|>|>|>|!2019.12.23|
|2019.12.23|Les Echos[>img[iCSF/flag_fr.png]]|[[Pour Tencent, l'Europe a déjà perdu la bataille du cloud|https://www.lesechos.fr/monde/europe/pour-tencent-leurope-a-deja-perdu-la-bataille-du-cloud-1158624]]|Sovereign_Cloud Europe|
|2019.12.23|Container Journal|[[OpenShift, Kubernetes and Docker: A Quick Comparison|https://containerjournal.com/topics/container-ecosystems/openshift-kubernetes-and-docker-a-quick-comparison/]]|Docker Kubernetes|
|2019.12.23|Avishay Bar|![[caponeme - Repository demonstrating the Capital One breach on your AWS account|https://github.com/avishayil/caponeme]]|Tools CapitalOne Demonstration|
|2019.12.23|//JumpCloud//|[[Active Directory for Cloud-Forward Sysadmins|https://jumpcloud.com/blog/active-directory-cloud-forward-sysadmins/]]|AzureAD|
|2019.12.23|//JumpCloud//|[[Sync Active Directory With AWS|https://jumpcloud.com/blog/sync-active-directory-with-aws/]]|AWS AzureAD|
|2019.12.23|//Data Insider//|[[What is a Cloud Access Security Broker?|https://digitalguardian.com/blog/what-cloud-access-security-broker]]|CASB|
|2019.12.23|//Security Intelligence//|[[Slowing Data Security Tool Sprawl in a Hybrid Multicloud World|https://securityintelligence.com/posts/slowing-data-security-tool-sprawl-in-a-hybrid-multicloud-world/]]|Hybrid_Cloud|
|2019.12.23|Transatel [>img[iCSF/flag_fr.png]]|[[Le cloud : enfer ou opportunité pour la sécurité ?|[https://www.linkedin.com/pulse/le-cloud-enfer-ou-opportunit%C3%A9-pour-la-s%C3%A9curit%C3%A9-valerian-perret/]]|Misc|
|2019.12.23|ESG|![[ESG Research Report: The rise of cloud-based security analytics and operations technologies|https://www.esg-global.com/research/esg-research-report-the-rise-of-cloud-based-security-analytics-and-operations-technologies]]|Report|
!1 - Les nouveautés CSA de la semaine du 16 au 22 décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Fin du projet ''European Security Certification Framework (EU-SEC)'' +++*[»]> <<tiddler [[2019.12.19 - Actu : Fin du projet European Security Certification Framework (EU-SEC)]]>>=== 
* Actu : Appel à commentaires, ''derniers jours'' pour répondre, document "''Cloud Incident Response Framework – A Quick Guide''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Cloud Incident Response Framework – A Quick Guide']]>>=== 
* Actu : Appel à commentaires, ''derniers jours'' pour répondre, document "''Hybrid Cloud and Its Associated Risks''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Hybrid Cloud and Its Associated Risks']]>>=== 
* Actu : Appel à commentaires, document "''Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS'''" +++*[»]> <<tiddler [[2019.12.12 - Actu : Appel à commentaires, document 'Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.12.22 - Veille Hebdomadaire]] avec plus de 60 liens
* Attaques et Vulnérabilités : 0-day Dropbox, élévation de privilège dans AWS, //Cloud Shell// contre AWS
* Bilan 2019 et prévisions 2020 : BetaNews, CloudFoundry, Container Journal, DevOps.com, DZone, Kubernetes, Rancher, Solutions Review
* Rapports et Sondages : Precise Security, SANS
* Info ou Intox : début 2018, Google aurait envisagé de se désengager du Cloud s'il n'était pas numéro 2 sur le marché en 2023 +++*[»]> 
|2019.12.17|The Information|[[Google Brass Set 2023 as Deadline to Beat Amazon, Microsoft in Cloud|https://www.theinformation.com/articles/google-brass-set-2023-as-deadline-to-beat-amazon-microsoft-in-cloud]]|GCP Strategy|
|2019.12.17|Silicon Angle| → [[Google denies report it considered quitting cloud computing business|https://siliconangle.com/2019/12/17/google-denies-report-considered-quitting-cloud-computing-business/]]|GCP Strategy|
|2019.12.18|CRN| → [[Google considered killing its cloud: report|https://www.crn.com.au/news/google-considered-killing-its-cloud-report-535749]]|GCP Strategy|
|2019.12.17|CRN| → [[Google’s Five-Year Plan For GCP Has Funding Strings Attached: Report|https://www.crn.com/news/cloud/google-reportedly-set-ambitious-goal-and-possible-deadline-for-gcp]]|GCP Strategy|
|2019.12.18|Computer Weekly| → [[Google declares report on alleged public cloud exit discussions 'inaccurate'|https://www.computerweekly.com/news/252475694/Google-declares-report-on-alleged-public-cloud-exit-discussions-inaccurate]]|GCP Strategy|
=== 
* Divers : l'approche BeyondProd de Google pour les microservices +++*[»]> 
|2019.12.17|//Google//|![[BeyondProd: A new approach to cloud-native security|https://cloud.google.com/security/beyondprod/]]|Cloud_Native|
|2019.12.18|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[BeyondProd : l’approche de Google pour sécuriser les microservices|https://www.silicon.fr/beyondprod-google-microservices-330083.html]]|Cloud_Native|
|2019.12.19|//Duo Security//| → [[BeyondProd Lays Out Security Principles for Cloud-Native Applications|https://duo.com/decipher/beyondprod-lays-out-security-principles-for-cloud-native-applications]]|Cloud_Native|
===, Containers, Docker
!3 - Contacts>>
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.22|
|2019.12.22|B2C|[[Cloud-Native Environments: A Challenge for Traditional Cyber Security Practices|https://www.business2community.com/cybersecurity/cloud-native-environments-a-challenge-for-traditional-cyber-security-practices-02269834]]|Cloud_Native|
|>|>|>|!2019.12.21|
|2019.12.21|BFM Business[>img[iCSF/flag_fr.png]]|[[Comment bâtir un cloud souverain de confiance ?|https://bfmbusiness.bfmtv.com/mediaplayer/video/comment-batir-un-cloud-souverain-de-confiance-2112-1210593.html]] (vidéo)|Sovereign_Cloud|
|>|>|>|!2019.12.20|
|2019.12.20|SANS|[[Workforce Automation and the Cloud: A Dichotomy|https://www.sans.org/cyber-security-intelligence/2019/12/20/workforce-automation-and-the-cloud-a-dichotomy]] ([[sondage après inscription|https://www.sans.org/reading-room/whitepapers/analyst/workforce-transformation-challenges-risks-opportunities-39340]])|Survey|
|2019.12.20|SecureCloud.blog|[[NodeJS Logging integration with Azure Log Analytics/Sentinel|https://securecloud.blog/2019/12/20/nodejs-logging-integration-with-azure-log-analytics-sentinel/]]|Azure Logging|
|2019.12.20|Healthcare IT News|[[Cybersecurity poses big challenges, but new cloud approaches hold promise|https://www.healthcareitnews.com/news/cybersecurity-poses-big-challenges-new-cloud-approaches-hold-promise]]|Challenges|
|2019.12.20|//Google Cloud//|[[Kubernetes Podcast in 2019: year-end recap|https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-podcast-in-2019-year-end-recap]]|Kubernetes Year_Recap|
|2019.12.20|//Trendmicro//|![[Why Running a Privileged Container in Docker Is a Bad Idea|https://blog.trendmicro.com/trendlabs-security-intelligence/why-running-a-privileged-container-in-docker-is-a-bad-idea/]]|Docker Containers Privileges|
|2019.12.20|//Checkpoint//|[[8 Best Practices for Multi-Cloud Security|https://blog.checkpoint.com/2019/12/20/8-best-practices-for-multi-cloud-security/]]|Multi_Cloud Best_Practices|
|2019.12.20|//Summit Route//|![[re:Invent 2019 Security Review|https://summitroute.com/blog/2019/12/20/reinvent_2019_security_review/]]|AWS Conference|
|2019.12.20|ID Access Management|[[How to remove inactive users automatically via Access Reviews?|https://identityaccess.management/2019/12/20/how-to-remove-inactive-users-automatically-via-access-reviews/]]|O365 Access_Review|
|>|>|>|!2019.12.19|
|2019.12.19|BetaNews|[[Cloud predictions for 2020|https://betanews.com/2019/12/19/cloud-predictions-for-2020/]]|Predictions|
|2019.12.19|Solutions Review|[[20 Experts Share Predictions for Cloud in 2020 and Beyond|https://solutionsreview.com/cloud-platforms/20-experts-share-predictions-for-cloud-in-2020-and-beyond/]]|Predictions|
|2019.12.19|Solutions Review|[[11 Experts Share Predictions and Advice for Cloud Security in 2020|https://solutionsreview.com/cloud-platforms/11-experts-share-predictions-and-advice-for-cloud-security-in-2020/]]|Predictions|
|2019.12.19|Container Journal|[[Going to the Cloud? Go Containers|https://containerjournal.com/topics/container-ecosystems/going-to-the-cloud-go-containers/]]|Containers|
|2019.12.19|Sensors Tech Forum|[[On-Premise vs Cloud-to-Cloud Backup: the Best Solution for Your SaaS|https://sensorstechforum.com/on-premise-vs-cloud-cloud-backup/]]|SaaS Backup|
|2019.12.19|//Tripwire//|[[Top Cloud Security Resources: Certifications, Events and Social Media|https://www.tripwire.com/state-of-security/security-data-protection/cloud/top-cloud-security-resources-certifications-events-social-media/]]|Misc|
|2019.12.19|//Rancher//|[[Rancher Security: 2019 Recap|https://rancher.com/blog/2019/rancher-security-2019-recap/]]|Year_Recap|
|2019.12.19|//StackRox//|[[As Kubernetes Matures, Security Evolves into Safety|https://vmblog.com/archive/2019/12/19/stackrox-2020-predictions-as-kubernetes-matures-security-evolves-into-safety.aspx]]|Predictions|
|2019.12.19|//Caylent//|[[The Pros and Cons of Running Production Databases as Containers|https://caylent.com/the-pros-and-cons-of-running-production-databases-as-containers]]|Containers Databases|
|2019.12.19|//WatchGuard//|[[MSP Cloud Presence Concerns|https://www.msspalert.com/cybersecurity-guests/msp-cloud-presence-concerns/]]|MSSP|
|2019.12.19|//Apcela//|[[Prime Real Estate in the Cloud|http://www.circleid.com/posts/20191219_prime_real_estate_in_the_cloud/]]|Misc|
|2019.12.19|//Bishopfox//|![[Investigating PrivEsc Methods in AWS|https://know.bishopfox.com/research/privilege-escalation-in-aws]]|AWS Vulnerabilities|
|2019.12.19|//Bishopfox//| → [[Escalator to the Cloud: 5 Privesc Attack Vectors in AWS|https://know.bishopfox.com/blog/5-privesc-attack-vectors-in-aws]]|AWS Vulnerabilities|
|2019.12.19|//Cloud Foundry//|[[Cloud Foundry Foundation 2020 Predictions: Cloud Complexity Urges Developers to Seek Simplification|https://vmblog.com/archive/2019/12/19/cloud-foundry-foundation-2020-predictions-cloud-complexity-urges-developers-to-seek-simplification.aspx]]|Predictions|
|>|>|>|!2019.12.18|
|2019.12.18|Infosecurity Mag|[[Year in Review: Cloud Security|https://www.infosecurity-magazine.com/blogs/year-review-cloud-security/]]|Year_Recap|
|2019.12.18|Infosecurity Mag|[[Data Leak Exposes Thousands of US Defense Contractor Staff|https://www.infosecurity-magazine.com/news/cloud-data-leak-thousands/]]|AWS S3 Data_Leak|
|2019.12.18|//Microsoft//|[[Data governance and retention in your Microsoft 365 tenant - a secure and highly capable solution|https://www.microsoft.com/security/blog/2019/12/18/data-governance-retention-microsoft-365-tenant-secure-highly-capable-solution/]]|Azure Tenant|
|2019.12.18|//Security Intelligence//|[[Cloud Security in 2020 Starts With Protecting Data Wherever It Resides|https://securityintelligence.com/posts/cloud-security-in-2020-starts-with-protecting-data-wherever-it-resides/]]|Predictions|
|2019.12.18|//Threatpost//|[[Why Cloud, Collaboration Breed Insider Threats|https://threatpost.com/why-cloud-collaboration-insider-threats/151272/]]|Insider_Threats|
|2019.12.18|//Sysdig//|[[How to Monitor Kubernetes API Server|https://sysdig.com/blog/monitor-kubernetes-api-server/]]|Kubernetes|
|2019.12.18|//NeuVector//|[[How Serverless Functions Work - Using AWS Lambda as an Example|https://neuvector.com/cloud-security/how-aws-lambda-serverless-works/]]|Serverless|
|2019.12.18|//Swimlane//|[[How to investigate alerts in Microsoft Azure with SOAR|https://swimlane.com/blog/investigate-alerts-in-microsoft-azure/]]|Azure Alerting|
|2019.12.18|//Precise Security//|[[MS Office Represents 73% Of The Most Commonly Exploited Applications Worldwide|https://www.precisesecurity.com/articles/ms-office-represents-73-of-the-most-commonly-exploited-applications-worldwide/]]|Report|
|2019.12.18|//Decoder.Cloud//|![[From dropbox(updater) to NT AUTHORITY\SYSTEM|https://decoder.cloud/2019/12/18/from-dropboxupdater-to-nt-authoritysystem/]]|Dropbox Vulnerabilities|
|2019.12.21|Bleeping Computer| → [[Dropbox Zero-Day Vulnerability Gets Temporary Fix|https://www.bleepingcomputer.com/news/security/dropbox-zero-day-vulnerability-gets-temporary-fix/]]|Dropbox Vulnerability|
|2019.12.21|GBHackers On Security| → [[Unpatched Dropbox for Windows Zero-Day Bug Let Hackers get SYSTEM Privileges|https://gbhackers.com/dropbox-windows/]]|Dropbox Vulnerability|
|2019.12.18|//Blackblaze//|[[Backing Up the Death Star: How Cloud Storage Explains the Rise of Skywalker|https://www.backblaze.com/blog/backing-up-the-death-star-how-cloud-storage-explains-the-rise-of-skywalker/]]|Fun|
|2019.12.18|//Sentinel One//|[[Ransomware as a Service - What are Cryptonite, Recoil and Ghostly Locker?|https://www.sentinelone.com/blog/ransomware-as-a-service-what-are-cryptonite-recoil-and-ghostly-locker/]]|Ransomware|
|2019.12.18|Container Journal|[[Google Shares Best Practices for Securing Microservices|https://containerjournal.com/topics/container-security/google-shares-best-practices-for-securing-microservices/]]|Microservices Best_Practices|
|>|>|>|!2019.12.17|
|2019.12.17|Gov.UK|![[Managing technical lock-in in the cloud|https://www.gov.uk/guidance/managing-technical-lock-in-in-the-cloud]]|Guidance|
|2019.12.20|UK Authority| → [[GDS publishes guidance on avoiding cloud lock-in|https://www.ukauthority.com/articles/gds-publishes-guidance-on-avoiding-cloud-lock-in/]]|Guidance|
|2019.12.17|SANS|![[How to Build a Successful Cloud Security Program|https://www.sans.org/cyber-security-intelligence/2019/12/17/how-to-build-a-successful-cloud-security-program]]|Governance|
|2019.12.17|SANS|![[How to Leverage a CASB for Your AWS Environment|https://www.sans.org/reading-room/whitepapers/analyst/leverage-casb-aws-environment-39345]]|CASB AWS|
|2019.12.17|The Information|[[Google Brass Set 2023 as Deadline to Beat Amazon, Microsoft in Cloud|https://www.theinformation.com/articles/google-brass-set-2023-as-deadline-to-beat-amazon-microsoft-in-cloud]]|GCP Strategy|
|2019.12.17|Silicon Angle| → [[Google denies report it considered quitting cloud computing business|https://siliconangle.com/2019/12/17/google-denies-report-considered-quitting-cloud-computing-business/]]|GCP Strategy|
|2019.12.18|CRN| → [[Google considered killing its cloud: report|https://www.crn.com.au/news/google-considered-killing-its-cloud-report-535749]]|GCP Strategy|
|2019.12.17|CRN| → [[Google’s Five-Year Plan For GCP Has Funding Strings Attached: Report|https://www.crn.com/news/cloud/google-reportedly-set-ambitious-goal-and-possible-deadline-for-gcp]]|GCP Strategy|
|2019.12.18|Computer Weekly| → [[Google declares report on alleged public cloud exit discussions 'inaccurate'|https://www.computerweekly.com/news/252475694/Google-declares-report-on-alleged-public-cloud-exit-discussions-inaccurate]]|GCP Strategy|
|2019.12.17|IoT for All|[[Five Reasons to Upgrade to MQTT 5|https://www.iotforall.com/mqtt-iot/]]|IOT MQTT|
|2019.12.17|//Nuageo//[>img[iCSF/flag_fr.png]]|[[A la découverte du Serverless Computing|https://www.nuageo.fr/2019/12/decouverte-serverless-computing/]]|Serverless FaaS|
|2019.12.17|//Microsoft//|[[Advancing Azure Active Directory availability|https://azure.microsoft.com/en-us/blog/advancing-azure-active-directory-availability/]]|AzureAD Availability|
|2019.12.17|//Google//|![[BeyondProd: A new approach to cloud-native security|https://cloud.google.com/security/beyondprod/]]|Cloud_Native|
|2019.12.18|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[BeyondProd : l’approche de Google pour sécuriser les microservices|https://www.silicon.fr/beyondprod-google-microservices-330083.html]]|Cloud_Native|
|2019.12.19|//Duo Security//| → [[BeyondProd Lays Out Security Principles for Cloud-Native Applications|https://duo.com/decipher/beyondprod-lays-out-security-principles-for-cloud-native-applications]]|Cloud_Native|
|2019.12.17|//Fortinet//|[[Seven Critical Vulnerabilities Discovered in Portainer|https://www.fortinet.com/blog/threat-research/seven-critical-vulnerabilities-portainer.html]]|Vulnerability|
|2019.12.17|//Zscaler//|[[A True SASE Solution Requires a Cloud-First Architecture|https://www.zscaler.com/blogs/corporate/true-sase-solution-requires-cloud-first-architecture]]|Network SASE|
|2019.12.17|//CloudAcademy//|[[Azure Security: Best Practices You Need to Know|https://cloudacademy.com/blog/azure-security-best-practices-you-need-to-know/]]|AWS Best_Practices|
|2019.12.17|//Forescout//|[[Forescout Research Labs Discovers Multiple Vulnerabilities in DTEN Conferencing and Collaboration Systems|https://www.forescout.com/company/blog/dten-vulnerability/]]|Data_Leak|
|>|>|>|!2019.12.16|
|2019.12.16|Silicon.fr[>img[iCSF/flag_fr.png]]|[[CLOUD Act : les hyperscalers optent pour la garantie chiffrement|https://www.silicon.fr/cloud-act-hyperscalers-chiffrement-329847.html]]|CLOUD_Act|
|2019.12.16|DZone|[[Desktop on Cloud: Productive, Cost-Effective and More Secure|https://dzone.com/articles/desktop-on-cloud-productive-cost-effective-and-mor]]|Desktop-aaS|
|2019.12.16|DevOps.com|[[The Top Six Cloud Computing Trends of 2019|https://devops.com/the-top-six-cloud-computing-trends-of-2019/]]|Year_Recap|
|2019.12.16|Bleeping Computer|[[Over 435K Security Certs Can Be Compromised With Less Than $3,000|https://www.bleepingcomputer.com/news/security/over-435k-security-certs-can-be-compromised-with-less-than-3-000/]]|Certificates|
|2019.12.16|Container Journal|[[Predictions 2020: The Killer App for Edge Computing in 2020 will be Kubernetes|https://containerjournal.com/topics/container-ecosystems/predictions-2020-the-killer-app-for-edge-computing-in-2020-will-be-kubernetes/]]|Kubernetes|
|2019.12.16|DZone|[[2020 Cloud and Containers Predictions|https://dzone.com/articles/2020-cloud-and-containers-predictions]]|Predictions|
|2019.12.16|Bleeping Computer|[[Google to Force OAuth in G Suite to Increase Security|https://www.bleepingcomputer.com/news/security/google-to-force-oauth-in-g-suite-to-increase-security/]]|GCP OAuth|
|2019.12.16|GCN|[[MITRE updates ATT&CK for the cloud|https://gcn.com/articles/2019/12/16/mitre-attack-cloud.aspx]]|MITRE_ATTACK|
|2019.12.16|//Offensi.com//|![[4 Google Cloud Shell bugs explained|https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-introduction/]] - bug [[#1|https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-1/]], [[#2|https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-2/]], [[#3|https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-3/]], [[#4|https://offensi.com/2019/12/16/4-google-cloud-shell-bugs-explained-bug-4/]]|GCP Vulnerabilities|
|2019.12.16|//Google Cloud//|[[Enabling a more secure cloud with our partners|https://cloud.google.com/blog/products/identity-security/making-your-cloud-more-secure-through-google-cloud-partners]]|GCP|
|2019.12.16|//Google Cloud//|[[Turning off less secure app access to G Suite accounts|https://gsuiteupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html]]|GCP OAuth|
|2019.12.17|//Duo Security//| → [[Google to Restrict App Access to G Suite Accounts|https://duo.com/decipher/google-to-restrict-app-access-to-g-suite-accounts]]|GCP OAuth|
|2019.12.16|//CompareTheCloud|//|[[Cloud vs on-premise: striking a balance on security|https://www.comparethecloud.net/articles/cloud/cloud-vs-on-premise-striking-a-balance-on-security/]]|Misc|
|2019.12.16|//CompareTheCloud|//|[[Taking the fog out of cloud security|https://www.comparethecloud.net/articles/taking-the-fog-out-of-cloud-security/]]|Misc|
|2019.12.16|//AppSecCo//|[[New Security Training - Attack and Defence in the AWS Cloud|https://blog.appsecco.com/new-security-training-attack-and-defence-in-the-aws-cloud-ef67f1221d0a]]|AWS Training|
!"//European Cloud Security Project Leaves Rich Legacy of Materials for Cloud Stakeholders//"
<<<
[>img(200px,auto)[iCSF/EUSEC.jpg]]//CSA contributions led to development of multi-party recognition framework for cloud security certifications, continuous auditing-based certification, and Privacy Code of Conduct
Seattle — Dec. 19, 2019 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the European Security Certification Framework (EU-SEC) project has concluded. During the course of its three-year participation, CSA contributed to numerous initiatives to benefit cloud stakeholders, among them a multi-party recognition framework for cloud security certifications that has brought clarity to the compliance process, continuous audit-based certification that offers increased trust in the assurance process, and a Privacy Code of Conduct that helps cloud service providers understand GDPR readiness and demonstrate compliance.
The primary goal of EU-SEC is to improve trust in cloud services by creating a framework under which existing certification and assurance approaches can co-exist. The framework also adds an additional layer of trust, assurance and transparency by including continuous auditing-based certifications. It is targeted at cloud stakeholders wishing to improve the business value, efficiency and effectiveness of their approach to cloud security and privacy compliance. This includes auditors, cloud service providers, regulators, standard owners and cloud users.
In addition to all the work required to build the framework architecture, the project partners worked hard to produce a variety of materials to ensure the project outcomes remain at the disposal of cloud stakeholders. The resources include:
* White papers
* Videos
* Training packages
* Webinars
Jürgen Grossman, coordinator of the EU-SEC project said, "There have been many challenges over the last three years, but I am proud of the results that EU-SEC has achieved. These results have been obtained thanks to the hard work of all the partners who brought their expertise to the consortium. I’m confident the outcomes will benefit European cloud stakeholders.”

The Cloud Security Alliance would like to encourage anyone interested in benefiting from the framework to get in touch via the website.
The EU-SEC project, which will come to an end on Dec. 31, 2019, received funding from the European Union’s HORIZON Framework Program for research, technological development and demonstration under grant agreement #731845.

__About EU-SEC__
The project "European Security Certification Framework" (EU-SEC) aimed to create a European framework for certification schemes and evaluation concepts to secure cloud infrastructures. Within this framework, existing national and international certifications can co-exist. EU-SEC will improve the business value as well as the effectiveness and efficiency of existing cloud security certification schemes.//
<<<
__Liens :__
* Annonce :  → ''[[CloudSecurityAlliance.fr/go/jcja/|https://cloudsecurityalliance.fr/go/jcja/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 9 au 15 décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Appel à commentaires, document "''Cloud Incident Response Framework – A Quick Guide''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Cloud Incident Response Framework – A Quick Guide']]>>=== 
* Actu : Appel à commentaires, document "''Hybrid Cloud and Its Associated Risks''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Hybrid Cloud and Its Associated Risks']]>>=== 
* Actu : Appel à commentaires, document "''CloudAbuse Working Group Charter''" +++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'CloudAbuse Working Group Charter']]>>=== 
* Actu : Appel à commentaires, document "''Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS'''" +++*[»]> <<tiddler [[2019.12.12 - Actu : Appel à commentaires, document 'Compléments CCM V3.0.1 pour les spécifications sécurité de CloudOS']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.12.15 - Veille Hebdomadaire]] avec plus de 60 liens
* Attaques et vulnérabilités : //Cloud Shell// contre Azure, phishing O365
* Rapports et Sondages : Archive360, INAP
* Bilan 2019 et prévisions 2020 : Lacework
* Podcast : la mini-série "dans le cloud en Islande, terre des data centers"
* Divers : alertes AzureAD, amélioration de la protection Office 365, méthodologie de notation des prestataires Cloud par la MSPAlliance
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.15|
|2019.12.15|Marco Lancini|[[[Cross Account Auditing in AWS and GCP|https://www.marcolancini.it/2019/blog-cross-account-auditing/]]|Audit AWS GCP|
|>|>|>|!2019.12.14|
|2019.12.14|DZone|[[CyberRange - The Open-Source AWS Cyber Range|https://www.kitploit.com/2019/12/cyberrange-open-source-aws-cyber-range.html]]|Exercise [[Tools|Outils]]|
|>|>|>|!2019.12.13|
|2019.12.13|CloudTweaks|[[Securing Multi-Cloud Manufacturing Systems In A Zero Trust World|https://cloudtweaks.com/2019/12/securing-multi-cloud-manufacturing-systems-in-a-zero-trust-world/]]|Zero_Trust|
|2019.12.13|DZone|[[Hazelcast Resilient to Kubernetes Zone Failures|https://dzone.com/articles/hazelcast-resilient-to-kubernetes-zone-failures]]|Kubernetes Resilience|
|2019.12.13|Lacework|![[The Biggest Cloud Breaches of 2019 and How to Avoid them for 2020|https://www.lacework.com/top-cloud-breaches-2019/]]|Data_Breaches|
|2019.12.13|//Avanan//|[[Update - HTML Attachment Attack on Office 365|https://www.avanan.com/blog/html-attachment-attack-update-office365]]|O365 Attack|
|2019.12.13|//BitDefender//|[[For Cloud-native App Security, Few Companies Have Embraced DevSecOps|https://businessinsights.bitdefender.com/for-cloud-native-app-security-companies-have-embraced-devsecops]]|SecDevOps|
|>|>|>|!2019.12.12|
|2019.12.12|France Inter[>img[iCSF/flag_fr.png]]|[[Episode 4 : dans le cloud en Islande, terre des data centers|https://www.franceinter.fr/emissions/le-reportage-de-la-terre-au-carre/le-reportage-de-la-terre-au-carre-12-decembre-2019]] (4/4) ([[mp3|https://media.radiofrance-podcast.net/podcast09/20693-12.12.2019-ITEMA_22227984-0.mp3]])|Podcast|
|2019.12.12|US Government Accountability Office|GAO-20-126: [[Agencies Increased Their Use of the Federal Authorization Program, but Improved Oversight and Implementation Are Needed|https://www.gao.gov/products/GAO-20-126]] ([[pdf|https://www.gao.gov/assets/710/703193.pdf]])|Controls FedRAMP|
|2019.12.13|NextGov| → [[Audit: Cloud Use Up But Agencies Skirting FedRAMP|https://www.nextgov.com/it-modernization/2019/12/audit-cloud-use-agencies-skirting-fedramp/161886/]]|Controls FedRAMP|
|2019.12.12|DZone|[[What is the Difference Between Kubernetes and Docker Swarm|https://dzone.com/articles/what-is-the-difference-between-kubernetes-and-dock]]|Kubernetes Swarm|
|2019.12.12|TechBeacon|[[5 critical features for cloud security controls|https://techbeacon.com/security/5-critical-features-cloud-security-controls]]|Controls|
|2019.12.12|SecureCloud.blog|[[Deep Diver – Azure AD Identity Protection (IPC) Alerts|https://securecloud.blog/2019/12/12/azure-ad-identity-protection-ipc-alerts/]]|AzureAD|
|2019.12.12|Dark Reading|[[Microsoft 'Campaign Views' Offers Full Look at Office 365 Attacks|https://www.darkreading.com/threat-intelligence/microsoft-campaign-views-offers-full-look-at-office-365-attacks/d/d-id/1336561]]|O365|
|2019.12.12|GBHackers on Security|[[Most Important Challenges of Cloud Migration In Your Organization With Cyber Security Principles - Guide|https://gbhackers.com/cloud-migration/]]|Migration|
|2019.12.12|//Managed Methods//|[[Next Gen Firewall & Cloud Security: What’s The Difference?|https://managedmethods.com/blog/next-gen-firewall-cloud-security-whats-the-difference/]]|Firewalls|
|2019.12.12|//Sunguard//|[[Look before you leap: a guide to resilient hybrid cloud migration|https://www.continuitycentral.com/index.php/news/technology/4715-look-before-you-leap-a-guide-to-resilient-hybrid-cloud-migration]]|Hybrid_Cloud|
|2019.12.12|//Jumploud//|[[Rethink AD|https://jumpcloud.com/blog/rethink-ad/]]|Active_Directory|
|2019.12.12|GAO|[[Agencies Increased Their Use of the Federal Authorization Program, but Improved Oversight and Implementation Are Needed|https://www.gao.gov/products/GAO-20-126]]|FedRAMP US|
|2019.12.12|GAO| → [[Synthèse (pdf)|https://www.gao.gov/assets/710/703192.pdf]] et [[rapport complet (pdf)|https://www.gao.gov/assets/710/703193.pdf]]|FedRAMP US|
|>|>|>|!2019.12.11|
|2019.12.11|France Inter[>img[iCSF/flag_fr.png]]|[[Episode 3 : dans le cloud en Islande, terre des data centers|https://www.franceinter.fr/emissions/le-reportage-de-la-terre-au-carre/le-reportage-de-la-terre-au-carre-11-decembre-2019]] (3/4) ([[mp3|https://media.radiofrance-podcast.net/podcast09/20693-11.12.2019-ITEMA_22226935-1.mp3]])|Podcast|
|2019.12.11|Solutions Review|[[6 Key Capabilities for Cloud Managed Service Providers|https://solutionsreview.com/cloud-platforms/6-key-capabilities-for-cloud-managed-service-providers/]]|CSP|
|2019.12.11|KitPloit|[[Splunk Attack Range - A Tool That Allows You To Create Vulnerable Instrumented Local Or Cloud Environments To Simulate Attacks Against And Collect The Data Into Splunk|https://www.kitploit.com/2019/12/splunk-attack-range-tool-that-allows.html]]|Tools Exercise|
|2019.12.11|//AWS//|[[10 things security teams should focus on, according to AWS' CISO|https://www.zdnet.com/article/10-things-security-teams-should-focus-on-according-to-aws-ciso/]]|Best_Practices|
|2019.12.11|//Microsoft//|[[The quiet evolution of phishing|https://www.microsoft.com/security/blog/2019/12/11/the-quiet-evolution-of-phishing/]]|O365 Phishing Report|
|2019.12.11|//Microsoft//|[[Microsoft Office 365 to Add Reply-All Mail Storm Protection|https://www.bleepingcomputer.com/news/microsoft/microsoft-office-365-to-add-reply-all-mail-storm-protection/]]|O365|
|2019.12.11|//Google Cloud//|[[What's new in Cloud Run for Anthos|https://cloud.google.com/blog/products/serverless/new-features-in-cloud-run-for-anthos-ga]]|GCP Anthos|
|2019.12.11|//Archive360//|[[More Than Sixty Percent of Enterprise IT Executives Plan to Retire Current SaaS Applications Amid Growing Security Fears|https://www.prnewswire.com/news-releases/more-than-sixty-percent-of-enterprise-it-executives-plan-to-retire-current-saas-applications-amid-growing-security-fears-300972934.html]] ([[Rapport|https://www.archive360.com/infographic-saas-security-survey]])|Survey SaaS|
|2019.12.13|HelpNet Security| → [[SaaS security fears: Is your data exposed to potential risk?|https://www.helpnetsecurity.com/2019/12/13/saas-security-fears/]]|Survey SaaS|
|2019.12.11|//INAP//|[[Survey: The Top Challenges Facing IT Departments in 2020|https://www.inap.com/blog/survey-top-challenges-it-2020/]]|Survey|
|>|>|>|!2019.12.10|
|2019.12.10|France Inter[>img[iCSF/flag_fr.png]]|[[Episode 2 : dans le cloud en Islande, terre des data centers|https://www.franceinter.fr/emissions/le-reportage-de-la-terre-au-carre/le-reportage-de-la-terre-au-carre-10-decembre-2019]] (2/4) ([[mp3|https://media.radiofrance-podcast.net/podcast09/20693-10.12.2019-ITEMA_22225846-1.mp3]])|Podcast|
|2019.12.10|MSP Alliance|![[MSPAlliance Develops Cyber Risk Rating for Cloud and Managed Service Providers|https://www.mspalliance.com/mspalliance-develops-cyber-risk-rating-for-cloud-and-managed-service-providers/]]|CyberRating|
|2019.12.10|Container Journal|[[Kubernetes 1.17 Release Arrives|https://containerjournal.com/topics/container-ecosystems/kubernetes-1-17-release-arrives/]]|Kubernetes|
|2019.12.10|Dark Reading|[[Data Leak Week: Billions of Sensitive Files Exposed Online|https://www.darkreading.com/cloud/data-leak-week-billions-of-sensitive-files-exposed-online/d/d-id/1336574]]|DataLeaks|
|2019.12.10||[[5 Ways To Monitor for an Account Takeover|https://dzone.com/articles/5-ways-to-monitor-for-an-account-takeover]]|Detection|
|2019.12.10|//Microsoft//|[[Introducing the integrated Microsoft Threat Protection solution (public preview)|https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Introducing-the-integrated-Microsoft-Threat-Protection-solution/ba-p/1059225]]|O365 Protection|
|2019.12.09|ZDnet| → [[Microsoft to help Office 365 customers track entire phishing campaigns, not just lone emails|https://www.zdnet.com/article/microsoft-to-help-office-365-customers-track-entire-phishing-campaigns-not-just-lone-emails/]]|O365 Protection|
|2019.12.11|Bleeping computer| → [[Microsoft Threat Protection Released in Public Preview|https://www.bleepingcomputer.com/news/microsoft/microsoft-threat-protection-released-in-public-preview/]]|O365 Protection|
|2019.12.10|//NetSPI//|![[Azure Privilege Escalation via Cloud Shell|https://blog.netspi.com/attacking-azure-cloud-shell/]]|Azure Privilege_Escalation|
|2019.12.10|//Google Cloud//|[[Exploring container security: Performing forensics on your GKE environment|https://cloud.google.com/blog/products/containers-kubernetes/best-practices-for-performing-forensics-on-containers]]|Forensics Containers|
|2019.12.10|//Alibaba Cloud//|[[How to Build Your Own Serverless ECS Instance Monitor|https://medium.com/@Alibaba_Cloud/how-to-build-your-own-serverless-ecs-instance-monitor-d420d1408073]]|AWS Serverless|
|2019.12.10|//CipherCloud//|[[Loose Lips Sink Ships - Securing Slack with CASB+|https://www.ciphercloud.com/loose-lips-sink-ships-casb-and-slack-security/]]|Slack CASB|
|2019.12.10|//Checkpoint//|[[Instant Observability into Cloud Threats with CloudGuard IaaS and Google Cloud Packet Mirroring|https://blog.checkpoint.com/2019/12/10/cloudguard-iaas-integrates-with-google-cloud-packet-mirroring/]]|Networks|
|2019.12.10|//ThousandEyes//|[[Top 4 Monitoring Myths: Debunked|https://blog.thousandeyes.com/top-4-monitoring-myths-debunked/]]|Monitoring|
|2019.12.10|//Optiv//|[[Your Risk is Shifting to Places You Can’t See|https://www.optiv.com/blog/your-risk-shifting-places-you-cant-see]] (1/7)|NIST_SP800-190 Containers|
|>|>|>|!2019.12.09|
|2019.12.09|France Inter[>img[iCSF/flag_fr.png]]|[[Episode 1 : dans le cloud en Islande, terre des data centers|https://www.franceinter.fr/emissions/le-reportage-de-la-terre-au-carre/le-reportage-de-la-terre-au-carre-09-decembre-2019]] (1/4) ([[mp3|https://media.radiofrance-podcast.net/podcast09/10212-09.12.2019-ITEMA_22224688-1.mp3]])|Podcast|
|2019.12.09|Economie Numérique[>img[iCSF/flag_fr.png]]|[[Le "Cloud de défense" - bientôt adopté par toutes les infrastructures militaires ?|http://blog.economie-numerique.net/2019/12/09/le-cloud-de-defense-bientot-adopte-par-toutes-les-infrastructures-militaires/]]|Sovereign_Cloud|
|2019.12.09|Informatique News[>img[iCSF/flag_fr.png]]|[[IBM décroche enfin la certification HDS, Hébergeur de données de santé|https://www.informatiquenews.fr/ibm-decroche-enfin-la-certification-hds-hebergeur-de-donnees-de-sante-65538]]|Healthcare France|
|2019.12.09|Zendata[>img[iCSF/flag_fr.png]]|[[Pourquoi et comment sécuriser correctement le déploiement d'Office 365|https://zendata.ch/fr/actualite/blog/item/2742-pourquoi-et-comment-securiser-correctement-le-deploiement-doffice-365]]|O365|
|2019.12.09|Bleeping Computer|[[Microsoft Office 365 ATP Now Helps Analyze Phishing Attacks|https://www.bleepingcomputer.com/news/microsoft/microsoft-office-365-atp-now-helps-analyze-phishing-attacks/]]|O365 Phishing|
|2019.12.09|Venture Beat|[[Microsoft adds 'campaign views' phishing intel to Office 365 Advanced Threat Protection|https://venturebeat.com/2019/12/09/microsoft-adds-campaign-views-phishing-intel-to-office-365-advanced-threat-protection/]]|O365 Phishing|
|2019.12.09|Security Week|[[New Office 365 Feature Provides Detailed Information on Email Attack Campaigns|https://www.securityweek.com/new-office-365-feature-provides-detailed-information-email-attack-campaigns]]|O365 Phishing|
|2019.12.09|CISO Mag|[[Buer, a New Loader Discovered in Several Malware Campaigns|https://www.cisomag.com/buer-loader-a-rising-superstar-of-the-dark-web/]]|Attacks Malware Docker|
|2019.12.09|TechBeacon|[[Data security and the cloud: 3 things your team needs to know|https://techbeacon.com/security/data-security-cloud-3-things-your-team-needs-know]]|Data_Protection|
|2019.12.09|TechCrunch|[[Over 750,000 applications for US birth certificate copies exposed online|https://techcrunch.com/2019/12/09/birth-certificate-applications-exposed/]]|DataLeaks AWS|
|2019.12.09|//PhishLabs//|[[Phishing Campaign Uses Malicious Office 365 App|https://info.phishlabs.com/blog/office-365-phishing-uses-malicious-app-persist-password-reset]]|O365 Attacks|
|2019.12.09|GBHackers on Security| → [[Microsoft Office 365 New Campaign Views to help Customers Tracking Attacks Targeting Organization and its Users|https://gbhackers.com/microsoft-office-365-campaign-views/]]|O365 Attacks|
|2019.12.10|Bleeping Computer| → [[Phishing Attack Hijacks Office 365 Accounts Using OAuth Apps|https://www.bleepingcomputer.com/news/security/phishing-attack-hijacks-office-365-accounts-using-oauth-apps/]]|O365|
|2020.01.09|Silicon Angle| → [[Office 365 hackers use malicious app to gain access to user accounts|https://siliconangle.com/2020/01/09/office-365-hackers-use-side-loaded-malicious-app-gain-access-user-accounts/]]|O365 Attacks|
|2019.12.09|//Threatpost//|[[GE, Dunkin', Forever 21 Caught Up in Broad Internal Document Leak|https://threatpost.com/ge-dunkin-forever21-internal-doc-leak/150920/]]|Data_Leaks|
|2019.12.09|//StackRox//|[[What's New in Kubernetes 1.17: A Deeper Look at New Features|https://www.stackrox.com/post/2019/12/whats-new-in-kubernetes-1.17-a-deeper-look-at-new-features/]]|Kubernetes|
|2019.12.09|//FireEye//|[[Want a Secure Cloud? Open Your Eyes First|https://www.fireeye.com/blog/executive-perspective/2019/12/want-a-secure-cloud-open-your-eyes-first.html]]|Risks|
|2019.12.09|//HPE//|[[Security Strategies for Hybrid IT, Hybrid Cloud and Multicloud Environments|https://www.cloudtp.com/doppler/security-strategies-for-hybrid-it-hybrid-cloud-and-multicloud-environments/]]|Hybrid_Cloud|
|2019.12.09|//HPE//|[[The Hidden Opportunity of Security in the Public Cloud|https://www.cloudtp.com/doppler/the-hidden-opportunity-of-security-in-the-public-cloud/]]|Public_Cloud|
!CCM V3.0.1 addendum to CSA's research artifact 'Cloud OS Security Specification'
[>img(100px,auto)[iCSA/CSAdoc.png]]La date limite pour transmettre les commentaires est le 11 janvier 2020.
<<<
//The Cloud Security Alliance (CSA) would like to invite you to review and comment on the CCM V3.0.1 addendum to CSA's research artifact "''Cloud OS Security Specification''".
It aims to help organizations adhering to the Cloud OS Security Specification to also meet CCM requirements.
This is achieved by identifying compliance gaps in the Cloud OS Security Specification document in relation to the CCM.//
<<<
* Date limite pour les commentaires : le 11 janvier 2020
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/jccp|https://cloudsecurityalliance.fr/go/jccp/]]''
!1 - Les nouveautés CSA de la semaine du 2 au 8 décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Publication : ''Recommandations Cloud'' pour les entités gouvernementales danoises +++*[»]> <<tiddler [[2019.12.07 - Publication : Recommandations Cloud pour les entités gouvernementales danoises]]>> === 
* Actu : Nouvelle certification ''Cloud Auditing Knowledge'' (''CCAK'') +++*[»]> <<tiddler [[2019.12.04 - Actu : Nouvelle certification 'Cloud Auditing Knowledge (CCAK)']]>> === 
* Actu : Appel à commentaires, document "''Cloud Incident Response Framework – A Quick Guide''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Cloud Incident Response Framework – A Quick Guide']]>>=== 
* Actu : Appel à commentaires, document "''Hybrid Cloud and Its Associated Risks''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Hybrid Cloud and Its Associated Risks']]>>=== 
* Actu : Appel à commentaires, document "''CloudAbuse Working Group Charter''" +++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'CloudAbuse Working Group Charter']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.12.08 - Veille Hebdomadaire]] avec plus de 60 liens
* À savoir : ''BlackDirect'' (//Microsoft and Azure Account Takeover//) +++*[»]> 
|2019.12.02|//CyberArk//|[[BlackDirect: Microsoft Azure Account Takeover|https://www.cyberark.com/threat-research-blog/blackdirect-microsoft-azure-account-takeover/]]|Azure OAuth|
|2019.12.02|//CyberArk//| → Site Web [[BlackDirect|https://black.direct/]]|Azure OAuth|
|2019.12.02|//Threatpost//| → [[Microsoft OAuth Flaw Opens Azure Accounts to Takeover|https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/]]|Azure OAuth|
|2019.12.05|CISO Mag| → [[Security Flaw in Microsoft Azure Lets Hackers Control Azure Accounts|https://www.cisomag.com/security-flaw-in-microsoft-azure-lets-hackers-control-azure-accounts/]]|Azure OAuth|
=== 
* Incidents : encore un prestataire victime de rançongiciel (CyrusOne), Mixcloud
* Annonces : ''AWS IAM Access Analyzer for S3'', Amazon Detective et AWS Nitro Enclaves, premier visa ANSSI ''SecNumCloud'' attribué à ''3Ds Outscale''
* Certification : Document de l'ENISA sur les certifications Cloud, en lien avec le groupe de travail ''CSPCERT'' +++*[»]> 
|2019.12.02|ENISA|![[Cybersecurity certification: lifting the EU into the cloud|https://www.enisa.europa.eu/news/enisa-news/cybersecurity-certification-lifting-the-eu-into-the-cloud]]|Certification|
|2019.12.02|ENISA| → [[CSPCERT WG - Recommendations for the implementation of the CSP Certification scheme|https://drive.google.com/file/d/1J2NJt-mk2iF_ewhPNnhTywpo0zOVcY8J/view]]|Certification|
=== 
* Divers : sécurité d'AzureAD, groupes O365
!3 - Contacts>>
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.08|
|2019.12.08|//Tripwire//|[[Moving to the Cloud: Motivations Behind the Migration|https://www.tripwire.com/state-of-security/security-data-protection/cloud/motivations-behind-migration-cloud/]]|Misc|
|2019.12.08|ID Access Management|[[How to apply access review on directory roles in Azure? – Part 2|https://identityaccess.management/2019/12/08/how-to-apply-access-review-on-enterprise-applications-in-azure-part-2/]]|Azure Access_Review|
|>|>|>|!2019.12.07|
|2019.12.07|ID Access Management|[[How to apply access review on directory roles in Azure? – Part 1|https://identityaccess.management/2019/12/07/how-to-apply-efficient-access-review-on-directory-roles-in-azure-part-1/]]|Azure Access_Review|
|>|>|>|!2019.12.06|
|2019.12.06|Maarten Goet|[[Azure Sentinel: advanced multistage attack detection - real machine learning for the real world|https://medium.com/wortell/advanced-multistage-attack-detection-real-machine-learning-for-the-real-world-2d9548276ea1]]|Azure_Sentinel|
|2019.12.06|ComputerWeekly|[[Security Think Tank: Is data more or less secure in the cloud?|https://www.computerweekly.com/opinion/Security-Think-Tank-Is-data-more-or-less-secure-in-the-cloud]]|Misconfigurations Controls|
|2019.12.06|DZone|[[10 Things You Should Expect From a Container Registry|https://dzone.com/articles/10-things-you-should-expect-from-a-container-regis]]|Container_Registry|
|2019.12.06|//PaloAlto Networks//|[[How Cloud Native Security Platforms Can Rescue Cloud Native|https://blog.paloaltonetworks.com/2019/12/cloud-native/]]|Cloud_Native|
|2019.12.06|Infoworld|[[3 cloud security ‘hacks’ to consider today|https://www.infoworld.com/article/3488500/3-cloud-security-hacks-to-consider-today.html]]|Risks|
|>|>|>|!2019.12.05|
|2019.12.05|The Register|[[Kubernetes? 'I don't believe in one tool to rule the world,' says AWS' Sassy Jassy|https://www.theregister.co.uk/2019/12/05/kubernetes_aws_ceo/]]|Kubernetes|
|2019.12.04|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud : les architectes réseau doivent faire preuve d'adaptabilité|https://www.silicon.fr/avis-expert/cloud-les-architectes-reseau-doivent-faire-preuve-dadaptabilite]]|Networks|
|2019.12.05|SecureCloudBlog|[[AAD Security made easy: Check your Azure AD Security with One-Liner (AZSK.AAD)|https://securecloud.blog/2019/12/04/aad-security-made-easy-check-youre-azure-ad-security-with-one-liner-azsk-aad/]]|AzureAD|
|2019.12.05|//SEKOIA//[>img[iCSF/flag_fr.png]]|[[Cloud Act : entre mythes et réalités|https://medium.com/@Sekoia_team/cloud-act-entre-mythes-et-r%C3%A9alit%C3%A9s-21eb1371a7ab]]|CLOUD_Act|
|2019.12.05|//CyrusOne//|[[Managed Service Division of CyrusOne Addresses Ransomware Incident|http://investor.cyrusone.com/news-releases/news-release-details/managed-service-division-cyrusone-addresses-ransomware-incident]]|Outage Ransomware CyrusOne|
|2019.12.05|ZDnet| → [[Ransomware attack hits major US data center provider|https://www.zdnet.com/article/ransomware-attack-hits-major-us-data-center-provider/]]|Outage Ransomware CyrusOne|
|2019.12.05|CIO Dive| → [[CyrusOne hit by REvil ransomware, impacting 6 managed service customers|https://www.ciodive.com/news/cyrusone-ransomware-REvil/568549/]]|Outage Ransomware CyrusOne|
|2019.12.06|Bleeping Computer| → [[U.S. Data Center Provider Hit by Ransomware Attack|https://www.bleepingcomputer.com/news/security/us-data-center-provider-hit-by-ransomware-attack/]]|Outage Ransomware CyrusOne|
|2019.12.05|//GoDaddy//|[[Securing the Cloud: The GoDaddy Way|https://fr.godaddy.com/engineering/2019/12/05/securing-the-cloud/]]|Implementation|
|2019.12.05|//Microsoft//|[[Auto renewal for Office 365 groups expiration policy now available|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Auto-renewal-for-Office-365-groups-expiration-policy-now/ba-p/1022398]]|O365|
|2019.10.24|//Microsoft//| → [[Configure the expiration policy for Office 365 groups|https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-lifecycle]]|O365|
|2019.12.05|//Eplexity//|[[Practical Approaches to Long-Term Cloud-Native Security|https://devops.com/practical-approaches-to-long-term-cloud-native-security/]]|Strategy|
|2019.12.05|//Gigamon//|[[What Is Hybrid Cloud? Advantages and Disadvantages|https://blog.gigamon.com/2019/12/05/what-is-hybrid-cloud-advantages-and-disadvantages/]]|Hybrid_Cloud|
|2019.12.05|//Managed Methods//|[[K-12 Content Filtering & Cloud Security: Why You Need Both|https://managedmethods.com/blog/k-12-content-filtering-cloud-security-why-you-need-both/]]|Filtering|
|2019.12.05|//Caylent//|[[How to use AWS Federated Identities with Amazon EKS|https://caylent.com/how-to-use-aws-federated-identities-with-amazon-eks]]|Federated_Identities AWS|
|2019.12.05|//INAP//|[[New Survey Reveals the Big 4 Reasons Behind Cloud Migrations and the Off-Premise Exodus|https://www.inap.com/blog/reasons-cloud-data-center-migrations/]]|Report|
|2019.12.05|Nino Crudele|![[Scan all public IP in Microsoft Azure using Azure CLI and Nmap|https://ninocrudele.com/scan-all-public-ip-in-microsoft-azure-using-azure-cli-and-nmap]]|Azure Scanning|
|>|>|>|!2019.12.04|
|2019.12.04|Silicon.fr[>img[iCSF/flag_fr.png]]|[[SecNumCloud : l'ANSSI décerne le premier visa à 3DS Outscale|https://www.silicon.fr/secnumcloud-lanssi-decerne-le-premier-visa-a-3ds-outscale-328357.html]]|SecNumCloud Outscale|
|2019.12.04|!Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud, sécurité des données et conteneurs : les prédictions technologiques pour 2020|https://www.silicon.fr/avis-expert/cloud-securite-des-donnees-et-conteneurs-les-predictions-technologiques-pour-2020]]|Predictions|
|2019.12.04|Dark Reading|[[Navigating Security in the Cloud|https://www.darkreading.com/cloud/navigating-security-in-the-cloud/a/d-id/1336477]]|Best_Practices|
|2019.12.04|SecurityWeek|[[Cloud(y) with a Chance of a Data Breach|https://www.securityweek.com/cloudy-chance-data-breach]]|Risks|
|2019.12.04|//PaloAlto Networks//|[[Perimeter Is Where Your Workload Is: Creating Policy Abstracted from IP Addressing|https://blog.paloaltonetworks.com/2019/12/network-data-center-security/]]|Policy Implementation|
|2019.12.04|//Malware Bytes//|[[Explained: What is containerization?|https://blog.malwarebytes.com/explained/2019/12/explained-what-is-containerization/]]|Containers|
|2019.12.04|//Google Cloud//|[[Last month today: November on GCP|https://cloud.google.com/blog/products/gcp/last-month-today-november-2019-on-gcp]]|GCP|
|2019.12.04|//Checkpoint//|[[How is your Kubernetes Security Posture?|https://blog.checkpoint.com/2019/12/04/how-is-your-kubernetes-security-posture/]]|Kubernetes Security_Posture|
|2019.12.04|//AWS//|[[Avoid ransomware by moving to the cloud, says AWS Public Sector boss|https://www.zdnet.com/article/avoid-ransomware-by-moving-to-the-cloud-says-aws-public-sector-boss/]]|AWS Ransomware|
|2019.12.04|//Tripwire//|[[PSA: Beware of Exposing Ports in Docker|https://www.tripwire.com/state-of-security/devops/psa-beware-exposing-ports-docker/]]|Docker Misconfiguration|
|2019.12.04|//FireEye//|[[FireEye's cloud security capabilities now available on AWS|https://www.helpnetsecurity.com/2019/12/04/fireeye-amazon-web-services/]]|FireEye AWS|
|2019.12.04|//Lifars//|![[How to mitigate your cloud computing risks|https://lifars.com/2019/12/are-you-working-in-a-secure-cloud-environment/]]|Risks|
|2019.12.04|//Microsoft//|[[Overview of the Microsoft 365 compliance center|https://docs.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-compliance-center]]|O365 Compliance|
|>|>|>|!2019.12.03|
|2019.12.03|Container Journal|[[Report: Kubernetes Use on the Rise |https://containerjournal.com/topics/container-ecosystems/report-kubernetes-use-on-the-rise/]]|Kubernetes|
|2019.12.03|CISO Mag|[["AWS" Hacker Attacks Online Music Service Mixcloud|https://www.cisomag.com/aws-hacker-attacks-online-music-service-mixcloud/]]|Attacks|
|2019.12.03|Dark Reading|[[Leveraging the Cloud for Cyber Intelligence|https://www.darkreading.com/cloud/leveraging-the-cloud-for-cyber-intelligence-/a/d-id/1336457]]|Cyber_Intelligence|
|2019.12.03|CSO|[[How to evaluate a CASB|https://www.csoonline.com/article/3454611/how-to-evaluate-a-casb.html]]|CASB|
|2019.12.03|SANS|[[How to Build a Threat Hunting Capability in AWS|https://www.sans.org/reading-room/whitepapers/analyst/build-threat-hunting-capability-aws-39300]]|Threat_Hunting|
|2019.12.03|//Microsoft//|[[Microsoft Security - a Leader in 5 Gartner Magic Quadrants|https://www.microsoft.com/security/blog/2019/12/03/microsoft-security-leader-5-gartner-magic-quadrants/]]|CASB|
|2019.12.03|//Microsoft//|[[Azure AD Domain Services classic migration now available|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Domain-Services-classic-migration-now-available/ba-p/1024783]]|AzureAD|
|2019.12.03|//AWS//|[[Easily Manage Shared Data Sets with Amazon S3 Access Points|https://aws.amazon.com/blogs/aws/easily-manage-shared-data-sets-with-amazon-s3-access-points/]] ([[podcast|https://d2908q01vomqb2.cloudfront.net/polly/da4b9237bacccdf19c0760cab7aec4a8359010b0amazon_polly_34136.mp3]])|AWS S3|
|2019.12.03|//AWS//| → [[AWS announces three new cloud security products|https://siliconangle.com/2019/12/03/aws-announces-three-new-products-focused-allowing-customers-operate-securely/]]|AWS S3|
|2019.12.03|//AWS//| → [[Amazon S3 Access Points|https://aws.amazon.com/s3/features/access-points/]]|AWS S3|
|2019.12.03|Silicon Angle| → [[With S3 Access Points, Amazon aims to make it easy to manage shared data|https://siliconangle.com/2019/12/03/amazon-makes-easy-manage-shared-data-s3-access-points/]]|AWS S3|
|2019.12.05|SecurityWeek| → [[AWS Unveils New Security Services and Capabilities|https://www.securityweek.com/aws-unveils-new-security-services-and-capabilities]]|AWS|
|2019.12.03|//Compare the Cloud//|[[Multi-cloud, Fog, Edge & Hybrid Computing – What's the Difference?|https://www.comparethecloud.net/articles/multi-cloud-fog-edge-hybrid-computing-whats-the-difference/]]|Multi_Cloud|
|2019.12.03|//Tuffin//|[[How to migrate apps and workloads to the cloud securely and efficiently|https://www.tufin.com/blog/cloud-migration-apps-workloads]]|Migration|
|2019.12.03|//Park my Cloud//|[[Cloud Control: Why Is It So Hard?|https://www.parkmycloud.com/blog/drivers-to-cloud/]]|Controls|
|2019.12.03|D/SRUPTION|[[Critical Considerations For Hybrid Cloud Infrastructure|https://disruptionhub.com/critical-considerations-for-hybrid-cloud-infrastructure/]]|Hybrid_Cloud|
|2019.12.03|Wall Street Journal|[[NSA to Issue Updated Cloud Security Guidance|https://www.wsj.com/articles/nsa-to-issue-updated-cloud-security-guidance-11575409110]]|Guidance|
|>|>|>|!2019.12.02|
|2019.12.02|ENISA|![[Cybersecurity certification: lifting the EU into the cloud|https://www.enisa.europa.eu/news/enisa-news/cybersecurity-certification-lifting-the-eu-into-the-cloud]]|Certification|
|2019.12.02|ENISA| → [[CSPCERT WG - Recommendations for the implementation of the CSP Certification scheme|https://drive.google.com/file/d/1J2NJt-mk2iF_ewhPNnhTywpo0zOVcY8J/view]]|Certification|
|2019.12.02|Bleeping Computer|[[Office 365 To Get Microsoft Recommended Security Profiles|https://www.bleepingcomputer.com/news/security/office-365-to-get-microsoft-recommended-security-profiles/]]|O365|
|2019.12.02|Center for Internet Security|[[CIS Debuts New Benchmarks, Hardened Images at AWS re:Invent|https://www.cisecurity.org/press-release/cis-debuts-new-benchmarks-hardened-images-at-aws-reinvent/]]|Hardening|
|2019.12.02|//AWS//|![[Monitor, review, and protect Amazon S3 buckets using Access Analyzer for S3|https://aws.amazon.com/blogs/storage/protect-amazon-s3-buckets-using-access-analyzer-for-s3/]]|AWS S3 Monitoring|
|2019.12.02|//AWS//| → [[Introducing Access Analyzer for Amazon S3 to review access policies|https://aws.amazon.com/about-aws/whats-new/2019/12/introducing-access-analyzer-for-amazon-s3-to-review-access-policies/]]|AWS S3 Monitoring|
|2019.12.03|HelpNet Security| → [[Control access and permissions to AWS services and resources|https://www.helpnetsecurity.com/2019/12/03/aws-iam-access-analyzer/]]|AWS S3 Monitoring|
|2019.12.03|The Register| → [[AWS has new tool for those leaky S3 buckets so, yeah, you might need to reconfigure a few things|https://www.theregister.co.uk/2019/12/03/aws_s3_buckets/]]|AWS S3 Monitoring|
|2019.12.03|CloudPro| → [[AWS plugs leaky S3 buckets with CloudKnox integration|https://www.cloudpro.co.uk/it-infrastructure/security/8327/aws-plugs-leaky-s3-buckets-with-cloudknox-integration]]|AWS S3 Monitoring|
|2019.12.07|//BitDefender//| → [[Amazon Battles Leaky S3 Buckets with a New Security Tool|https://businessinsights.bitdefender.com/amazon-battles-leaky-s3-buckets-with-a-new-security-tool]]|AWS Tools|
|2019.12.02|//Security Intelligence//|[[Attain Embedded Cloud Security With a DevSecOps Approach|https://securityintelligence.com/posts/attain-embedded-cloud-security-with-a-devsecops-approach/]]|DevSecOps|
|2019.12.02|//CyberArk//|[[BlackDirect: Microsoft Azure Account Takeover|https://www.cyberark.com/threat-research-blog/blackdirect-microsoft-azure-account-takeover/]]|Azure OAuth|
|2019.12.02|//CyberArk//| → Site Web [[BlackDirect|https://black.direct/]]|Azure OAuth|
|2019.12.02|//Threatpost//| → [[Microsoft OAuth Flaw Opens Azure Accounts to Takeover|https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/]]|Azure OAuth|
|2019.12.05|CISO Mag| → [[Security Flaw in Microsoft Azure Lets Hackers Control Azure Accounts|https://www.cisomag.com/security-flaw-in-microsoft-azure-lets-hackers-control-azure-accounts/]]|Azure OAuth|
|2019.12.02|//McAfee//|[[Data in the Cloud is Much More at Risk Than Enterprises May Think|https://www.cisomag.com/a-secure-bridge-to-the-cloud/]]|Risks|
|2019.12.02|//Cloudflare//|[[The Serverlist: Full Stack Serverless, Serverless Architecture Reference Guides, and more|https://blog.cloudflare.com/serverlist-10th-edition/]]|Serverless|
[>img(200px,auto)[iCSF/DKCFCS.png]]L'agence nationale de sécurité danoise, "Center for Cybersikkerhed", et le Conseil national de la numérisation ont publié un guide intitulé "//Vejledning til anvendelse af Cloudservices//" ou "Nouvelle orientation sur le Cloud pour les agences gouvernementales", avec un ensemble de directives.
!Contexte
[>img(80px,auto)[iCSF/DK.png]]Le document intègre des considérations commerciales, juridiques et de sécurité que les autorités devraient prendre en compte lors de l'utilisation de services Cloud.
Son but est de fournir un cadre d'utilisation et un processus de prise de décision pour savoir si les services Cloud peuvent être utilisés ou non. 
Il passe donc en revue ce qu'est le Cloud, et les problèmes juridiques clés, explique comment aborder la sécurité des informations lors du transfert d'une application vers le Cloud, donne les moyens de d'évaluer les opportunités et les responsabilités liées à l'utilisation du Cloud.
Les 4 parties principales du document sont ainsi :
* Introduction aux services Cloud : les concepts de base, les modèles, leurs avantages et inconvénients
* Aspects commerciaux : besoins de l'entreprise en matière de vices Cloud, et ce que cela implique pour l'organisation.
* Aspects juridiques : sécurité des données, notamment lors du traitement de données à caractère personnel
* Aspects sécurité de l'information : exigences sécurité spécifiques apportés par les services Cloud
!Principaux éléments du guide
* Nécessité de clarifier les exigences de l'entité qui a le besoin et les implications organisationnelles des opérations et du développement basés sur le Cloud
* Évaluer les risques techniques, de sécurité, financiers, procéduraux, d'organisation et de compétence.
** Veiller à ce que les mesures de sécurité soient reflétées dans les exigences de la solution Cloud
** Permettre un contrôle adapté de la conformité du fournisseur aux exigences convenues et acceptées
** Prendre en compte les futures exigences
* Si des données à caractère personnel sont en jeu, prendre en compte certaines considérations particulières résultant du RGPD.
** L'évaluation des risques doit porter sur les risques liés au traitement de données à caractère personnel
** Mener une analyse d'impact si le niveau de risque pour les droits des personnes concernées est élevé
** Intégrer si nécessaire les aspects de localisation des données, avec éventuellement la localisation au Danemark
** Conclure un contrat de traitement de données, incluant notamment des conditions ou instructions de supervision, de déclaration d'assurance, de transfert dans des pays tiers, de localisation du traitement, ainsi que le retour et la suppression des données à la fin du contrat
** Utiliser, par exemple, la norme ISO 27701 qui permet de cartographier les liens entre les dispositions du RGD et la sécurité de l'information. Le cas échéant, s'appuyer sur les normes ISO 27001, 27002, 27017 et 27018.
Enfin, le guide rappelle aussi qu'il appartient à l'entité concernée de veiller à ce que les objectifs de sécurité soient atteints.
Même s'il est principalemnt destiné aux institutions publiques et gouvernementales, ce guide peut également s'appliqué dans le privé.
!Plan du guide
Le guide comporte 46 pages :[>img(200px,auto)[iCSF/JBTDK.png]]
|!1|>|!Introduction|
|!2|>|!Introduction aux services Cloud|
|!3|>|!Aspects commerciaux|
| |3.1|Besoins d'organisation et de compétences|
|~|3.2|Agilité et innovation|
|~|3.3|Dimensionnement|
|~|3.4|Dépendance au fournisseur|
|~|3.5|Gestion financière|
|!4|>|!Aspects juridiques|
| |4.1|Conditions spéciales pour le traitement des données personnelles|
|~|4.2|Contrats de traitement de données|
|~|4.3|Transferts en provenance de pays tiers|
|~|4.4|Évaluation d'impact|
|~|4.5|La condition de localisation requise par la loi sur la protection des données|
|~|4.6|Protection des données par la conception et par défaut|
|~|4.7|Autre législation|
|!5|>|!Aspects sécurité|
| |5.1|Évaluation des risques de la solution Cloud|
|~|5.2|Sécurité de traitement|
|~|5.3|Sécurité et nécessité de clarification|
|~|5.4|Sécurité des achats|
|~|5.5|Sécurité pendant le fonctionnement|
|~|5.6|Résiliation ou modification de la relation fournisseur|
|~|5.7|Gestion des mises à jour|
|~|5.8|Formation|
|~|5.9|Test et développement|
|!6|>|!Synthèse|
!Liens
* Annonce :  → ''[[CloudSecurityAlliance.fr/go/jc7a/|https://cloudsecurityalliance.fr/go/jc7a/]]'' 
* Document (en danois, format PDF) :  → ''[[CloudSecurityAlliance.fr/go/jc7p/|https://cloudsecurityalliance.fr/go/jc7p/]]'' 
[img[iCSF/flag_fr.png]][img(50%,1px)[iCSF/BluePixel.gif]]
!"//Cloud Security Alliance Announces Industry's First Credential for Cloud Auditing//"
<<<
[>img(200px,auto)[iCSA/CCAK.png]]//The Certificate of Cloud Auditing Knowledge ([[CCAK]]) allows professionals to demonstrate expertise in auditing cloud computing systems
Las Vegas - Dec. 4, 2019. The [[Cloud Security Alliance]] ([[CSA]]), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the Certificate of Cloud Auditing Knowledge ([[CCAK]]), the only credential for industry professionals that demonstrates expertise in the essential principles of auditing cloud computing systems. Set to be released in the second half of 2020, the [[CCAK]] aims to solve the current industry knowledge gap for IT audit and security professionals trained and certified for traditional on-premise IT auditing and assurance.

Designed to provide CISOs, security and compliance managers, internal and external auditors, and practitioners of tomorrow with the proven skillset to address the specific concerns that arise from the use of various forms of cloud services, the [[CCAK]] will provide a common baseline of expertise and shared nomenclature to ensure that IT auditors and other related stakeholders are communicating appropriately and accurately regarding the effectiveness of cloud security controls.

With its focus on cloud computing, the [[CCAK]] differs from traditional IT audit certification programs, which have many excellent elements, but were not developed with an understanding of cloud computing and its many nuances. An audited organization using cloud computing, for instance, will have a very different approach to satisfying control objectives, and a cloud tenant will certainly not have the same administrative access as in a legacy IT system and will employ a wide range of security controls that will be foreign to an audit and assurance professional grounded in traditional IT audit practices.

"Cloud computing represents a radical departure from legacy IT in virtually every respect. The new technology architecture, the nature of how cloud is provisioned, and the new shared responsibility model means that IT audits must be significantly altered to provide assurance to stakeholders that their cloud adoption is secure," said Jim Reavis, co-founder and CEO, ''Cloud Security Alliance''. "Because CSA already has developed the most widely adopted cloud security audit criteria and organizational certification, we are uniquely positioned to lead efforts to ensure industry professionals have the requisite skill set for auditing cloud environments."

The [[CCAK]]'s holistic body of knowledge will be composed of the ''CSA'''s ''Cloud Controls Matrix'' ([[CCM]]), the fundamental framework of cloud control objectives; its companion ''Consensus Assessments Initiative Questionnaire'' ([[CAIQ]]), the primary means for assessing a cloud provider's adherence to ''CCM''; and the ''Security, Trust, Assurance & Risk'' ([[STAR]]) program, the global leader in cloud security audits and self-assessments, in addition to new material.

For more than 10 years, ''CSA'' has led the development of the trusted cloud ecosystem, which notably includes the ''STAR'' program and the Certificate of Cloud Security Knowledge ([[CCSK]]), the gold standard for measuring professional competency in cloud security. The [[CCAK]] and the [[CCSK]] will complement one another in that the [[CCSK]] provides the knowledge that enables an expert to secure cloud systems that will, in turn, be successfully scrutinized by an expert holding the [[CCAK]]. In many cases, an industry professional will be well served by obtaining both certificates.

Because the [[CCAK]] is intended to create a common cloud audit understanding, it's expected to become a mandatory requirement for IT auditors and highly recommended for IT managers and professionals, especially governance, risk management, compliance, and vendor/supply chain management.//
<<<
__Liens :__
* Annonce :  → ''[[CloudSecurityAlliance.fr/go/jc4a/|https://cloudsecurityalliance.fr/go/jc4a/]]''
* Page dédiée au CCAK → ''[[CloudSecurityAlliance.fr/go/CCAK/|https://cloudsecurityalliance.fr/go/CCAK/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 25 novembre au 1^^er^^ décembre 2019 [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Appel à commentaires, document "''Cloud Incident Response Framework – A Quick Guide''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Cloud Incident Response Framework – A Quick Guide']]>>=== 
* Actu : Appel à commentaires, document "''Hybrid Cloud and Its Associated Risks''" +++*[»]> <<tiddler [[2019.11.28 - Actu : Appel à commentaires, document 'Hybrid Cloud and Its Associated Risks']]>>=== 
* Blog : 'Qu'est-ce que la Pseudo Crypto-Monnaie' +++*[»]> <<tiddler [[2019.11.25 - Blog : Qu'est-ce que la Pseudo Crypto-Monnaie]]>>=== 
* Actu : Derniers jours pour ''valider la traduction en français de 3 documents CSA'' (CCM, CAIQ et PLA CoC) +++*[»]> <<tiddler [[2019.11.13 - Actu : Demande de validation de la traduction en français de 3 documents CSA]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.12.01 - Veille Hebdomadaire]] avec plus de 30 liens
* Bonnes pratiques et recommendations : Docker, Kubernetes
* Rapport : ''CIGREF'' sur la régulation du marché européen du Cloud +++*[»]> 
|2019.11.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Services Cloud : Microsoft veut appliquer la conformité au RGPD partout|https://www.silicon.fr/services-cloud-microsoft-veut-appliquer-la-conformite-rgpd-partout-326317.html]]|Microsoft GDPR|
|2019.11.18|//Microsoft//| → [[Introducing more privacy transparency for our commercial cloud customers|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/]]|Microsoft GDPR|
|2019.11.18|The Register| → [[You're about to gouda major change in Microsoft cloud security after Redmond agrees to go Dutch on data|https://www.theregister.co.uk/2019/11/18/microsoft_gdpr_moj_deal/]]|Microsoft GDPR|
|2019.11.18|CBR Online| → [[Microsoft Buckles Under EU Pressure: Changes Cloud Contracts to Reflect "Data Controller" Role|https://www.cbronline.com/news/microsoft-cloud-terms]]|Microsoft GDPR|
|2019.11.19|Le Monde Informatique[>img[iCSF/flag_fr.png]]| → [[Microsoft révise ses contrats de services cloud pour l'Union européenne|https://www.lemondeinformatique.fr/actualites/lire-microsoft-revise-ses-contrats-de-services-cloud-pour-l-union-europeenne-77118.html]]|Microsoft GDPR|
=== 
* Divers : Cloud et résilience, Cloud et PRA, évaluation des prestataires Cloud
!3 - Contacts>>
|!Décembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.12.01|
|2019.12.01|KitPloit|[[CCAT - Cloud Container Attack Tool For Testing Security Of Container Environments|https://www.kitploit.com/2019/12/ccat-cloud-container-attack-tool-for.html]]|Tools Containers|
|2019.12.01|//Tripwire//|[[Security for Cloud Services: IaaS Deep Dive|https://www.tripwire.com/state-of-security/security-data-protection/cloud/security-cloud-services-iaas-deep-dive/]] (3/3)|IaaS|
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.29|
|2019.11.29|Center for Cybersikkerhed|![[Nouvelle directive sur le cloud pour les autorités publiques|https://fe-ddis.dk/cfcs/nyheder/arkiv/2019/Pages/cloudvejledning-for-offentlige-myndigheder.aspx]]|Guidelines Denmark|
|2019.11.29|Container Journal|[[Sysdig's Third Annual Container Usage Report Reveals That Container Lifespan Has Been Cut in Half |https://containerjournal.com/news/news-releases/sysdigs-third-annual-container-usage-report-reveals-that-container-lifespan-has-been-cut-in-half/]]|Containers Survey|
|2019.11.29|//Fortinet//|[[Four ways to develop a hybrid cloud security strategy|https://www.itworldcanada.com/sponsored/four-ways-to-develop-a-hybrid-cloud-security-strategy]]|Hybrid_Cloud|
|2019.11.29|//Sunguard//|![[Embedding resilience into your cloud-based modernisation strategy|https://www.continuitycentral.com/index.php/news/resilience-news/4674-embedding-resilience-into-your-cloud-based-modernisation-strategy]]|Resilience|
|>|>|>|!2019.11.28|
|2019.11.28|//DivvyCloud//|[[Forecasting the cloud security landscape in 2020|https://betanews.com/2019/11/28/forecasting-cloud-security-2020/]]|Predictions|
|2019.11.28|//Cloudonaut//|[[Checklist: Is your application ready for a container cluster?|https://cloudonaut.io/checklist-container-cluster-ecs-fargate/]]|Containers|
|>|>|>|!2019.11.27|
|2019.11.27|Journal du Net[>img[iCSF/flag_fr.png]]|[[Etat des lieux du cloud dans le secteur de la santé|https://www.journaldunet.com/solutions/expert/72165/etat-des-lieux-du-cloud-dans-le-secteur-de-la-sante.shtml]]|Healthcare|
|2019.11.27|ZDnet|[[Predictions 2020: Cloud computing sees new alliances and new security concerns|https://news.hitb.org/content/predictions-2020-cloud-computing-sees-new-alliances-and-new-security-concerns]]|Predictions|
|2019.11.27|Container Journal|[[Securing Docker Containers: A Primer|https://containerjournal.com/topics/container-security/securing-docker-containers-a-primer/]]|Docker|
|2019.11.27|//Compare the Cloud//|[[A brief history of disaster recovery|https://www.comparethecloud.net/articles/a-brief-history-of-disaster-recovery/]] ([[vidéo|https://www.youtube.com/watch?v=BJ2g_1-m_mo]])|DRP DRaaS|
|2019.11.27|//Google Cloud//|[[Exploring container security: Day one Kubernetes decisions|https://cloud.google.com/blog/products/containers-kubernetes/security-considerations-for-google-kubernetes-engine]]|Kubernetes Best_Practices|
|2019.11.27|//Alcide//|[[Prevent Costly Mistakes that Expose Your Kubernetes Service|https://blog.alcide.io/prevent-costly-mistakes-that-expose-your-kubernetes-service]]|Kubernetes Best_Practices|
|2019.11.27|//Tresorit//|[[Choosing the Right Cloud Provider: The Importance of Security Assessments|https://www.infosecurity-magazine.com/blogs/choosing-the-right-cloud-provider/]]|Vendors Assessment|
|>|>|>|!2019.11.26|
|2019.11.26|Solutions Numériques[>img[iCSF/flag_fr.png]]|[[Sécurité d'Office 365 : les entreprises doivent agir|https://www.solutions-numeriques.com/dossiers/securite-doffice-365-les-entreprises-doivent-agir/]]|O365|
|2019.11.26|Alain Bensoussan[>img[iCSF/flag_fr.png]]|[[Les contrats cloud Microsoft rattrapés par le RGPD|https://www.alain-bensoussan.com/avocats/les-contrats-cloud-microsoft-rattrapes-par-le-rgpd/2019/11/26/]]|Microsoft RGPD|
|2019.11.26|ZDnet|[[A hacking group is hijacking Docker systems with exposed API endpoints|https://www.zdnet.com/article/a-hacking-group-is-hijacking-docker-systems-with-exposed-api-endpoints/]]|Attacks Docker|
|2019.11.26|Silicon Angle|[[Vulnerable Docker instances targeted in cryptocurrency mining campaign|https://siliconangle.com/2019/11/27/vulnerable-docker-instances-targeted-cryptocurrency-mining-campaign/]]|Attacks Docker|
|2019.11.26|Silicon Angle|[[Designing security for an open-source, containerized, cloud-native world|https://siliconangle.com/2019/11/26/designing-security-for-an-open-source-containerized-cloud-native-world-kubecon/]] ([[vidéo|http://www.youtube.com/watch?v=i4Xo_OYSShk]])|Cloud_Native Containers|
|>|>|>|!2019.11.25|
|2019.11.25|LeMagIT[>img[iCSF/flag_fr.png]]|[[Sécurité du cloud : dix ans après le lancement de la CSA, les chantiers restent énormes|https://www.lemagit.fr/actualites/252474540/Securite-du-Cloud-dix-ans-apres-le-lancement-de-la-CSA-les-chantiers-restent-enormes]]|CSA trends|
|2019.11.25|CIGREF[>img[iCSF/flag_fr.png]]|![[SWIPO : Échec de la régulation du marché européen du cloud|https://www.cigref.fr/swipo-echec-regulation-marche-europeen-cloud]] ([[pdf|https://www.cigref.fr/wp/wp-content/uploads/2019/11/CP-SWIPO-Cigref-version-francaise-2019-11-25.pdf]])|Regulations SWIPO|
|2019.11.25|LeMagIT[>img[iCSF/flag_fr.png]]| → [[Pour le Cigref, la première tentative d'autorégulation du cloud en Europe est un "échec"|https://www.lemagit.fr/actualites/252474525/Pour-le-CIGREF-la-premiere-tentative-dautoregulation-du-cloud-en-Europe-est-un-echec]]|Regulations SWIPO|
|2019.11.26|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Cloud : le Cigref adoube les contrats IaaS mais critique le SaaS|https://www.silicon.fr/cloud-europeen-cigref-critique-saas-327207.html]]|Regulations SWIPO|
|2019.11.25|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Multicloud : la sécurité est le principal défi à relever|https://www.silicon.fr/multicloud-securite-principal-defi-327095.html]]|Misc|
|2019.11.25|Solutions Review|[[Google Announces New Security Capabilities for Google Cloud|https://solutionsreview.com/cloud-platforms/google-announces-new-security-capabilities-for-google-cloud/]]|GCP|
|2019.11.25|CBR On Line|[[An Idiot's Guide to Kubernetes|https://www.cbronline.com/feature/an-idiots-guide-to-kubernetes]]|Kubernetes|
|2019.11.25|Techradar Pro|[[Amazon files official JEDI contract complaint|https://www.techradar.com/news/amazon-files-official-jedi-contract-complaint]]|JEDI|
|2019.11.25|eWeek|[[Recognizing the Right Stuff in Cloud Security|https://www.eweek.com/cloud/recognizing-the-right-stuff-in-cloud-security]]|Misc|
|2019.11.25|//Cisco//|[[Security's New Address: The Cloud|https://umbrella.cisco.com/blog/2019/11/25/securitys-new-address-the-cloud/]]|Gartner Network|
|2019.11.25|//Compare the Cloud//|[[Cloud Vendor Assessments - Done The Right Way|https://www.comparethecloud.net/articles/cloud-vendor-assessments-done-right/]]|Vendors Assessment|
|2019.11.25|//Heimdal//|[[What is the Zero Trust Model?|https://heimdalsecurity.com/blog/what-is-the-zero-trust-model/]]|Zero_Trust|
!"//Cloud Security Alliance Announces Speakers for CSA Summit at RSA Conference 2020//"
[>img(100px,auto)[iCSA/K2OEC.png]]Le CSA Summit aura lieu le 24 février 2020 à San Francisco.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/press-releases/2019/12/17/cloud-security-alliance-announces-speakers-for-csa-summit-at-rsa-conference-2020/]] sur le site de la Cloud Security Alliance.
&rArr; Le site du [[CSA Summit|https://cloudsecurityalliance.org/events/csa-summit-at-rsa-conference-2020]] à la ''RSA Conference 2020''

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//​CCPA is Ambiguous About Cloud. Your Response Shouldn’t Be//"
[>img(100px,auto)[iCSA/JCIBC.jpg]]^^Article publié le 18 décembre sur le blog de la CSA, et après l'avoir été 2 jours auparavant sur le site de la société Fugue.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/blog/2019/12/18/ccpa-is-ambiguous-about-cloud-your-response-shouldn-t-be/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.fugue.co/blog/ccpa-is-ambiguous-about-cloud.-your-response-shouldnt-be]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//The Four Pillars of CASB: Visibility//"
[>img(100px,auto)[iCSA/JC4BT.jpg]]^^Article publié le 4 décembre sur le blog de la CSA, et après l'avoir été il y a plus de 6 semaines sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/articles/the-four-pillars-of-casb-visibility/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/four-pillars-casb-visibility]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201911>>
<<tiddler fAll2Tabs10 with: VeilleM","_201911>>
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|2019.11.19|//PaloAlto Networks//|![[Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271|https://unit42.paloaltonetworks.com/docker-patched-the-most-severe-copy-vulnerability-to-date-with-cve-2019-14271/]]|Docker CVE-2019-14271|
|2019.07.25|MITRE|[[CVE-2019-14271|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14271]]|Docker CVE-2019-14271|
|2019.11.19|GBHackers on Security| → [[Most Critical Docker Vulnerability Let Hackers To Take Complete Control Over Host & All Containers Within It|https://gbhackers.com/docker-vulnerability/]]|Docker CVE-2019-14271|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Novembre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201911>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Novembre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Novembre 2019]]>><<tiddler fAll2LiTabs with: Actu","201911>>
<<tiddler fAll2LiTabs with: Blog","201911>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Novembre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201911>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Novembre 2019]]>>
Un appel à commentaires dont la date de clôture est le ''27 décembre 2019'' : "''Cloud Incident Response Framework – A Quick Guide''".
<<<
//What this Quick Guide aims to do is to distill and give readers an overview of key contributions of the work currently undertaken in the CIR WG, towards a comprehensive CIR framework. The CIR WG hopes to take this opportunity to encourage volunteers to participate in the WG's efforts and provide valuable feedback to the ongoing work.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/jbsi/|https://cloudsecurityalliance.fr/go/jbsi/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
Un appel à commentaires dont la date de clôture est le ''27 décembre 2019'' : "''Hybrid Cloud and Its Associated Risks''".
<<<
//Cloud computing is flourishing. Hybrid clouds, especially, have been gaining more traction as cloud customers increasingly understand that using public clouds or private clouds alone poses certain limitations. Hybrid cloud is often the starting point for organizations to get started on the cloud journey and this document aims to describe the concept and value of hybrid clouds, highlight key application scenarios and point out security risks in the hybrid cloud.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/jbsh/|https://cloudsecurityalliance.fr/go/jbsh/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//What's a Pseudo Cryptocurrency?//"
[>img(150px,auto)[iCSA/JBLBD.jpg]]Article de blog publié le 25 novembre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//You may not have yet seen the term "pseudo cryptocurrency," in fact it (as of 2019-08-22) it only shows up 2030 Google search results and a quarter million without the quotes. So if nobody is using this term, why does it matter?
Currently, we have a number of established cryptocurrencies such as Bitcoin, Ethereum, Litecoin, Zcash, Mondero and so on. They tend to share two major characteristics:
* They are decentralized, meaning no single central authority controls them entirely
* Secondly, they can be used to represent value, with varying degrees of stability, or in the case of Bitcoin: buckle up!
The term pseudo cryptocurrency is not completely established yet but appears to be in use for two main reasons. You want to talk about a cryptocurrency that isn't decentralized enough and is part of a scammy initial coin offering. Or you want to talk about something that has many of the properties of the established cryptocurrencies but isn't a currency.

The first case isn't too interesting, there are many new cryptocurrency projects that are not decentralized or "pure" enough, and to be clear there is a place for these.
The second case is much more interesting, like most new technologies we started with a single ambitious use case ("replace all the banks! 2EZ!") that has morphed and grown to other use cases (e.g. inventory tracking and food safety) and we're even starting to see hybrid projects. Measuring and tracking value is a core activity for many businesses and projects. Still, you probably don't want to actually be a currency as this means you'll have to deal with the SEC (in America) or their local counterpart, and if you're really unlucky, you may end up in front of a Senate hearing getting grilled on just what exactly it is you're planning to do.

Many systems that store and distribute information (privately and publicly) can also allow you to conduct transactions with it. For example, a résumé or CV cannot be spent to buy a candy bar, but a good résumé or CV can definitely help you get a better job so you can buy more candy bars. You can't "spend" your résumé, but you can increase the value inherent in your résumé through training, experience, certifications and so on that can then be used to get a pay raise or a better job. Measuring that value is where the pseudo cryptocurrency comes in. Allowing the market to abstract the value into a standard form makes it much easier to examine and compare résumés. For people using the system, they can listen to what the market values and get certifications that actually provide them with more value.
You can read more about Blockchain in CSA's uses cases research report +++*[here]> <<tiddler [[2018.11.27 - Publication : Blockchain DLT Use Cases]]>> ===. Interested in reading more about Blockchain from the Seifried Files?//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jbpb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 18 au 24 novembre 2019
* Publication : 4 documents CSA sur le ''RGPD'' +++*[»]> <<tiddler [[2019.11.19 - Publication : 4 documents CSA sur le RGPD]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Publication : Présentations au Forum CSA 2019 du Colorado +++*[»]> <<tiddler [[2019.11.18 - Publication : Présentations au Forum CSA 2019 du Colorado]]>>=== 
* Actu : Nouvelle ''demande de validation de la traduction en français de 3 documents CSA'' (CCM, CAIQ et PLA CoC) +++*[»]> <<tiddler [[2019.11.13 - Actu : Demande de validation de la traduction en français de 3 documents CSA]]>>=== 
* Actu : CCSK Plus Labs pour plate-forme Microsoft Azure +++*[»]> <<tiddler [[2019.11.20 - Actu : CCSK Plus Labs pour plate-forme Microsoft Azure]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.24 - Veille Hebdomadaire]]>>=== avec plus de 40 liens
* Alerte : analyse de la vulnérabilité ''Docker CVE-2019-14271''
* Incidents et pannes : plusieurs pannes Azure en Australie
* Outils : Benchmarking CIS pour AWS, Azure et GCP +++*[»]> 
=== 
* Divers : répertoire de liens sur Dockers, Chaos Engineering pour Kubernetes, Threat Hunting pour AWS +++*[»]> 
|2019.11.19|//AWS//|[[Enabling a Threat Hunting Capability in AWS (pdf)|https://pages.awscloud.com/rs/112-TZM-766/images/How-to-Build-a-Threat-Hunting-Capability-in-AWS_Whitepaper.pdf]]|Threat_Hunting|
|2019.11.21|//AWS//| → [[How to Build a Threat Hunting Capability in AWS (pdf)|https://pages.awscloud.com/rs/112-TZM-766/images/How-to-Build-a-Threat-Hunting-Capability-in-AWS_Slides.pdf]]|Threat_Hunting|
=== 
* Rapport : INAP, Information Security Forum+++*[»]>
|2019.11.19|Information Security Forum|[[ISF Releases Using Cloud Services Securely: Harnessing Core Controls|https://vmblog.com/archive/2019/11/19/isf-releases-using-cloud-services-securely-harnessing-core-controls.aspx]]|Best_Practices Controls|
|2019.11.19|Information Security Forum| → [[Using Cloud Services Securely: Harnessing Core Controls|https://www.securityforum.org/research/using-cloud-services-securely-harnessing-core-controls/]] ([[synthèse|https://www.securityforum.org/uploads/2019/11/ISF_Using-Cloud-Services-Securely_Executive-Summary-PWS-new.pdf]])|Best_Practices Controls|
===, TrendMicro
!3 - Conférences et Salons
* Le ''Cloud & Cyber Security Expo c'est cette semaine'' : ''mercredi 27 et jeudi 28 novembre'' à Paris, Porte de Versailles
** ''Troisième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.22 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (3/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
!4 - Contacts
<<tiddler .ReplaceTiddlerTitle with: [[Newsletter Hebdomadaire - 24 Novembre 2019]]>>
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.26|
|2019.11.26|Informatique News[>img[iCSF/flag_fr.png]]|[[Google abandonne Cloud Print|https://www.informatiquenews.fr/google-abandonne-cloud-print-65041]]|GCP|
|2019.11.26|InfoSecurity Mag|[[DevOps, Cloud and Remote Workers Dominate 2020 Risks|https://www.infosecurity-magazine.com/news/devops-cloud-remote-workers/]]|Trends Risks|
|>|>|>|!2019.11.24|
|2019.11.24|//Tripwire//|[[Cloud Security Threats: Escaping the Egregious Eleven - Part Two|https://www.tripwire.com/state-of-security/featured/cloud-security-threats-escaping-egregious-eleven-part-two/]] (2/2)|CSA Threats|
|2019.11.24|//Tripwire//|[[Security for Cloud Services: PaaS Deep Dive|https://www.tripwire.com/state-of-security/security-data-protection/cloud/security-cloud-services-paas-deep-dive/]] (2/3)|PaaS|
|>|>|>|!2019.11.22|
|2019.11.22|Wired|[[1.2 Billion Records Found Exposed Online in a Single Server|https://www.wired.com/story/billion-records-exposed-online/]]|Data_Leak|
|2019.11.22|Data Viper| → [[Personal and Social information of 1.2 billion people Discovered in Massive Data Leak|https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/]]|Data_Leak|
|2019.11.22|CRN|[[Australia cops third Microsoft cloud outage in a week|https://www.crn.com.au/news/australia-cops-third-microsoft-cloud-outage-in-a-week-534452]]|Azure Outage Australia|
|2019.11.22|//Blissfully//|[[What HR Needs to Know About SaaS Security|https://www.blissfully.com/blog/what-hr-needs-to-know-about-saas-security/]]|SaaS|
|>|>|>|!2019.11.21|
|2019.11.21|Bleeping Computer|[[Microsoft 365 Experiencing OneDrive and SharePoint Outages|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-experiencing-onedrive-and-sharepoint-outages/]]|O365 OneDrive Sharepoint Outage|
|2019.11.21|ComputerWeekly|[[Security Think Tank: Stopping data leaks in the cloud|https://www.computerweekly.com/opinion/Security-Think-Tank-Stopping-data-leaks-in-the-cloud]]|DataLeaks|
|2019.11.21|Federal News Network|[[Goodrich overcame naysayers, doubters to advance cloud security|https://federalnewsnetwork.com/ask-the-cio/2019/11/goodrich-overcame-naysayers-doubters-to-advance-cloud-security/]]|Misc|
|2019.11.21|//Security Intelligence//|[[5 Cloud Security Considerations to Ensure a Successful Migration|https://securityintelligence.com/posts/5-cloud-security-considerations-to-ensure-a-successful-migration/]]|Migration|
|2019.11.21|//FireEye//|[[The Cloud Revolution and the Future of the SOC|https://www.fireeye.com/blog/products-and-services/2019/11/cloud-revolution-and-the-future-of-the-soc.html]] ([[podcast|https://www.hipcast.com/podcast/HqmqyRZs]] [[mp3|https://fireeyeinc.hipcast.com/download/fireeyeinc-20191119120146-2659.mp3]])|SOC|
|2019.11.21|//Caylent//|[[Top Secrets Management Tools Compared|https://caylent.com/top-secrets-management-tools-compared]]|Secret_Management|
|2019.11.21|//Respond//|[[Who Needs a SIEM with All These Cloud Services Options?|https://respond-software.com/blog/siem-cloud-service-options/]]|SIEM|
|>|>|>|!2019.11.20|
|2019.11.20|Forbes|[[The Kubernetes Ship Has Set Sail: Is Your Security Team On Board?|https://www.forbes.com/sites/forbestechcouncil/2019/11/20/the-kubernetes-ship-has-set-sail-is-your-security-team-on-board/]]|Kubernetes|
|2019.11.20|Infosec|[[Malware overview - Graboid|https://resources.infosecinstitute.com/malware-overview-graboid/]]|Graboid|
|2019.11.20|The Register|[[Cloud nine to cloud nein: Google beefs up punters' data encryption to fend off cyber-thieves|https://www.theregister.co.uk/2019/11/20/google_cloud_next/]]|GCP|
|2019.11.21|CRN| → [[Google Cloud unveils new security capabilities|https://www.crn.com.au/news/google-cloud-unveils-new-security-capabilities-534305]]|GCP|
|2019.11.20|David Balut|[[Useful training and mindset for becoming a Cloud Security Architect|https://dawidbalut.com/2019/11/20/useful-training-and-mindset-for-becoming-a-cloud-security-architect/]]|Training|
|2019.11.20|CRN|[[Microsoft blames networking build for 365 outage|https://www.crn.com.au/news/microsoft-blames-networking-build-for-365-outage-534278]]|Azure Outage Australia|
|2019.11.20|//Security Intelligence//|[[Reimagining Security for a Multicloud World|https://securityintelligence.com/posts/reimagining-security-for-a-multicloud-world/]]|Multi_Cloud|
|2019.11.20|//Checkpoint//|[[6 DevSecOps Sessions You Won't Want to Miss at AWS Re:Invent|https://blog.checkpoint.com/2019/11/20/6-devsecops-sessions-you-wont-want-to-miss-at-aws-reinvent/]]|DevSecOps|
|2019.11.20|//Google Cloud//|[[Advancing control and visibility in the cloud|https://cloud.google.com/blog/products/identity-security/new-security-tools-for-google-cloud-and-g-suite]]|GCP|
|2019.11.20|//INAP//|[[New Survey: IT Professionals Want to Embrace Cloud Services, Update IT Infrastructure and Expand Job Roles|https://www.inap.com/press-release/state-it-infrastructure-management-2019/]]|Report|
|2019.11.20|//INAP//| → [[New Survey Report: The State of IT Infrastructure Management|https://www.inap.com/blog/state-it-infrastructure-management-2019/]]|Report|
|>|>|>|!2019.11.19|
|2019.11.19|Information Security Forum|[[ISF Releases Using Cloud Services Securely: Harnessing Core Controls|https://vmblog.com/archive/2019/11/19/isf-releases-using-cloud-services-securely-harnessing-core-controls.aspx]]|Best_Practices Controls|
|2019.11.19|Information Security Forum| → [[Using Cloud Services Securely: Harnessing Core Controls|https://www.securityforum.org/research/using-cloud-services-securely-harnessing-core-controls/]] ([[synthèse|https://www.securityforum.org/uploads/2019/11/ISF_Using-Cloud-Services-Securely_Executive-Summary-PWS-new.pdf]])|Best_Practices Controls|
|2019.12.13|UK Authority| → [[Information Security Forum highlights threats to IoT and cloud|https://www.ukauthority.com/articles/information-security-forum-highlights-threats-to-iot-and-cloud/]]|Best_Practices Controls|
|2019.11.19|//PaloAlto Networks//|![[Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271|https://unit42.paloaltonetworks.com/docker-patched-the-most-severe-copy-vulnerability-to-date-with-cve-2019-14271/]]|Docker CVE-2019-14271|
|2019.07.25|MITRE|[[CVE-2019-14271|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14271]]|Docker CVE-2019-14271|
|2019.11.19|GBHackers on Security| → [[Most Critical Docker Vulnerability Let Hackers To Take Complete Control Over Host & All Containers Within It|https://gbhackers.com/docker-vulnerability/]]|Docker CVE-2019-14271|
|2019.11.19|CRN|[[Microsoft 365 outage strikes, lasts about four hours|https://www.crn.com.au/news/microsoft-365-outage-strikes-534267]]|Azure Outage Australia|
|2019.11.19|ZDnet|[[Nextcry : un ransomware s'attaque aux instances NextCloud|https://www.zdnet.fr/actualites/nextcry-un-ransomware-s-attaque-aux-instances-nextcloud-39894109.htm]]|NextCloud Ransomware|
|2019.11.19|//TrendMicro//|[[The New Norm - Trend Micro Security Predictions For 2020|https://www.trendmicro.com/vinfo/fr/security/research-and-analysis/predictions/2020]] ([[rapport (pdf)|https://documents.trendmicro.com/assets/rpt/rpt-the-new-norm-trend-micro-security-predictions-for-2020.pdf]]|Trends Report|
|2019.11.19|//Neuvector//|[[Serverless 101: When It Makes Sense and When It Doesn't|https://neuvector.com/cloud-security/why-serverless/]] (1/3)|Serverless|
|2019.11.19|NextGov|[[Flash Poll: Capturing the Power of Cloud|https://www.govexec.com/insights/reports/flash-poll-capturing-power-cloud/161239/]]|Survey|
|2019.11.19|//AWS//|[[Enabling a Threat Hunting Capability in AWS (pdf)|https://pages.awscloud.com/rs/112-TZM-766/images/How-to-Build-a-Threat-Hunting-Capability-in-AWS_Whitepaper.pdf]]|Threat_Hunting|
|2019.11.21|//AWS//| → [[How to Build a Threat Hunting Capability in AWS (pdf)|https://pages.awscloud.com/rs/112-TZM-766/images/How-to-Build-a-Threat-Hunting-Capability-in-AWS_Slides.pdf]]|Threat_Hunting|
|>|>|>|!2019.11.18|
|2019.11.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Services Cloud : Microsoft veut appliquer la conformité au RGPD partout|https://www.silicon.fr/services-cloud-microsoft-veut-appliquer-la-conformite-rgpd-partout-326317.html]]|Microsoft GDPR|
|2019.11.18|//Microsoft//| → [[Introducing more privacy transparency for our commercial cloud customers|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/|https://blogs.microsoft.com/eupolicy/2019/11/18/introducing-privacy-transparency-commercial-cloud-customers/]]|Microsoft GDPR|
|2019.11.18|The Register| → [[You're about to gouda major change in Microsoft cloud security after Redmond agrees to go Dutch on data|https://www.theregister.co.uk/2019/11/18/microsoft_gdpr_moj_deal/]]|Microsoft GDPR|
|2019.11.18|CBR Online| → [[Microsoft Buckles Under EU Pressure: Changes Cloud Contracts to Reflect "Data Controller" Role|https://www.cbronline.com/news/microsoft-cloud-terms]]|Microsoft GDPR|
|2019.11.19|Le Monde Informatique[>img[iCSF/flag_fr.png]]| → [[Microsoft révise ses contrats de services cloud pour l'Union européenne|https://www.lemondeinformatique.fr/actualites/lire-microsoft-revise-ses-contrats-de-services-cloud-pour-l-union-europeenne-77118.html]]|Microsoft GDPR|
|2019.11.18|DZone|![[The Complete Docker Collection|https://dzone.com/articles/the-complete-docker-collection-tutorials]]|Docker Tutorials|
|2019.11.18|DZone|[[Containers vs. Serverless|https://dzone.com/articles/containers-vs-serverless]]|Containers Serverless|
|2019.11.18|TechBeacon|[[Why you should shift your cloud security strategy up stack|https://techbeacon.com/security/why-you-should-shift-your-cloud-security-strategy-stack]]|Strategy|
|2019.11.18|Shivbihari Pandey|[[Million Users PII Leak Data Leak|https://medium.com/bugbountywriteup/million-users-pii-leak-attack-288c5e37b283]]|Data_Leak|
|2019.11.18|//Gremlin//|[[Simple Kubernetes Targeting for Your Chaos Experiments|https://www.gremlin.com/blog/simple-kubernetes-targeting-for-your-chaos-experiments/]]|Kubernetes Chaos_Engineering|
|2019.11.18|BetaNews|[[Chaos engineering platform improves Kubernetes container reliability|https://betanews.com/2019/11/18/chaos-engineering-kubernetes/]]|Kubernetes Chaos_Engineering|
|2019.11.18|//Threatpost//|[[Office 365 Admins Targeted in Ongoing Phishing Scam|https://threatpost.com/office-365-admins-phishing/150352/]]|O365 Phishing|
|2019.11.18|//Sysdig//|[[Announcing the Cloud Native Security Hub|https://sysdig.com/blog/cloud-native-security-hub/]]|Sharing Configurations|
|2019.11.18|//Cavirin//|![[Cavirin Free for CIS benchmark now available on AWS and GCP|https://www.helpnetsecurity.com/2019/11/18/cavirin-free/]]|Benchmarking|
|2019.11.18|//Cavirin//| → [[Cavirin Platform Comparison|https://www.cavirin.com/environments/cavirin-free.html]]|Benchmarking|
|2019.11.28|//Tripwire//|[[Security for Cloud Services: SaaS Deep Dive|https://www.tripwire.com/state-of-security/security-data-protection/cloud/security-cloud-services-saas-deep-dive/]] (1/3)|SaaS|
|2019.11.18|//DataDog//|[[8 Facts about Real-World Container Use|https://www.datadoghq.com/container-report/]]|Containers Survey|
|2019.11.18|//WatchGuard//|[[2020 Security Predictions: Ransomware Targets the Cloud|https://www.secplicity.org/2019/11/18/2020-security-predictions-ransomware-targets-the-cloud/]]|Ransomware|
|2019.11.18|Nino Crudele|![[The three most effective and dangerous cyberattacks to Azure and countermeasures (part 3 – The privilege escalation)|https://ninocrudele.com/the-three-most-effective-and-dangerous-cyberattacks-to-azure-and-countermeasures-part-3-the-privilege-escalation]] (3/3)|Azure Attacks CounterMeasurement||
[>img(200px,auto)[iCSF/CCSEP2019.png]]Pour s'inscrire à la ''Cloud & Cyber Security Expo'' et disposer une deuxième aperçu du programme des conférences gratuites :

Suivez le lien → ''[[CloudSecurityAlliance.fr/go/jbls|https://CloudSecurityAlliance.fr/go/jbls]]''

[img(auto,60px)[iCSF/CCSA19h.jpg][https://CloudSecurityAlliance.fr/go/jbls]]
!CSA Congress EMEA 2019
[>img(250px,auto)[iCSA/201911DE-Berlin.jpg]]Après Amsterdam en 2012, et Madrid en 2016, le ''CSA Congress EMEA'' se déroulera à Berlin du 20 et 21 novembre 2019, après 2 jours de formations CSA
La [[Cloud Security Alliance]] est donc fière d'accueillir le Congrès 2019 de l'EMEA dans les locaux de son nouveau siège européen de Berlin.
Cette conférence de 4 jours comprendra 2 jours de formations, puis 2 jours de sessions de présentations et des possibilités de réseautage pour les professionnels de la sécurité du Cloud. Les participants pourront assister à un large éventail de présentations et de discussions sur des sujets d'actualité en matière de recherche, développement, pratiques et exigences liées à la sécurité dans le Cloud.
Cette année marque le dixième anniversaire de la CSA. Depuis sa création, la CSA s'est consacrée à la définition et à la sensibilisation aux bonnes pratiques afin d'assurer un environnement informatique dans le Cloud sécurisé partout dans le monde. Le congrès CSA EMEA est l'occasion pour nous de réfléchir aux expériences acquises par les entreprises et les fournisseurs alors que le Cloud est devenu le principal système informatique prédominant. Nous explorerons également de nouvelles frontières qui accélèrent le changement en matière de sécurité de l'information, telles que l'intelligence artificielle, le blockchain et l'IoT.
__Agenda :__[>img(250px,auto)[iCSA/JBICE.jpg]]
* Lundi 18 et mardi 19 novembre : formations
** ''RGPD'' : les 18 et 19
** ''CCSK'' : le 18
** ''Cloud Governance & Compliance Training Course'' : le 19
* Mercredi 20 et jeudi 21 novembre : le ''CSA Congress EMEA''
__Lieu :__
* Hotel Adlon Kempinski — Unter den Linden 77, 10117 Berlin, Germany
* Lien : ''[[CloudSecurityAlliance.fr/go/jBjH/|https://cloudsecurityalliance.fr/go/jBjH/]]''
__Appel à présentations :__ --[[ici|2019.03.30 - CSA Congress EMEA 2019 - Appel à présentations]]-- clôturé.
Pour en savoir plus et s'incrire :
* Lien → ''[[CloudSecurityAlliance.fr/go/jBjE/|https://cloudsecurityalliance.fr/go/jBjE/]]''
!Communiqué de presse "//CSA's Certificate of Cloud Computing Knowledge Plus Labs Are Now Available on Microsoft Azure Cloud Platform //"
[>img(200px,auto)[iCSA/J73CCSK.png]]
<<<
//Expansion gives Microsoft users equal access and functionality on the Azure platform

''SEATTLE and BERLIN – CSA EMEA CONGRESS – Nov. 20, 2019'' – The ''Cloud Security Alliance'' (''CSA''), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced that the hands-on labs available as part of the ''Certificate of Cloud Security Knowledge'' ([[CCSK]]) ''Plus'' coursework are now available on the ''Microsoft Azure'' cloud platform. Previously available only on ''Amazon Web Services'' (''AWS''), now Microsoft users will have equal access and functionality on the Azure platform, expanding the number of users who can now benefit from ''CCSK'' training and demonstrate their technical knowledge, skills, and abilities to use controls tailored to the cloud effectively.

"We're extremely excited to be able to expand the availability of our ''CCSK Plus'' training to ''Microsoft Azure'' cloud platform users looking to establish a baseline of security best practices when dealing with a broad array of responsibilities, from cloud governance to configuring technical security controls" said Ryan Bergsma, Training Program Director, ''CSA''.

The lecture-only ''CCSK Foundation'' course begins with the fundamentals, then increases in complexity as it works through all 16 domains of the ''CSA Security Guidance'', recommendations from the ''European Union Agency for Network & Information Security'' (''ENISA''), and an overview of the ''Cloud Controls Matrix'' (''CCM'').

The ''CCSK Plus'' includes expanded material and offers extensive hands-on activities that reinforce classroom instruction. During the lab sessions, students engage in a scenario of bringing a fictional organization securely into the cloud, allowing them to apply their knowledge by performing a series of activities that would be required in a real-world ''Microsoft Azure'' cloud platform or ''AWS'' environments.

Regardless of whether a student opts to prepare with the ''CCSK Foundation'' or the 'CCSK Plus'' course, the vendor-neutral ''CCSK'' tests for a broad foundation of cloud security knowledge, covering such topics as architecture, governance, compliance, operations, encryption, and virtualization. Those interested in taking the exam can also choose to take advantage of a variety of ''CCSK'' training programs, including free self-study prep courses, in-person training sessions, and instructor-led online classes. To date, thousands of IT and security professionals have upgraded their skillsets and careers by obtaining the ''CCSK''.The exam is also covered under the U.S. Dept. of Veterans Affairs GI Bill®.

Among the benefits of earning the ''CCSK'' are:
* Proven competency in key cloud security issues through an organization that specializes in cloud research
* Increased employment opportunities by filling the skills-gap for cloud-certified professionals
* Demonstrated technical knowledge, skills, and abilities to use controls tailored to the cloud effectively
* Ability to establish a baseline of security best practices when dealing with a broad array of responsibilities, from cloud governance to configuring technical security controls
Serves as a complement to other credentials//
<<<
&rArr; Lire le [[communiqué de presse|https://CloudSecurityAlliance.fr/go/jbka/]] sur le site de la CSA.
Dans le cadre du Congrès Européen du CSA, 4 nouveaux documents ont été publiés ou mis à jour :
* "''Beyond the General Data Protection Regulation (GDPR)''"
<<<
//Data residency insights from around the world. This study reveals the top data protection concerns and strategies of more than 800 senior business professionals from eight countries and a range of industries. Beyond the European Union's General Data Protection Regulation (GDPR) and other regulatory developments, enterprises think data privacy can create competitive advantage. What drives their decisions and investments in data management? Do they place their faith in cloud providers? Are they prepared to meet regulatory mandates and exceed customer expectations?//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/beyond-the-general-data-protection-regulation-gdpr/
* "''Code of Conduct (CoC): Statement of Adherence 3rd Party Certification''"
<<<
//CSA PLA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU's GDPR. The CSA PLA Code of Conduct for GDPR Compliance is designed to be an appendix to a Cloud Services Agreement to describe the level of privacy protection that a Cloud Service Provider will provide.//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/code-of-conduct-coc-statement-of-adherence-3rd-party-certification/
* "''PLA Code of Conduct (CoC): Statement of Adherence Self-Assessment''"
<<<
//CSA PLA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU's GDPR. The CSA PLA Code of Conduct for GDPR Compliance is designed to be an appendix to a Cloud Services Agreement to describe the level of privacy protection that a Cloud Service Provider will provide.//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/pla-code-of-conduct-coc-statement-of-adherence-self-assessment/
* "''Guidance for submitting the CSA Code of Conduct (CoC) for GDPR Compliance Self-Assessment''"
<<<
//The CSA CoC for GDPR Compliance Self-Assessment is the voluntary publication of a CSP's self-assessment results based on the requirements specified in the PLA Code of Practice (CoP).//
<<<
** ⇒ https://cloudsecurityalliance.org/artifacts/guidance-for-submitting-the-csa-code-of-conduct-coc-for-gdpr-compliance-self-assessment/
!"//Colorado Chapter Forum 2019 Presentations//"
[>img(auto,150px)[iCSA/JB7-USCO.jpg]][>img(auto,150px)[iCSA/IB8-USCO.jpg]]Le ''Forum CSA du chapitre du Colorado'' s'est tenu à Denver le 7 novembre 2019.

Les 7 présentations sont maintenant disponibles en téléchargement :
* "''Change is Simply an Act of Survival''" par Bil Harmer	
* "''Data Protection Controls for the Cloud''" par Toby Zimmerer	
* "''Identity Round Robin Workshop Serverless''" par AWS Security	
* "''Taking Compliance to the Cloud''" par Tim Weil
* "''Attackers Battle for Hijacked Resources''" par James Condon
* "''Are Your Cloud Servers Under Attack''" par Brian Hileman
* "''Shared Responsibility Model in the Age of Cloud''" par Janelle Hsia

Les présentations peuvent être téléchargées individuellement ou en une seule fois.
Lien de téléchargement du paquet complet &rArr; ''[[CloudSecurityAlliance.fr/go/jbip/|https://CloudSecurityAlliance.fr/go/jbip/]]
!1 - Les nouveautés CSA de la semaine du 11 au 17 novembre 2019
* Publication : Nouvelle version 3.1 de la ''CAIQ'' +++*[»]> <<tiddler [[2019.11.15 - Publication : CAIQ version 3.1]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : Évolution des Technologies et Simplification +++*[»]> <<tiddler [[2019.11.15 - Blog : Evolution des Technologies et Simplification]]>>=== 
* Blog : Les principales erreurs de configuration à éviter+++*[»]> <<tiddler [[2019.11.14 - Blog : 4 erreurs de configuration]]>>=== 
* Actu : Nouvelle ''demande de validation de la traduction en français de 3 documents CSA'' (CCM, CAIQ et PLA CoC) +++*[»]> <<tiddler [[2019.11.13 - Actu : Demande de validation de la traduction en français de 3 documents CSA]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.10 - Veille Hebdomadaire]]>>=== avec plus de 60 liens
* Rapports : Barracuda Networks, Blackblaze, Centrify, Firemon, ThousandEyes+++*[»]>
|2019.11.13|//ThousandEyes//|[[ThousandEyes Annual Research Report Reveals Notable Performance Variations Between AWS, GCP, Azure, Alibaba and IBM Cloud|https://vmblog.com/archive/2019/11/13/thousandeyes-annual-research-report-reveals-notable-performance-variations-between-aws-gcp-azure-alibaba-and-ibm-cloud.aspx]] ([[rapport|https://www.thousandeyes.com/resources/cloud-performance-benchmark-report-november-2019]])|Report|
=== 
* Conférence : future présentation sur les vulnérabilités liées aux APIs à la BlackHat Europe
* Pannes et attaques : nouveaux prestataires Cloud attaqués par des ransomawares
* Divers : retour sur la vulnérabilité "baseStricker" sur O365, Chaos Engineering pour Kubernetes, Phishing O365, traitement d'incidents
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** ''Deuxième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.01 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (2/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
!4 - Contacts
<<tiddler .ReplaceTiddlerTitle with: [[Newsletter Hebdomadaire - 17 Novembre 2019]]>>
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.17|
|2019.11.17|//Tripwire//|[[MITRE ATT&CK October Update: Extending to the Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/mitre-attck-extending-cloud/]]|MITRE|
|2019.11.17|//Tripwire//|[[How to Implement an Efficient Cloud Security Strategy: The Experts Guide|https://www.tripwire.com/state-of-security/security-data-protection/cloud/efficient-cloud-security-strategy-experts-guide/]]|Strategy|
|>|>|>|!2019.11.16|
|2019.11.16|Ars Technica|[[Breach affecting 1 million was caught only after hacker maxed out target's storage|https://arstechnica.com/information-technology/2019/11/breach-affecting-1-million-was-caught-only-after-hacker-maxed-out-targets-storage/]]|DataBreach InfoTrax|
|>|>|>|!2019.11.15|
|2019.11.15|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud du Pentagone : face à Microsoft, Amazon contre-attaque pour JEDI|https://www.silicon.fr/cloud-pentagone-microsoft-amazon-contre-attaque-jedi-326209.html]]|Government JEDI|
|2019.11.15|Informatique News[>img[iCSF/flag_fr.png]]| → [[Amazon conteste le choix d'Azure sur le contrat JEDI|https://www.informatiquenews.fr/amazon-conteste-le-choix-de-microsoft-sur-le-contrat-jedi-64729]]|Government JEDI|
|2019.11.15|Breaking Defense| → [[Amazon's Big JEDI Gamble ANALYSIS|https://breakingdefense.com/2019/11/amazons-big-jedi-gamble-analysis/]]|Government JEDI|
|2019.11.15|Container Journal|![[5 Ways to Chaos Test Kubernetes|https://containerjournal.com/topics/container-security/5-ways-to-chaos-test-kubernetes/]]|Kubernetes Chaos_Engineering|
|2019.11.15|//Vanson Bourne//|[[Cloud services backup: survey finds major gap between perceptions and realities|https://www.continuitycentral.com/index.php/news/technology/4627-cloud-services-backup-survey-finds-major-gap-between-perceptions-and-cloud-realities]] ([[rapport .pdf|https://www.4sl.com/wp-content/uploads/2019/11/research-report-nov-2019.pdf]])|Backups|
|2019.11.15|Bleeping Computer|[[New NextCry Ransomware Encrypts Data on NextCloud Linux Servers|https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encrypts-data-on-nextcloud-linux-servers/]]|NextCloud Ransomware|
|2019.11.15|Nino Crudele|![[The three most effective and dangerous cyberattacks to Azure and countermeasures (part 2 – attack the Azure Storage Service)|https://ninocrudele.com/the-three-most-effective-and-dangerous-cyberattacks-to-azure-and-countermeasures-part-2-attack-the-azure-storage-service]] (2/3)|Azure Attacks CounterMeasurement||
|2019.11.15|Nino Crudele|![[The three most effective and dangerous cyberattacks to Azure and countermeasures (part 1 – attack all the public and private IP addresses in Azure)|https://ninocrudele.com/the-three-most-effective-and-dangerous-cyberattacks-to-azure-and-countermeasures-part-1-attack-all-the-public-and-private-ip-addresses-in-azure]] (1/3)|Azure Attacks CounterMeasurement||
|>|>|>|!2019.11.14|
|2019.11.14|Journal du Net[>img[iCSF/flag_fr.png]]|[[Prêt pour le cloud souverain 2.0 ?|https://www.journaldunet.com/solutions/expert/72072/pret-pour-le-cloud-souverain-2-0.shtml]]|Sovereign_Cloud|
|2019.11.14|Wall Street Journal|[[Amazon to Protest Pentagon Contract Award to Microsoft|https://www.wsj.com/articles/amazon-to-protest-pentagon-contract-award-to-microsoft-11573769321]]|Government JEDI|
|2019.11.14|Silicon Angle| → [[Amazon protests Pentagon's cloud contract award, citing 'unmistakable bias'|https://siliconangle.com/2019/11/14/amazon-protests-pentagons-cloud-computing-contract-award-citing-unmistakable-bias/]]|Government JEDI|
|2019.11.14|CBR Online|[[Codeanywhere Blames GCP Outage for Vanished Work|https://www.cbronline.com/news/codeanywhere-gcp-projects-missing]]|GCP Outage|
|2019.11.14|Medium|[[AWS Cyber Range — The Ultimate Cyber Lab Overview|https://medium.com/aws-cyber-range/aws-cyber-range-the-ultimate-cyber-lab-overview-3affcca1c842]]|Exercise Tools|
|2019.11.14|//Microsoft//|![[Changing security incident response by utilizing the power of the cloud-DART tools, techniques, and procedures: part 1|https://www.microsoft.com/security/blog/2019/11/14/security-incident-response-utilizing-cloud-dart-tools-techniques-procedures-part-1/]] (1/3)|Incident_Response|
|2019.11.14|//PhishLabs//|[[Active Office 365 Credential Theft Phishing Campaign Targeting Admin Credentials|https://info.phishlabs.com/blog/active-office-365-phishing-campaign-targeting-admin-credentials]]|O365 Phishing|
|2019.11.16|Bleeping Computer| → [[Microsoft Office 365 Admins Targeted by Ongoing Phishing Campaign|https://www.bleepingcomputer.com/news/security/microsoft-office-365-admins-targeted-by-ongoing-phishing-campaign/]]|O365 Phishing|
|2019.11.14|//Tripwire//|[[Aligning SECaaS with Your Organization's Cloud Security Needs|https://www.tripwire.com/state-of-security/security-data-protection/cloud/aligning-secaas-organizations-cloud-security-needs/]]|SECaaS|
|2019.11.14|//Microsoft//|[[Azure Container Registry: Preview of diagnostic and audit logs|https://azure.microsoft.com/en-us/blog/azure-container-registry-preview-of-diagnostics-and-audit-logs/]]|Azure Containers Tools|
|2019.11.14|//LogRythm//|[[Examining the baseStriker Vulnerability|https://logrhythm.com/blog/examining-the-basestriker-vulnerability/]]|O365 Vulnerability baseStricker|
|2019.11.14|//Compare The Cloud//|[[Cloud and Web Application Security: Growing Confidence and Emerging Gaps|https://www.comparethecloud.net/articles/cloud-and-web-application-security-growing-confidence-and-emerging-gaps/]]|Confidence|
|2019.11.14|//Cyware//|![[Many public cloud infrastructures suffer from serious security loophole, researchers say|https://cyware.com/news/many-public-cloud-infrastructures-suffer-from-serious-security-loophole-researchers-say-4c79a693]]|Vulnerability|
|2019.11.14|//AlienVault//|[[Cybersecurity: top of mind Q and A|https://www.alienvault.com/blogs/security-essentials/cybersecurity-questions-and-answers]]|Misc|
|2019.11.14|//Sysdig//|[[Securing Google Cloud Run serverless workloads|https://sysdig.com/blog/securing-google-cloud-run/]]|GCP|
|2019.11.14|//Sensu//|[[Kubernetes 101|https://blog.sensu.io/kubernetes-101]]|Kubernetes|
|2019.11.14|//Syxsense//|[[Worried about Cloud Security? Why On-Premise is More Dangerous|https://www.syxsense.com/why-on-premise-is-more-dangerous]]|Risks|
|2019.11.14|//Barracuda Networks//|[[Growing confidence and emerging gaps in cloud security|https://blog.barracuda.com/2019/11/14/growing-confidence-emerging-gaps-cloud-security/]]|Survey|
|>|>|>|!2019.11.13|
|2019.11.13|Economie Numérique[>img[iCSF/flag_fr.png]]|[[Cloud souverain français : vers un protectionnisme de la donnée ?|http://blog.economie-numerique.net/2019/11/13/cloud-souverain-francais-vers-un-protectionnisme-de-la-donnee/]]|Sovereign_Cloud|
|2019.11.13|ComputerWeekly|[[Taking responsibility for security in the cloud|https://www.computerweekly.com/feature/Taking-responsibility-for-security-in-the-cloud]]|Responsibility|
|2019.11.13|GBHackers on Security|[[Telegram MTProxy Used to Launch DDoS Attack Against Cloud Service Provider Arvan – Peaks Up to 5,000 Requests Per Second|https://gbhackers.com/telegram-mtproxy/]]|DDoS|
|2019.11.13|Breaking Defense|[[Can DoD Get Speed & Security With The Cloud?|https://breakingdefense.com/2019/11/can-dod-get-speed-security-with-the-cloud/]]|DevSecOps|
|2019.11.13|Silicon Angle|[[Google launches new service for monitoring multicloud networks|https://siliconangle.com/2019/11/13/google-launches-new-service-monitoring-multicloud-networks/]]|GCP|
|2019.11.13|//Avanan//|[[What Is a Cloud Access Security Broker (CASB)?|https://www.avanan.com/blog/what-is-a-casb]]|CASB|
|2019.11.13|//AlertLogic//|[[Managing Cybersecurity During Cloud Migration|https://blog.alertlogic.com/managing-cybersecurity-during-cloud-migration/]]|Migration|
|2019.11.13|//Nutanix//[>img[iCSF/flag_fr.png]]|[[Enterprise Cloud Index : 73 % des entreprises rapatrient leurs applications du cloud public vers le cloud privé|http://www.globalsecuritymag.fr/Enterprise-Cloud-Index-73-des,20191114,92735.html]]|Report|
|2019.11.13|//ThousandEyes//|[[ThousandEyes Annual Research Report Reveals Notable Performance Variations Between AWS, GCP, Azure, Alibaba and IBM Cloud|https://vmblog.com/archive/2019/11/13/thousandeyes-annual-research-report-reveals-notable-performance-variations-between-aws-gcp-azure-alibaba-and-ibm-cloud.aspx]] ([[rapport|https://www.thousandeyes.com/resources/cloud-performance-benchmark-report-november-2019]])|Report|
|2019.11.13|//ThousandEyes//|[[Top Takeaways from the Cloud Performance Benchmark|https://blog.thousandeyes.com/top-takeaways-cloud-performance-benchmark/]]|Performance|
|2019.11.18|CBR Online| → [[The Cloud Providers Ranked by Network Performance|https://www.cbronline.com/news/fastest-cloud-thousandeyes]]|Performance|
|2019.11.13|//Microsoft//|[[The refreshed Azure AD Identity Protection is now generally available|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/The-refreshed-Azure-AD-Identity-Protection-is-now-generally/ba-p/1002916]]|AzureAD|
|2019.11.13|//Microsoft//|[[Azure Container Registry: preview of repository-scoped permissions|https://azure.microsoft.com/en-us/blog/azure-container-registry-preview-of-repository-scoped-permissions/]]|Azure Container Registry|
|2019.11.13|//Akamai//|[[Security at the Edge - What is Gartner's SASE & why does it matter?|https://blogs.akamai.com/2019/11/security-at-the-edge-what-is-gartners-sase-why-does-it-matter.html]]|SASE|
|2019.11.13|DevOps|[[Five Microservices Worst Practices|https://devops.com/five-microservices-worst-practices/]]|Microservices Best_Practices|
|>|>|>|!2019.11.12|
|2019.11.12|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Les développeurs, insoupçonnés maillons faibles de la sécurité des clouds|https://www.lemondeinformatique.fr/actualites/lire-les-developpeurs-insoupconnes-maillons-faibles-de-la-securite-des-clouds-77046.html]]|SecDevOpsDev|
|2019.11.12|Information Security Forum|[[ISF Announces Release of Securing the IoT: Taming the Connected World|https://vmblog.com/archive/2019/11/12/isf-announces-release-of-securing-the-iot-taming-the-connected-world.aspx]]|IoT|
|2019.11.12|//Blackblaze//|[[Backblaze Hard Drive Stats Q3 2019|https://www.backblaze.com/blog/backblaze-hard-drive-stats-q3-2019/]]|Reliability|
|2019.11.12|//Uptycs//|![[Conducting A Vulnerability Assessment: A Step-By-Step Guide For Linux Workloads In The Cloud|https://www.uptycs.com/blog/how-to-conduct-a-vulnerability-assessment]]|Vulnerability_Assessment|
|2019.11.12|//PaloAlto Networks//|[[Is CASB Alone Enough? Long Live SASE|https://blog.paloaltonetworks.com/2019/11/cloud-casb-sase/]]|SASE|
|2019.11.12|//Trustwave//|[[3 Multi-Cloud Environment Challenges to Overcome|https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/3-multi-cloud-environment-challenges-to-overcome/]]|Multi_Cloud|
|2019.11.12|//Lob//|[[Detecting Manual AWS Console Actions|https://arkadiyt.com/2019/11/12/detecting-manual-aws-console-actions/]]|AWS_Console|
|2019.11.12|//Sysdig//|[[Incident response in Kubernetes with Sysdig's Activity Audit|https://sysdig.com/blog/cloud-native-incident-response/]]|Kubernetes Incident_Response|
|2019.11.12|//Centrify//[>img[iCSF/flag_fr.png]]|[[Comment sécuriser l'accès aux opérations de cloud : 5 conseils|https://www.undernews.fr/reseau-securite/comment-securiser-lacces-aux-operations-de-cloud-5-conseils.html]]|Zero_Trust|
|2019.11.12|//Cyberark//|[[New Open Source Offerings Simplify Securing Kubernetes|https://www.cyberark.com/blog/new-open-source-offerings-simplify-securing-kubernetes/]]|Kubernetes Tools|
|2019.11.12|//Firemon//|[[State of the Firewall Report 2019: Zero-Touch Automation is More Headline than Reality, Network Complexity and Lack of Visibility Are Key Issues|https://www.firemon.com/state-of-the-firewall-report-2019/]] ([[rapport|https://www.firemon.com/2019-state-of-the-firewall-report/]])|Report|
|2019.11.12|//Fugue//|[[Cloud Network Security 101: AWS VPC Endpoints|https://www.fugue.co/blog/network-security-vpc-endpoints-101]]|VPC|
|2019.11.12|//3DS Outscale//[>img[iCSF/flag_fr.png]]|[[Failles Intel : des impacts à redouter chez 3DS OUTSCALE ?|https://blog.outscale.com/fr/failles-intel-des-impacts-a-redouter-chez-3ds-outscale]]|Vulnerabilities|
|>|>|>|!2019.11.11|
|2019.11.11|HelpNet Security|![[Speeding MTTR when a third-party cloud service is attacked|Outage Best_Practices|
|2019.11.11|//XM Cyber//|![[Researchers Find New Approach in Attacking Cloud Infrastructure|https://xmcyber.com/researchers-find-new-approach-in-attacking-cloud-infrastructure/]]|APIs|
|2019.11.11|BlackHat Europe| → [[Inside Out - The Cloud Has Never Been So Close|https://www.blackhat.com/eu-19/briefings/schedule/index.html#inside-out---the-cloud-has-never-been-so-close-17797]]|APIs|
|2019.11.11|Dark Reading| → [[Researchers Find New Approach to Attacking Cloud Infrastructure|https://www.darkreading.com/cloud/researchers-find-new-approach-to-attacking-cloud-infrastructure/d/d-id/1336327]]|APIs|
|2019.11.11|//Heimdal//|[[Ransomware as a Service (RaaS) – A Contemporary Mal du siècle?|https://heimdalsecurity.com/blog/ransomware-as-a-service/]]|Ransomware|
|2019.11.11|//Smarter ASP//|[[Your hosting accounts are under attack|http://status.smarterasp.net/post/your-hosting-accounts-are-under-attack]]|Attack Ransomware|
|2019.11.11|ZDnet|[[Major ASP.NET hosting provider infected by ransomware|https://www.zdnet.com/article/major-asp-net-hosting-provider-infected-by-ransomware/]]|Attack Ransomware|
|2019.11.12|//MSSP Alert//| → [[Ransomware Attack Hits Web Hosting Provider SmarterASP|https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/smarterasp-hit/]]|Attack Ransomware|
|2019.11.11|//Centrify//|[[New Report from Centrify Reveals That the Majority of Organizations Still Misunderstand the Shared Responsibility Model for Cloud Security|https://www.centrify.com/about-us/news/press-releases/2019/reducing-risk-cloud-migration-report/]]|Report|
|2019.11.13|HelpNet Security| → [[The leading challenge facing cloud migration projects is security|https://www.helpnetsecurity.com/2019/11/13/cloud-migration-projects/]]|Report|
|2019.11.11|//Zyxel//|[[The Role Of SaaS In Network Security|https://www.informationsecuritybuzz.com/articles/the-role-of-saas-in-network-security/]]|Network_Security|
|2019.11.11|//Edgewise Networks//|[[Thwarting Graboid and Protecting Containers with Zero Trust|https://www.cisomag.com/thwarting-graboid-and-protecting-containers-with-zero-trust/]]|Containers Zero_Trust|
|2019.11.11|//JumpCloud//|[[Why Use a Directory Service?|https://jumpcloud.com/blog/build-directory-service/]]|Directory|
|2019.11.11|//JumpCloud//|[[RADIUS Server In Azure|https://jumpcloud.com/blog/radius-server-azure/]]|Azure RADIUS|
!"//Consensus Assessment Initiative Questionnaire (CAIQ) v3.1//"
[>img(150px,auto)[iCSA/CAIQ31.png]]Publication de la nouvelle version ''CAIQ 3.1''
<<<
//Cloud Security Alliance (CSA) would like to present the next version of the Consensus Assessments Initiative Questionnaire (CAIQ) v3.1.
The CAIQ offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services, providing security control transparency.
It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM).
Therefore, it helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.
CAIQ v3.1 represents a minor update to the previous CAIQ v3.0.1.
In addition to improving the clarity and accuracy, it also supports better auditability of the CCM controls.
The new updated version aims to not only correct errors but also appropriately align and improve the semantics of unclear questions for corresponding CCM v3.0.1 controls.
In total, 49 new questions were added, and 25 existing ones were revised.
For this new CAIQ version, CSA took into account the combined comprehensive feedback that was collected over the years from its partners, the industry and the CCM working group.//
[...]
<<<
&rArr; [[Détail|https://CloudSecurityAlliance.fr/go/jbfp/]] sur le site de la CSA.
&rArr; Fichier [[XLSX|https://CloudSecurityAlliance.fr/go/jbfx/]] sur le site de la CSA.
!"//Keeping Up With Changing Technology by Reducing Complexity//"
[>img(150px,auto)[iCSA/JBFBK.jpg]]Article de blog publié le 14 novembre 2019 — Rédigé par John DiMaria, CSA Research Fellow, Assurance Investigatory Fellow, Cloud Security Alliance
<<<
//+++*[Fox News reported]> https://www.foxbusiness.com/industrials/boeing-should-reconsider-pilots-response-time-ntsb === that in answer to the previous Boeing 737 accidents, the Federal safety officials say, "Boeing should consider how cockpit confusion can slow the response of pilots who are dealing with the kind of problem that likely caused two airliners to crash in the past year."
"They suggest that Boeing underestimated the time it takes for pilots to diagnose and react when they are being bombarded by multiple, cascading warning alerts."
Think about it; they were bombarded by multiple, cascading warning alerts that taxed their ability to respond in a timely fashion. There were two issues there:
# Too much complexity was built into the system
# They underestimated the time it takes to diagnose and react.
''The more complex systems become, the less secure they become, even though security technologies improve.''
While there's nothing wrong with improving technology, we always need to consider the human element since leveraging multiple systems can create a fragmented environment. Underlying the current security failings is a critical, under appreciated problem -- fragmentation.

''Root Cause of Cost Increase & Poor Data Governance''
Fragmentation is at the heart of the ineffectiveness of our efforts to continue to improve. Fragmentation happens when we focus on individual parts without adequately appreciating their relation to the evolving whole. This unbalance is one of the root causes of the more obvious security issues of continued cost increases, poor data governance, and inadequate planning. Not addressing this problem is essential because fragmentation leads to well-intentioned actions that sometimes have unintended consequences that often make things worse.
''Unintended consequences of fragmentation:''
* Inefficiency
** Narrowly focused programs and services is an excellent strategy for reducing the security budget, but it is not a strategy for efficiently implementing an effective holistic information/cybersecurity system. Efficient strategic planning should analyze and prioritize based on a holistic analysis of risk. This analysis should include all applicable elements of people, process and technology. It should hone in on the critical scope and then implement the applicable controls that are justified based on that risk assessment.
* Ineffectiveness
** It is no fluke that technologically has advanced, yet security breaches continue to grow exponentially. Risk Based Securities mid-year report noted that 2019 is on track to be the "worst year on record" for breach activity. Spending more on the parts has not improved the whole. Today many of the efforts toward improving security are directed at narrow programs with insufficient attention to the larger scope they are trying to affect. Many times scope is the problem because the scope is not "fit for purpose." The lack of an integrative way of addressing security and implementing proper controls only addresses the short-term problems and may keep costs down (for the time being) but ignores the greater objective of addressing the total system within the context of the organization.
* Commoditization
** I was on a website of an organization that was claiming "X Security Controls will stop 85% of Cyber Attacks". Not "address," not "help mitigate" but STOP! Seriously? Further, if you implement X more of the controls, you'll prevent 97% of attacks.
** Treating security as a commodity can unintentionally deemphasize the seriousness and real scope of the issue. Especially when addressing cloud security, that can be a perilous road to go down. The cloud is a dynamic environment where things are always changing, especially security threats. You have to first understand what needs to be protected and from what. Risk assessment is a real-time living process and the controls change as the environment changes. Cybersecurity is not a science; at least not yet.
** Some advertised solutions focus on delivering their well-intentioned services without consideration of their effect on the whole system or the reality that scope and specific SLA's that change the way you approach cybersecurity strategy. They also ignore how many and what controls need to be put in place. The true urgency of cybersecurity is reduced when it is treated as a commodity. Conversely, other solutions take the approach that the more complexity, the better.

''How can we start being a part of the solution?''
The CSA Cloud Control Matrix ([[CCM]]), The Consensus Assessments Initiative Questionnaire ([[CAIQ]]) and the CSA [[STAR]] Program come together as an integrated approach that helps companies understand the fundamental problem of fragmentation and how to reduce it. And the first step towards reducing fragmentation, is simply reducing complexity. Viewing security as an evolving integrated system instead of only as fragmented parts or small insignificant scopes that are not fit for purpose, can help our industry to feel hope where now there is skepticism. ''Transparency, trust and information sharing instead of detachment and isolation. Professional and corporate shared responsibility instead of narrow self-interest''.

''Here is my challenge...''
* Listen to my +++*[Podcast interview with Doctor Ron Ross; Senior Fellow at NIST]> https://www.buzzsprout.com/303731/1298485-the-growing-complexity-around-cybersecurity-and-evolving-technology-guest-dr-ron-ross-nist === "The growing complexity around cybersecurity and evolving technology."
* Take a deep dive into the [[STAR]] Program and the [[STAR]] Registry and then take a self-assessment using the CAIQ.
//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jbfb/]] sur le blog de la CSA.
!"//4 Common Cloud Misconfigurations & What To Do About Them//"
[>img(150px,auto)[iCSA/JBEBF.jpg]]Article de blog publié le 14 novembre 2019 — Rédigé par Kevin Tatum, IT Security Engineer chez ExtraHop
<<<
//In a +++*[recent report]> https://cloudsecurity.mcafee.com/cloud/en-us/forms/white-papers/wp-cloud-adoption-risk-report-iaas.html ===, McAfee uncovered the rise of Cloud-Native Breaches and the state of multi-cloud adoption. We'll define the top 4 cloud misconfiguration goofs from their list, how they can affect your organization, and what to do about them.
When it comes to personal data, the mid-2010s were a bit of a reckoning. Your credit card information, health records, and even your love life became subject to breaches. Today, nearly everyone can relate to the hassle of switching out a debit or credit card, and these issues persist-especially as enterprises move their IaaS (Infrastructure as a Service) to the cloud.
In recent years, nearly 70 percent of exposed records - 5.4 billion total - were caused by unintentional internet exposure due to misconfigured services and portals - services like Amazon Simple Storage Service, known as S3. (+++*[Luckily, S3 misconfiguration is a very avoidable issue]> https://www.extrahop.com/company/blog/2018/get-safe-smart-secure-on-aws-s3/ ===.)
As McAfee found, most of these misconfigurations go unreported and, in many cases, unnoticed.
If only 1% of IaaS issues are reported, that means a whole slew of companies inadvertently leak data or fail to report for fear of bad PR. Worse, one-quarter of the McAfee survey respondents said it takes longer than 24 hours to correct misconfigurations.
In summary, McAfee highlights significant visibility, reporting, and misconfiguration errors that are preventable. Here are the top offenders in the McAfee list and the ways they can affect your organization, followed by a remedy for these common problems.

__''4 Common Security Group Setting Misconfigurations''__

__1 -- Unrestricted Outbound Access__
Outbound traffic should always use the principle of minimalist authority. Many AWS users only configure inbound ports in security groups, but outbound ports can also be a huge security risk. Limiting outbound traffic helps direct traffic to only the applications and servers that need to communicate. This helps reduce the risk and impact of internal network scans, lateral movement, and data exfiltration.
Your servers may only need SSH or RDP inbound ports to manage them. It's rare for one of those application servers to SSH to all of the other servers in the network. Many common hacker tactics use random ports for Command and Control actions, reverse shells, or to spread malware.

__2 -- Unrestricted Access to Non-HTTP/HTTPS Ports__
Web servers are designed to host websites and web services to the internet, and they can also host other services like SSH or RDP for management or databases. But it's important to block these from the whole internet. If these ports remain improperly configured, it can open you up to attackers looking to exploit or brute force the authentication. If you open up these ports to the internet, make sure they're limited to accept traffic from particular addresses such as your office.

__3 -- Unrestricted Inbound Access on Uncommon Ports__
Some services use a high numbered TCP or UDP port to obfuscate what is running in the environment, but security through obscurity never really works. It doesn't protect you from a determined hacker or even a random internet scan. Some services also open uncommon ports without really letting you know.
Does your web server have a statistics page? Do you have PHPMyAdmin running on port 8443? Are you leaking Apache Tomcat services on port 8080? You must restrict high-level ports to only the necessary systems, and usually, that is not the internet. PHPMyAdmin on the internet makes us shudder.

__4 -- Unrestricted ICMP Access__
ICMP is a useful protocol, but leaving it open to the internet can leave you vulnerable to more straightforward, older attacks. One of the most common uses of ICMP is to use ICMP Echo to verify that your servers are online and responsive.
ICMP Echo is an excellent diagnostic tool for IT professionals. Unfortunately, it's also a great tool for hackers. A quick ping scan of the internet using Nmap or Fping can let attackers know that you have a server online, which becomes ripe for a focused attack. There are several more complicated ways to find a server on the internet, so why do a bad actor's job for them?
Attackers can use ICMP for much more than finding servers, however. As an example, a ping flood overwhelms a server with too many ICMP messages. Though simple, a ping flood is an effective type of Denial of Service attack, which becomes even more effective when multiple attackers or botnets are involved to create a Distributed Denial of Service (DDoS).
The ping sweep and ping flood may be ancient methods, but they're still put to use because they work. Do yourself a favor and block ICMP.

__''How Network Detection and Response (NDR) Can Help''__

Most cloud environments have dozens, if not hundreds, of these security risks. And really, each server needs its own set of rules.
While the ability to quickly build servers and services in the cloud has its advantages, it also comes with some of the most significant security risks. When you use default rules, it's easy to miss one rule on a single server - and if an appropriate rule is overlooked, your whole environment can quickly be compromised.
One reason cloud security has lagged so far behind traditional security is that, until very recently, network traffic in the cloud was extremely difficult to capture and parse effectively. Monitoring network communications in real time through network detection and response (NDR) is the quickest and easiest way for security teams to stay on top of complex, dynamic environments, and without NDR in the cloud, SecOps struggled to maintain the same deep visibility and rapid threat detection as is possible on-premises.
With the advent of traffic mirroring in AWS and Azure, that gap has finally begun to close.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jbeb/]] sur le blog de la CSA.
[>img[iCSF/cloud-security-alliance-fr.png]]La [[Cloud Security Alliance]] a lancé la traduction de 3 outils majeurs dans 10 langues : allemand, danois, espagnol, italien, japonais, néerlandais, portugais, roumain, suédois, et ... français.
Il s'agit de feuilles Excel dans lesquelles il vous est demandé d'adapter les traductions ou de les commenter.
Pour chaque document, les 10 traductions sont dans un répertoire //Google Drive// dédié, et pour travailler sur la version française, il faut sélectionner le document commençant par "''FR-''"

Les 3 documents sont les suivants :
* "''Cloud Controls Matrix''" (CCM) : document "FR-CSA_CCM_v.3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99c/|https://cloudsecurityalliance.fr/go/j99c/]]''
* "''Consensus Assessments Initiative Questionnaire''" (CAIQ) : document "FR-CAIQ_v3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99q/|https://cloudsecurityalliance.fr/go/j99q/]]''
* "''Code of Conduct''" du "''Privacy Level Agreement''" (PLA CoC) : document "FR-CoC_GDPR_Annex_1_Compliance_Assessment_Template.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99p/|https://cloudsecurityalliance.fr/go/j99p/]]''

La date limite initiale était fixée en octobre 2019, mais est maintenant repoussée au ''1^^er^^ décembre 2019''.
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 4 au 10 novembre 2019
* Publication : Présentations du ''CSA Summit'' au congrès (ISC)² +++*[»]> <<tiddler [[2019.11.04 - Publication : Présentations du CSA Summit au congrès (ISC)²]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Blog : ''CMMC'', un nouveau protocole pour la conformité DoD +++*[»]> <<tiddler [[2019.11.06 - Blog : CMMC, un nouveau protocole pour la conformité DoD]]>>=== 
* Blog : Google et la ''Suprématie Quantique'' +++*[»]> <<tiddler [[2019.11.06 - Blog : Google et la Suprématie Quantique]]>>=== 
* Actu : Contribution CSA à deux documents de ''l'EU-SEC sur la certification'' +++*[»]> <<tiddler [[2019.11.07 - Actu : Contribution CSA à deux documents de l'EU-SEC sur la certification]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.10 - Veille Hebdomadaire]]>>=== avec plus de 50 liens
* Rapports : Gurucul, Rancher Labs, Rick's Cloud, Sophos
* Conférences : présentations au BSidesCT 2019, annonces Microsoft à Ignite 2019
* Divers : sécurité des containers, retour sur le SASE du Gartner
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** ''Deuxième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.01 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (2/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
!4 - Contacts
<<tiddler .ReplaceTiddlerTitle with: [[Newsletter Hebdomadaire - 10 Novembre 2019]]>>
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.10|
|2019.11.10|BSidesCT 2019|[[Rethinking Privileged Access Management for Agile Clouds & Data Center Environments|http://www.irongeek.com/i.php?page=videos/bsidesct2019/2-01-rethinking-privileged-access-management-for-agile-clouds-data-center-environments-brian-gladstein]] ([[vidéo|http://www.youtube.com/watch?v=EMKDvB7zpf0]])|Conference Access_Management|
|2019.11.10|BSidesCT 2019|[[Event Injections: Sending Evil to the Cloud|http://www.irongeek.com/i.php?page=videos/bsidesct2019/1-02-event-injections-sending-evil-to-the-cloud-tal-melamed]] ([[vidéo|http://www.youtube.com/watch?v=NJOuXeFtgBU]])|Conference Attacks|
|2019.11.10|BSidesCT 2019|[[Building Castles in the Cloud: AWS Security and Self-Assessment|http://www.irongeek.com/i.php?page=videos/bsidesct2019/2-05-building-castles-in-the-cloud-aws-security-and-self-assessment-rami-mccarthy]] ([[vidéo|http://www.youtube.com/watch?v=W2I-b_b_-6M]])|Conference AWS|
|2019.11.10|Silicon Angle|![[As cloud security improves, a weak link emerges: people |https://siliconangle.com/2019/11/10/cloud-security-improves-weak-link-emerges-people/]]|Risks|
|>|>|>|!2019.11.08|
|2019.11.08|SANS|[[JumpStart Guide to Investigations and Cloud Security Posture Management in AWS|https://www.sans.org/reading-room/whitepapers/analyst/jumpstart-guide-investigations-cloud-security-posture-management-aws-39250]]|Investigation CSPM|
|2019.11.08|//TresorIT//|[[Should You Trust Your Cloud Storage Provider?|https://www.infosecurity-magazine.com/blogs/should-trust-cloud-storage-provider/]]|Storage|
|2019.11.08|//Sophos//|[[Exposed: Private Amazon S3 bucket exposure|https://news.sophos.com/en-us/2019/11/08/exposed-private-amazon-s3-bucket-exposure/]]|AWS Data_Leak|
|>|>|>|!2019.11.07|
|2019.11.07|Davis Wright Tremaine|[["CLOUD"s On the Horizon – How Law Enforcement Electronic Data Requests Are Going Global|https://www.dwt.com/blogs/privacy--security-law-blog/2019/11/global-law-enforcement-electronic-data-requests]]|Law_Enforcement|
|2019.11.07|The Hacker News|[[Gartner Says the Future of Network Security Lies with SASE|https://thehackernews.com/2019/11/network-security-sase.html]]|Network SASE|
|2019.11.07|//PaloAlto Networks//|[[Container Security: Vulnerability Management from Build to Run|https://blog.paloaltonetworks.com/2019/11/cloud-container-security/]]|Containers|
|2019.11.07|//Tripwire//|[[Thunder on the Horizon: 4 Security Threats for the Cloud|https://www.tripwire.com/state-of-security/risk-based-security-for-executives/connecting-security-to-the-business/thunder-horizon-4-security-threats-cloud/]]|Threats|
|2019.11.07|//Fugue//|[[Securing Cloud Environments Against Advanced Misconfiguration Risk with Fugue Best Practices|https://www.fugue.co/blog/securing-cloud-environments-against-advanced-misconfiguration-risk-with-fugue-best-practices]]|Best_Practices Framework|
|2019.11.07|//Fugue//| → [[Fugue Releases Best Practices Framework to Protect Against Advanced Cloud Misconfiguration Attacks|https://vmblog.com/archive/2019/11/07/fugue-releases-best-practices-framework-to-protect-against-advanced-cloud-misconfiguration-attacks.aspx]]|Best_Practices Framework|
|2019.11.07|//Reduxio//|[[Cloud Storage: Where Private and Public Diverge|https://vmblog.com/archive/2019/11/07/cloud-storage-where-private-and-public-diverge.aspx]]|Storage|
|2019.11.07|//JumpCloud//|[[How Cloud Services Maximize Cybersecurity|https://jumpcloud.com/blog/best-practices/cybersecurity-cloud-services/]]|Misc|
|2019.11.07|//Cloudflare//[>img[iCSF/flag_fr.png]]|[[Quoi de neuf en Francophonie?|https://blog.cloudflare.com/fr/quoi-de-neuf-en-francophonie/]]|Cloudflare|
|2019.11.07|//DS Outscale//[>img[iCSF/flag_fr.png]]|![[Le C.L.O.U.D. Act : comment échapper au radar américain ?|https://blog.outscale.com/fr/le-cloud-act-comment-echapper-au-radar-americain]]|CLOUD_Act|
|>|>|>|!2019.11.06|
|2019.11.06|Cloud Native Computing Foundation|[[Cloud Native Chaos Engineering – Enhancing Kubernetes Application Resiliency|https://www.cncf.io/blog/2019/11/06/cloud-native-chaos-engineering-enhancing-kubernetes-application-resiliency/]]|Kubernetes Chaos_Engineering Resilience|
|2019.11.06|Computer Weekly|[[Security Think Tank: Adapt security posture to your cloud model|https://www.computerweekly.com/opinion/Security-Think-Tank-Adapt-security-posture-to-your-cloud-model]]|Security_Posture|
|2019.11.06|//Rancher Labs//|[[Rancher Labs Industry Survey Shows Rapid Adoption of Containers and Kubernetes, But Challenges Remain|https://rancher.com/blog/2019/container-industry-survey-results]] ([[infographie|https://info.rancher.com/kubernetes-industry-survey-key-findings]])|Survey Kubernetes|
|2019.11.06|//Rancher Labs//| → [[Rancher Labs Industry Survey Highlights Rapid Adoption of Kubernetes for Production Workloads|https://www.businesswire.com/news/home/20191106005114/en/Rancher-Labs-Industry-Survey-Highlights-Rapid-Adoption]]|Survey Kubernetes|
|2019.11.08|Container Journal| → [[Survey Finds Kubernetes Clusters Are Multiplying|https://containerjournal.com/topics/container-ecosystems/survey-finds-kubernetes-clusters-are-multiplying/]]|Survey|
|2019.11.06|//Gurucul//|[[2020 Insider Threat Report|https://gurucul.com/2020-insider-threat-survey-report]]|Report Insider_Threats|
|2019.11.06|InfoSecurity Mag| → [[Cloud Covers Up Insider Threats|https://www.infosecurity-magazine.com/news/cloud-covers-up-insider-threats/]]|Report Insider_Threats|
|2019.11.06|HelpNet Security| → [[SIEM complexity and cloud visibility put companies at risk|https://www.helpnetsecurity.com/2019/11/08/siem-complexity/]]|Report Insider_Threats|
|2019.11.06|//PaloAlto Networks//|[[The Next Generation of Network Security Is Cloud-Delivered|https://blog.paloaltonetworks.com/2019/11/cloud-next-generation-network-security/]]|Network SASE|
|2019.11.06|//Tripwire//|[[Cloud Security Threats: Escaping the Egregious Eleven - Part One|https://www.tripwire.com/state-of-security/security-data-protection/cloud/cloud-security-threats-egregious-eleven-part-one/]] (1/2)|CSA Threats|
|2019.11.04|//Microsoft//|[[Microsoft Cloud Security solutions provide comprehensive cross-cloud protection|https://www.microsoft.com/security/blog/2019/11/06/microsoft-cloud-security-solutions-provide-comprehensive-cross-cloud-protection/]]|Azure|
|2019.11.06|//ExtraHop//|[[Three Cloud Security Best Practices for 2020|https://www.sans.org/cyber-security-intelligence/2019/11/06/three-cloud-security-best-practices-for-2020]]|Best_Practices|
|2019.11.06|//ZScaler//|[[Why You Still Need a Firewall When Deploying Office 365|https://www.zscaler.com/blogs/corporate/why-you-still-need-firewall-when-deploying-office-365]]|O365|
|2019.11.05|//Bitglass//|[[Cloud Adoption 2019: A for Adoption|https://www.bitglass.com/blog/cloud-adoption-2019-a-for-adoption]] ([[[téléchargement|https://pages.bitglass.com/CD-FY19Q4theCloudAdoptionReportof2019_LP.html]])|Report Bitglass|
|2019.11.06|HelpNet Security|[[As more companies deploy cloud apps, they must also implement security tools|https://www.helpnetsecurity.com/2019/11/06/accessing-cloud-data-via-sso/]]|Report Bitglass|
|2019.11.06|//Microsoft//|[[Microsoft Cloud Security solutions provide comprehensive cross-cloud protection|https://www.microsoft.com/security/blog/2019/11/06/microsoft-cloud-security-solutions-provide-comprehensive-cross-cloud-protection/]]|Azure Protection|
|>|>|>|!2019.11.05|
|2019.11.05|Pawel Urbanek|![[How to hide AWS EC2 instances from network scanning bots using IPv6|https://pawelurbanek.com/ec2-scanner-bots-ipv6]]|AWS IPv6 Attacks|
|2019.11.05|DZone|[[How to Remediate Kubernetes Security Vulnerability: CVE-2019-11247|https://dzone.com/articles/how-to-remediate-kubernetes-security-vulnerability-1]]|CVE-2019-11247 Kubernetes|
|2019.11.05|//Sophos//|[[Sophos 2020 Threat Report|https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-uncut-2020-threat-report.pdf]]|Report Attacks|
|2019.11.08|CIO| → [[Cyber criminals are exploiting android apps and misconfigured cloud platforms for attacks|https://www.cio.co.ke/cyber-criminals-are-exploiting-android-apps-and-misconfigured-cloud-platforms-for-attacks/]]|Report Attacks|
|2019.11.05|//Compare The Cloud//|[[DDoS attacks – Seven effects it has on cloud environments|https://www.comparethecloud.net/articles/ddos-attacks-seven-effects-it-has-on-cloud-environments/]]|Attacks DDoS|
|2019.11.05|//PaloAlto Networks//|[[A Firewall Admin's Introduction to Serverless Security|https://blog.paloaltonetworks.com/2019/11/cloud-serverless-security/]]|Serverless|
|2019.11.05|Computer Weekly|[[Security Think Tank: The cloud needs security by design|https://www.computerweekly.com/opinion/Security-Think-Tank-The-cloud-needs-security-by-design]]|Risks|
|>|>|>|!2019.11.04|
|2019.11.04|Rick's Cloud|[[2019 State of the Cloud in SMBs|https://rickscloud.com/2019-state-of-the-cloud-in-smbs/]]|Report|
|2019.11.04|Bleeping Computer|[[Office 365 to Prevent Malicious Docs From Infecting Windows|https://www.bleepingcomputer.com/news/microsoft/office-365-to-prevent-malicious-docs-from-infecting-windows/]]|O365 Prevention|
|2019.11.04|Container Journal|[[Persistent Data Storage Integral for Containers|https://containerjournal.com/topics/container-networking/persistent-data-storage-integral-for-containers/]]|Containers Storage|
|2019.11.04|HelpNet Security|[[Organizations fail to maximize use of Microsoft 365 security features|https://www.helpnetsecurity.com/2019/11/04/microsoft-365-security-features/]]|Survey SoftwareONE|
|2019.11.04|Christophe Parisel|[[How AWS and Azure are shaping the future of microservices|https://www.linkedin.com/pulse/how-aws-azure-shaping-future-microservices-christophe-parisel/]]|MicroServices|
|2019.11.04|//Microsoft//|[[Microsoft announces new innovations in security, compliance, and identity at Ignite|https://www.microsoft.com/security/blog/2019/11/04/microsoft-announces-new-innovations-in-security-compliance-and-identity-at-ignite/]]|Azure Tools|
|2019.11.04|Security Week| → [[Microsoft Unveils New Security Tools for Azure|https://www.securityweek.com/microsoft-unveils-new-security-tools-azure]]|Azure Tools|
|2019.11.04|Bleeping Computer| → [[Microsoft 365 Helps Improve Orgs' Security and Compliance Posture|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-helps-improve-orgs-security-and-compliance-posture/]]|Azure Tools|
|2019.11.04|Bleeping Computer| → [[Office 365 Breach Detection Capabilities Now in Public Preview|https://www.bleepingcomputer.com/news/microsoft/office-365-breach-detection-capabilities-now-in-public-preview/]]|Azure Tools|
|2019.11.04|Bleeping Computer| → [[Microsoft 365 Now Helps Find and Review Insider Security Threats|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-now-helps-find-and-review-insider-security-threats/ ]]|Azure Tools|
|2019.11.04|Venture Beat| → [[Microsoft announces security, identity, management, and compliance updates across Azure and Office|https://venturebeat.com/2019/11/04/microsoft-announces-security-identity-management-and-compliance-updates-across-azure-and-office/]]|Azure Tools|
|2019.11.04|Computer Weekly|[[Security Think Tank: Secure the cloud when negotiating contracts|https://www.computerweekly.com/opinion/Security-Think-Tank-Secure-the-cloud-when-negotiating-contracts]]|Misc|
|2019.11.04|Dark Reading|[[To Secure Multicloud Environments, First Acknowledge You Have a Problem|https://www.darkreading.com/cloud/to-secure-multicloud-environments-first-acknowledge-you-have-a-problem/a/d-id/1336219]]|Multi_Cloud|
|2019.11.04|//Microsoft//|[[What's new in Azure Active Directory at Microsoft Ignite 2019|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/What-s-new-in-Azure-Active-Directory-at-Microsoft-Ignite-2019/ba-p/827831]]|AzureAD|
|2019.11.04|//Spanning//|[[5 Steps to Securing your Office 365 Migration|https://spanning.com/blog/5-steps-securing-your-office-365-migration/]]|O365|
|2019.11.04|//Microsoft//|[[Book of News - Microsoft Ignite 2019|https://news.microsoft.com/wp-content/uploads/prod/sites/563/2019/11/Ignite-2019-Book-of-News.pdf]]|Azure|
|2019.11.04|//Forrester//|[[Predictions 2020: Cloud Computing|https://www.forrester.com/report/Predictions+2020+Cloud+Computing/-/E-RES157593]]|Predictions|
|2019.11.04|DevOps|[[Breaking Down the OWASP API Security Top 10, Part 1|https://devops.com/breaking-down-the-owasp-api-security-top-10-part-1/]] (1/2)|API|
!Communiqué de presse : "//CSA Contributes to Key How-To Guidance Documents for Multi-Party Recognition and Continuous Audit-Based Certification//"
<<<
[>img(200px,auto)[iCSF/EUSEC.jpg]]//Practical guidelines to innovative framework promoting trust in cloud services
BERLIN –– Nov. 7, 2019 – The ''Cloud Security Alliance'' (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the availability two guidance documents – "+++*[Implementing Multi-Party Recognition for Cloud Security Certifications]> lien → https://cdn0.scrvt.com/fokus/ccc72dd1f339f01e/440004d502fa/EU-SEC-Guidelines---Implementing-Multi-Party-Recognition-for-Cloud-Security-Certifications---ALL-GUIDES.pdf === and +++*[Implementing Continuous Audit-Based Certification]> lien → https://cdn0.scrvt.com/fokus/2dd3c180ea11ea69/1c925e3b6fb9/EU-SEC-Guidelines---Implementing-Continuous-Audit-Based-Certification.pdf === – designed for cloud stakeholders wishing to improve the business value, efficiency and effectiveness of their approach to cloud security certification schemes.

Since January 2017, CSA has been a key partner in the +++*[European Security Certification Framework (EU-SEC)]> lien → https://www.sec-cert.eu/ ===, a project funded by the European Commission under the H2020 program for research and innovation. The aim of EU-SEC is to create a framework under which existing certification and assurance approaches can co-exist, adding at the same time an additional layer of trust, assurance and transparency by including continuous auditing-based certifications.
"Compliance fatigue and lack of clarity is a tremendous problem in the cloud industry," said Daniele Catteddu, Global CTO at CSA. "The multi-party approach to cloud security certifications is a great way to tackle this as it minimizes the compliance burden for cloud service providers, as well as delivering a competitive advantage to auditors."
"I think this [Framework] is a big step towards managing compliance and providing a common framework to many large, complex and multi-site organizations," said Jatin Sehgal, Global Leader and Managing Partner, EY CertifyPoint.

Based on survey and analysis of the certification and standardization landscape which highlighted a number of issues in the ICT market in Europe, such as lack of trust and transparency, compliance fatigue and assurance gaps, the EU-SEC embarked on an ambitious path to create a framework which would assist cloud stakeholders navigating this complex and confusing field. The intervening years have been dedicated to developing this framework, leveraging the expertise of partners such as CSA.

The publication of the +++*[EU Cybersecurity Act (EUCA)]> lien → https://ec.europa.eu/digital-single-market/en/eu-cybersecurity-act === in June 2019, which shares EU-SEC's objective of increasing trust in ICT services, has reinforced and supported the work of EU-SEC.
The newly published how-to guidance documents bring together that expertise in a practical format for auditors, standard owners, cloud service providers and auditees who are looking to innovate their approach to certification and standardization.

In order to ensure the Framework remains relevant, CSA is inviting cloud stakeholders to complete a +++*[short survey]> lien → https://www.surveymonkey.com/r/EUSEC === on the certification and standardization landscape. The valuable contribution of auditors, standard owners and cloud service providers to this survey will provide CSA with an updated understanding of existing practices and feed into the development of the framework. The survey, which closes Nov. 28, can be found +++*[here]> lien → https://www.surveymonkey.com/r/EUSEC ===.//
<<<
__A noter :__
* Le guide d'implémentation est constitué de 3 parties : une pour les dépositaires du standard, une pour les entités auditrices, et un epour les entités auditées.
* Le sondage, accessible [[ici|https://CloudSecurityAlliance.fr/go/jb7s/]], est ouvert jusqu'au jeudi 28 novembre 2019.

&rArr; Lire [[le communiqué de presse|https://CloudSecurityAlliance.fr/go/jb7p/]] sur le site de la CSA.
!"//Google's Potential Claim to the Throne of Quantum Supremacy: What Does it Mean for Cybersecurity?//"
[>img(150px,auto)[iCSA/JB6BW.jpg]]Article de blog publié le 6 novembre 2019 — Rédigé par Roberta Faux, Shamik Kacker, Bruno Huttner, John Hooks, Ron F. del Rosario et John Young
<<<
//__''A mysterious paper''__
A research paper titled "+++*[Quantum Supremacy Using a Programmable Superconducting Processor]> lien → https://www.nature.com/articles/s41586-019-1666-5 ===" briefly appeared last September 21, 2019 on NASA's Technical Report Server (TRS), but was later removed.
In the paper, researchers from +++*[Google AI Quantum Labs]> lien → https://ai.google/research/teams/applied-science/quantum/ === claimed supremacy in quantum computing by successfully running a series of ground-breaking experiments utilizing a processor with programmable superconducting qubits and completing an experiment within 200 seconds that normally would take a modern, state-of-the-art supercomputer approximately 10,000 years to complete.
Various research and scientific community websites were able to obtain +++*[a copy of the document prior to its removal]> lien → https://www.inverse.com/article/59507-full-quantum-supremacy-paper ===. Therefore, this document has been the subject of much debate, scrutiny and speculation for the past few weeks. It is very likely that the paper is currently under peer review and shall be available soon.
Whether it was a PR stunt to attract interest (it worked!) or an honest mistake, it is now official: Google published on October 23, the results of their quantum supremacy experiment in the Nature article Quantum supremacy using +++*[a programmable superconducting processor]> lien → https://www.nature.com/articles/s41586-019-1666-5 ===.

__''What is Quantum Supremacy?''__
Coined by John Preskill back in 2012, "Quantum Supremacy" describes the point where quantum computers can do things that classical computers can't, regardless of whether those tasks are useful. John is a Theoretical Physicist and Director of The Institute for Quantum Information and Matter (IQIM) at Caltech.
In the paper, Google AI Quantum Labs researchers claimed they were able to achieve this status in quantum computing through their experiments utilizing a physical quantum processor with sufficiently low error rates:
"We have performed random quantum circuit sampling in polynomial time with a physically realized quantum processor (with sufficiently low error rates), yet no efficient method is known to exist for classical computing machinery. As a result of these developments, quantum computing is transitioning from a research topic to a technology that unlocks new computational capabilities. We are only one creative algorithm away from valuable near-term applications."
Note however, that some naysayers doubt this claim. The mathematician, Gil Kalai fully expects that "quantum supremacy cannot be achieved at all". While accepting the importance of this work, Kalai argues that Google made a crucial mistake in their supremacy claims. IBM, who is also one of the main contenders in the quantum race and has built its own 53-qubit machine, was not slow to react as well. The IBM team published a counter-argument to Google's estimates, arguing that the calculation could be simulated in just 2.5 days on available supercomputers, not the 10,00 years which Google reported. Whether Google has demonstrated "quantum supremacy" or is merely on the verge of "quantum supremacy," this feat should be noted as a milestone.

__''Potential impact on current cryptographic systems''__
According to John Preskill, the experiment is a sort of "demonstration" at this early stage that Google researchers understand their quantum computing hardware and the next big step is to look for more practical applications in general computing.
Researchers also stated that the next focus should be on engineering quantum error correction technology in order to tackle problems with immediate implications to current computing paradigms such as Shor's Algorithm.
Published back in 1995 by AT&T Labs Researcher Peter Shor in his paper "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer", the so-called Shor's Algorithm is a quantum algorithm that causes an exponential speed-up when solving factoring, discrete logarithm (DLP), and elliptic curve discrete logarithm (ECDLP) problems. Modern public key cryptography, which underpins secure communication and e-commerce on the internet, relies on the difficulty of solving these problems with our current classical computing paradigm. Therefore, a fully-realized quantum computer running Shor's algorithm will easily circumvent our current cryptographic infrastructure. Note that Shor's algorithm is not the only quantum algorithm attacking cybersecurity. Grover's algorithms can compromise our symmetric cryptography (e.g. AES). However, as it only results in a quadratic speed-up, increasing the AES key size can provide adequate resistance against Grover's quantum attack.
Does it mean that Google's experiment means doom for cybersecurity today? Not quite. As expressed above, the first caveat is about quantum error correction technology. A brief technical aside is required here to explain what we are writing about.
Today, all quantum processors utilize physical qubits, which can be in a coherent superposition of zero and one. With this type of qubits, every operation introduces some error, basically reducing the quality of the qubit. This limits the total number of operations, which can be performed before you "lose" your qubits, or decohere. In order to go further and perform longer computations, we need to move to logical qubits. A logical qubit is built from a large number of physical qubits, which protect it and enable error-free computations. This is the field of quantum error correction technology. Note that a classical computer, which runs on classical bits (zeros and ones), runs naturally on logical bits. In order to run Shor's algorithm, a quantum computer has to implement logical qubits. Now back to our development...
Google's system is using physical qubits, with a sufficiently low error rate. This was apparently enough to demonstrate quantum supremacy. However, it will probably be a good number of years before a quantum computer can run long enough computations with logical qubits. The current estimates are between 5 to +10 years.
The second caveat is that, although current cybersecurity infrastructure relies on potentially unsafe cryptographic protocols, new developments are currently underway to address this issue. This is the task of quantum-safe cryptography.

__''Can we counter the quantum threat?''__
The fact that we still have a few years before quantum supremacy transforms into a real threat to cybersecurity should not lure us into a false sense of security. We can already record data today and decrypt it once a powerful enough quantum computer is available. Information exchanged today, which may still have value in several years, is already at threat. Even adapting our infrastructure to the threat will take several years.
[>img(200px,auto)[iCSA_/PEFTQCCST.png]]According to the October 2019 research "Quantum Threat Timeline" conducted by the Global Risk Institute, the transition to quantum-safe cryptography is a challenge itself, as it requires the development and deployment of hardware and software solutions, the establishment of standards, the migration of legacy systems, and more."
Fortunately, things are already moving. Post-Quantum or Quantum-safe algorithms are actively being developed to specifically address this looming threat of quantum computing in the security of modern communication systems. The NIST in the USA has launched a competition, wherein groups of researchers around the world propose post-quantum algorithms for different cryptographic purposes. The goal is to converge to a few of them, which will become standards between 2022 and 2024.
In an interesting twist, new solutions, such as Quantum Random Number Generators and Quantum Key Distribution, based on the same quantum effects, can already be deployed today to offer quantum-safe communications.
Within the Cloud Security Alliance (CSA), the Quantum-Safe Security (QSS) working group is a forum where companies and academic institutions meet to discuss these issues, and suggest solutions. It has written a number of white papers, which address most of the above topics in a non-technical format. The latest report discusses how to prepare enterprises for the quantum threat.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jb6q/]] sur le blog de la CSA.
!"//CMMC – the New Protocol Droid for DoD Compliance//"
[>img(150px,auto)[iCSA/JB6BC.png]]Article de blog publié le 6 novembre 2019 — Rédigé par Doug Barbin, Cybersecurity Practice Leader chez Schellman & Company, LLC
<<<
//A long time ago in a galaxy exactly ours…There was 800-171.
For some time, the US Department of Defense has been working to revise its funding procurement procedures referred to as the Defense Acquisition Regulation Supplement, or DFARS.Most important among all the details are the included requirements in the regulations (under 252.204-7012), which mandate that defense contractors meet the NIST special publication (SP) 800-171 standard that deals with Controlled [but] Unclassified Information (CUI).

__Episode I – The Mandated Requirement__
NIST 800-171, unlike its broader cousin NIST 800-53, was written for non-government entries such as government contractors and service providers.With that being said, though NIST 800-171 is required for contractors, the DFARS regulation also necessitates the more comprehensive FedRAMP authorization for cloud service providers.

__Episode II – The Rise of CMMC__
The means to communicate NIST 800-171 compliance has always been inconsistent, with many service providers performing self-attestation, but earlier this year, the DoD made a presentation on a new model based on new revisions to the requirement. This new model includes a "certification" framework, and contractors and vendors who were once able to self-attest will now need third-party validation in 2020.
This proposed framework is called the +++*[Cybersecurity Maturity Model Certification, or CMMC]> lien → https://www.acq.osd.mil/cmmc/ ===.
The model, now on version 0.4, was most recently updated on August 30, 2019. For more details, see the  +++*[August 30, 2019 briefing document]> lien → https://www.acq.osd.mil/cmmc/docs/cmmc-overview-brief-30aug19.pdf ===, as well as the latest  +++*[Criteria v 0.4 – August 30, 2019]> lien → https://www.acq.osd.mil/cmmc/docs/cmmc-draft-model-30aug19.pdf ===.
In terms of requirements, v0.4 now includes additional descriptions of levels and practices including:
* 35 practices to achieve level 1 maturity or "Basic Cyber Hygiene"
* 115 additional practices to achieve level 2 maturity or "Intermediate Cyber Hygiene"
* 91 additional practices to achieve level 3 maturity or "Good Cyber Hygiene"
* 95 additional practices to achieve level 4 maturity or "Proactive"
* 34 additional practices to achieve level 5 maturity or "Advanced Progressive"

__Episode III – Oversight Awakens__
Lastly, on October 3rd DoD issued +++*[an RFI]> lien → https://www.fbo.gov/index?s=opportunity&mode=form&id=4a4b539a0e347e540b30b3121916031c&tab=core&_cview=0 === to solicit accreditation bodies for CMMC.Note that this is not for audit firms like Schellman, but for an accreditation body that will oversee and audit the auditors.Within the request for information, the DoD disclosed that the auditors will now be referred to as CMMC 3rd Party Assessment Organizations (C3PAOs).Yes, you heard that correctly, though there's been no word on Artoo Detoo.

__Episode IV – A New Requisite__
To summarize, here is what we know, based on the above data points:
* Version 0.4 further increased the number of required practices for each leader.
* The Undersecretary of Defense is expected to create an accreditation body to authorize C3PAOs.It would not be surprising should it come together similarly to FedRAMP, which requires 3PAOs to be accredited by A2LA.
* To date, there still has been no guidance released on the content or format of CMMC or C3PAO deliverables - everyone remains in a holding pattern there.
* CMMC validation by a third party is expected to be requested in RFIs starting in June of 2020 and in RFPs starting in the fall of 2020.
//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jb6d/]] sur le blog de la CSA.
!"//CSA Summit at (ISC)² Security Congress 2019//"
[>img(200px,auto)[iCSA/JAR-MCO.jpg]]Le ''CSA Summit'' s'est tenu à Orlando le 27 octobre 2019, dans le cadre du congrès (ISC)².

Les 6 présentations sont maintenant disponibles en téléchargement :
* "''Diversify Defense - Improving Cybersecurity Through Smart Consolidation''" par Jeff Costlow, ExtraHop
* "''The Next Evolution of Cloud Based Attacks and How to Prevent It''" par Brian Johnson, DivvyCloud
* "''Tell Me a Story – The Art of Explaining Risks''" par Christine Vanderpool, Florida Crystals
* "''Rethinking the Traditional Cloud Vendor Assessment Model: Proactive vs Reactive Vendor Security''" par Michael Odenwald, Whistic
* "''Security Leaders as Change Leaders''" par Marnie Wilking, Wayfair
* "''Eight Ball For The Win: Key Cloud and Cybersecurity Trends for 2020''" par Jim Reavis, Cloud Security Alliance[>img(100px,auto)[iCSA/JARCCAK.png]]
** Jim Reavis a notamment annoncé le ''CCAK'' (Certificate of Cloud Auditing Knowledge) pour 2020.

Les présentations peuvent être téléchargées individuellement ou en une seule fois.
Lien de téléchargement du paquet complet &rArr; ''[[CloudSecurityAlliance.fr/go/jb4p/|https://CloudSecurityAlliance.fr/go/jb4p/]]
!1 - Les nouveautés CSA de la semaine du 28 octobre au 3 novembre 2019
* Publication : Exigences pour les organismes procédant à l'audit et à la certification STAR +++*[»]> <<tiddler [[Publication : Exigences pour les organismes procédant à l'audit et à la certification STAR]]>>=== [>img[iCSF/cloud-security-alliance-fr.png]]
* Actu : Utilisation de SDP en anti-DDoS +++*[»]> <<tiddler [[2019.10.28 - Actu : Utilisation de SDP en anti-DDoS]]>>=== 
* Publication : Utilisation de SDP en anti-DDoS +++*[»]> <<tiddler [[2019.10.28 - Publication : Utilisation de SDP en anti-DDoS]]>>=== 
* Actu : Appel à commentaires, documents 'CloudAbuse Working Group Charter'+++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'CloudAbuse Working Group Charter']]>>=== et 'Privacy Level Agreement Working Group Charter' +++*[»]> <<tiddler [[2019.10.29 - Actu : Appel à commentaires, document 'Privacy Level Agreement Working Group Charter']]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.11.03 - Veille Hebdomadaire]]>>=== avec plus de 70 liens :
* __''À lire'' :__ Article "Cloud Storage Acquisition from Endpoint Devices" sur le site du SANS +++*[»]>
|2019.10.30|SANS|![[Cloud Storage Acquisition from Endpoint Devices|https://digital-forensics.sans.org/blog/2019/10/30/cloud-storage-endpoint-devices]]|Forensics Storage|
=== 
* Phishing Office 365 : plusieurs cas récents
* Retours d'expérience sur des pannes ou des incidents : Little "Chubby" (GCP), Capital One
* Rapports et sondages : Rick's Cloud, Securonix, Sysdig
* Cloud souverain : quelques éléments sur les efforts en France et en Europe
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** ''Deuxième'' teaser et inscription gratuite +++*[»]> <<tiddler [[2019.11.01 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (2/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
!4 - Contacts
<<tiddler .ReplaceTiddlerTitle with: [[Newsletter Hebdomadaire - 3 Novembre 2019]]>>
|!Novembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.11.01|
|2019.11.01|BetaNews|[[How automation can contribute to cloud security [Q&A]|https://betanews.com/2019/11/01/automation-cloud-security-qa/]]|Automation|
|2019.11.01|CBR Online|[[Google Cloud's Little "Chubby" Outage|https://www.cbronline.com/news/google-cloud-outage-chubby]]|GCP Outage Lessons_Learnt|
|2019.11.01|ZDnet|[[Europe's cloud computing plan won't do much to scare the US giants|https://www.zdnet.com/article/europes-cloud-computing-plan-wont-do-much-to-scare-the-us-giants/]]|Sovereign_Cloud Europe|
|2019.11.01|//Protego//|[[State of Serverless and Security|https://www.protego.io/state-of-serverless-and-security/]] ([[infographie|https://ss-usa.s3.amazonaws.com/c/308465463/media/18915dbcb1e74090390480216989672/infographic%20survey.pdf]])|Survey Serveless|
|2019.11.01|//Fugue//|[[Securing Microsoft Azure Virtual Networks and Network Security Groups|https://www.fugue.co/blog/securing-microsoft-azure-virtual-networks-and-network-security-groups]]|Azure Networking|
|2019.11.01|//CloudCheckr//|[[5 Rules of Multi-Cloud Governance: What AWS, Azure, and Google Cloud Users Need to Know|https://cloudcheckr.com/multi-cloud/multi-cloud-governance/]]|Governance|
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.31|
|2019.10.31|SANS|[[EML attachments in O365 - a recipe for phishing|https://isc.sans.edu/forums/diary/EML+attachments+in+O365+a+recipe+for+phishing/25474/]]|O365 Phishing|
|2019.10.31|DZone|[[Demystifying Security on AWS Cloud|https://dzone.com/articles/demystifying-security-on-aws-cloud]]|AWS|
|2019.10.31|SiliconAngle|[[Disaster recovery essential for data protection, and cloud makes it scalable|https://siliconangle.com/2019/10/31/disaster-recovery-essential-for-data-protection-datrium-cloud-scalable-dr-cubeconversations/]]|DRP|
|2019.10.31|Medium|[[Introducing The Multi-Cloud Cyber Range — Azure v0.01|https://medium.com/aws-cyber-range/introducing-the-multi-cloud-cyber-range-azure-v0-01-66fd13de3eef]]|Exercise Tools|
|2019.10.31|//Google Cloud//|[[Exploring container security: Use your own keys to protect your data on GKE|https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-use-your-own-keys-to-protect-your-data-on-gke]]|GCP Containers|
|2019.10.31|//Google Cloud//|[[Admin Insider: These 6 steps can help you address security threats in G Suite|https://cloud.google.com/blog/products/g-suite/admin-insider-these-6-steps-can-help-you-block-security-threats-in-g-suite]]|GCP Protection|
|2019.10.31|//Alibaba Cloud//|[[Thoughts on the Development of Secure Container Technology|https://medium.com/@Alibaba_Cloud/thoughts-on-the-development-of-secure-container-technology-8fb30670eea]]|Containers|
|2019.10.31|//Alibaba Cloud//|[[Next-Gen Enterprise Security Based on Cloud-Native Technology|https://medium.com/@Alibaba_Cloud/next-gen-enterprise-security-based-on-cloud-native-technology-6a6c28a6011e]]|Misc|
|2019.10.31|//Viruss//|[[3 Tips to Protect Yourself From the Office 365 Phishing Scams|http://www.viruss.eu/virus-news/3-tips-to-protect-yourself-from-the-office-365-phishing-scams-3/]]|O365 Phishing|
|2019.10.31|//Synology//|[[Behold: The 2019 cloud backup myth-buster|https://www.theregister.co.uk/2019/10/31/the_cloud_backup_myth_buster/]]|BackUps|
|2019.10.31|//Alcide//|[[Kubernetes Audit: Making Log Auditing a Viable Practice Again|https://blog.alcide.io/kubernetes-audit-making-log-auditing-a-viable-practice-again]]|Kubernetes Audit Logging|
|2019.10.31|//Caylent//|[[Kubernetes Service Discovery|https://caylent.com/kubernetes-service-discovery]]|Kubernetes Discovery|
|2019.10.31|//Google Cloud//|[[How GCP helps you take command of your threat detection|https://cloud.google.com/blog/products/identity-security/how-gcp-helps-you-take-command-of-your-threat-detection]]|GCP Detection|
|2019.10.31|//Armor//|[[Achieving PCI Compliance on AWS Is More Involved Than You Think|https://www.armor.com/blog/aws-pci-compliance/]]|AWS PCI_DSS Compliance|
|2019.10.31|//Lacework//|[[AWS Security Best Practices for 2020 You Need to Implement|https://www.lacework.com/aws-security-best-practices-2020/]]|AWS Best_Practices|
|2019.10.31|//Capsule8//|[[The Curious Case of a Kibana Compromise|https://capsule8.com/blog/the-curious-case-of-a-kibana-compromise/]]|Compromise|
|2019.10.31|//Managed Methods//|[[Top 4 Cloud Security Risks for K-12|https://managedmethods.com/blog/cloud-security-risks-for-k-12/]]|Risks|
|2019.10.31|//Google Cloud//|[[How Google adopted BeyondCorp: Part 4 (services)|https://security.googleblog.com/2019/10/how-google-adopted-beyondcorp-part-4.html]] (4/4)|Services|
|2019.10.31|Nino Crudele|[[Hackazure – anything bad and good about Azure Cybersecurity|https://ninocrudele.com/hackazure-anything-bad-and-good-about-azure-cybersecurity]]|Azure|
|>|>|>|!2019.10.30|
|2019.10.30|Solutions Numériques[>img[iCSF/flag_fr.png]]|[[La France et l'Allemagne ont présenté la feuille de route du futur Cloud européen|https://www.solutions-numeriques.com/securite/la-france-et-lallemagne-ont-presente-la-feuille-de-route-du-futur-cloud-europeen/]]|Sovereign_Cloud|
|2019.10.30|SANS|![[Cloud Storage Acquisition from Endpoint Devices|https://digital-forensics.sans.org/blog/2019/10/30/cloud-storage-endpoint-devices]]|Forensics Storage|
|2019.10.30|SANS|[[How to Perform a Security Investigation in AWS A SANS Whitepaper|https://www.sans.org/reading-room/whitepapers/analyst/perform-security-investigation-aws-whitepaper-39230]]|Investigation|
|2019.10.30|Down the rabbit Hole|[[Contain(er) Your Security|http://podcast.wh1t3rabbit.net/dtsr-episode-368-container-your-security]] ([[podcast mp3|http://hwcdn.libsyn.com/p/d/a/f/daf7af50cae08cd8/DtSR_Episode_368_-_Container_Your_Security.mp3]])|Containers|
|2019.10.30|APNIC|[[Internet clouds are (also) unpredictable|https://blog.apnic.net/2019/10/30/internet-clouds-are-also-unpredictable/]]|Networking Latency|
|2019.10.30|//McAfee//|[[Office 365 Users Targeted by Voicemail Scam Pages|https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/office-365-users-targeted-by-voicemail-scam-pages/]]|O365 Phishing|
|2019.10.31|Bleeping Computer| → [[New Office 365 Phishing Scams Using Audio Voicemail Recordings|https://www.bleepingcomputer.com/news/security/new-office-365-phishing-scams-using-audio-voicemail-recordings/]]|O365 Phishing|
|2019.10.31|HepNet Security| → [[Office 365 users targeted with fake voicemail alerts in suspected whaling campaign|https://www.helpnetsecurity.com/2019/10/31/office-365-voicemail-phishing/]]|O365 Phishing|
|2019.10.31|//Threatpost//| → [[Fake Voicemail/Office 365 Attack Targets Enterprise Execs|https://threatpost.com/enterprise-big-fish-fake-voicemail-office-365-attack/149730/]]|O365 Phishing|
|2019.10.30|3DS Outscale[>img[iCSF/flag_fr.png]]|![[Le Cloud Act en une infographie par 3DS Outscale|https://www.informatiquenews.fr/le-cloud-act-en-une-infographie-par-eds-outscale-64243]]|CLOUD_Act|
|2019.10.30|//Securonix//|[[More than 1 in 3 Enterprises Say Cloud Apps Are the Most Vulnerable to Insider Threat|https://www.securonix.com/press-release/more-than-1-in-3-enterprises-say-cloud-apps-are-the-most-vulnerable-to-insider-threat/]] ([[2019 Insider Threat Survey Report|https://www.securonix.com/resources/2019-insider-threat-survey-report/]])|Report Securonix|
|2019.10.30|Dark Reading| → [[Security Pros Fear Insider Attacks Stem from Cloud Apps|https://www.darkreading.com/cloud/security-pros-fear-insider-attacks-stem-from-cloud-apps/d/d-id/1336215]]|Report Securonix|
|2019.10.30|//Google Cloud//|[[Cloud storage data protection that fits your business|https://cloud.google.com/blog/products/storage-data-transfer/cloud-storage-data-protection-that-fits-your-business]]|GCP Storage|
|2019.10.30|//McAfee//|[[3 Tips to Protect Yourself From the Office 365 Phishing Scams|https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/office-365-phishing/]]|O365 Phishing|
|2019.10.30|//Protego//|[[Cloud Native Application Security - What You Need To Know|https://www.protego.io/what-you-need-to-know-about-cloud-native-security/]]|Cloud_Native|
|2019.10.30|//Microsoft//|[[Tutorial: Configure secure LDAP for an Azure Active Directory Domain Services managed domain|https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps]]|AzureAD LDAP|
|2019.10.30|//Nuage Networks//|[[SD-WAN Security – Challenges and Solution|https://www.nuagenetworks.net/blog/sd-wan-security-challenges-and-solution/]]|SDWAN|
|>|>|>|!2019.10.29|
|2019.10.28|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Un projet franco-allemand jette les bases d'un cloud européen|https://www.lemondeinformatique.fr/actualites/lire-un-projet-franco-allemand-jette-les-bases-d-un-cloud-europeen-76933.html]]|Sovereign_Cloud|
|2019.10.28|Informatique News[>img[iCSF/flag_fr.png]]|[[Les licences Microsoft 365 peuvent poser des problèmes de conformité|https://www.informatiquenews.fr/les-licences-microsoft-365-peuvent-poser-des-problemes-de-conformite-64215]]|O365 License|
|2019.11.01|The Register| → [[Microsoft sees sense, will give Office 365 admins veto rights on self-service Power tools|https://www.theregister.co.uk/2019/11/01/microsoft_power_platform_u_turn/]]|O365 License|
|2019.11.01|Informatique News[>img[iCSF/flag_fr.png]]| → [[Microsoft fait marche arrière sur son "Self-Service" pour Power Platform|https://www.informatiquenews.fr/microsoft-fait-marche-arriere-sur-son-self-service-pour-power-platform-64263]]|O365 License|
|2019.10.29|Container Journal|[[Top 10 Container and Kubernetes Security Questions to Ask Your Team|https://containerjournal.com/features/top-10-container-and-kubernetes-security-questions-to-ask-your-team/]]|Containers Kubernetes|
|2019.10.29|DZone|[[Docker Explained – An Introductory Guide To Docker|https://dzone.com/articles/docker-explained-an-introductory-guide-to-docker]]|Docker|
|2019.10.29|Dark Reading|[[Why Cloud-Native Applications Need Cloud-Native Security|https://www.darkreading.com/cloud/why-cloud-native-applications-need-cloud-native-security/a/d-id/1336187]]|Cloud_Native|
|2019.10.29|Euractiv|[[European cloud network to start in late 2020|https://www.euractiv.com/section/digital/news/european-cloud-network-to-start-in-late-2020/]]|Sovereign_Cloud Europe|
|2019.10.29|Synergy Research|[[Amazon, Microsoft, Google and Alibaba Strengthen their Grip on the Public Cloud Market|https://www.srgresearch.com/articles/amazon-microsoft-google-and-alibaba-strengthen-their-grip-public-cloud-market]]|Report|
|2019.10.30|Informatique News[>img[iCSF/flag_fr.png]]| → [[Cloud : quatre leaders sur un marché concentré|https://www.informatiquenews.fr/cloud-quatre-leaders-sur-un-marche-concentre-64230]]|Report|
|2019.10.29|TMCnet|[[Capital One AWS Breach is a Headache for Consumers, the Bank and now Amazon|https://blog.tmcnet.com/blog/rich-tehrani/security/capital-one-aws-breach-is-a-headache-for-consumers-the-bank-and-now-amazon.html]]|CapitalOne Outage Lessons_Learnt|
|2019.10.29|//Sysdig//|[[Sysdig 2019 Container Usage Report: New Kubernetes and security insights|https://sysdig.com/blog/sysdig-2019-container-usage-report/]]|Report Containers Kubernetes|
|2019.10.29|Container Journal| → [[Sysdig Report Shines Light on Container Usage Patterns|https://containerjournal.com/topics/container-ecosystems/sysdig-report-shines-light-on-container-usage-patterns/]]|Report Containers Kubernetes|
|2019.10.29|//Anchore//|[[Benefits of Static Image Inspection and Policy Enforcement|https://anchore.com/benefits-static-image-inspection/]]|Containers|
|2019.10.29|//AlienVault//|[[Was the largest breach in history a misconfiguration problem?|https://www.alienvault.com/blogs/security-essentials/was-the-largest-breach-in-history-a-misconfiguration-problem]]|Misconfigurations|
|2019.10.29|//JumpCloud//|[[Azure MFA|https://jumpcloud.com/blog/azure-mfa/]]|Azure Authentication|
|2019.10.29|//Alert Logic//|[[Streamline Cybersecurity for Cloud Applications and Data on Azure|https://blog.alertlogic.com/streamline-cybersecurity-for-cloud-applications-and-data-on-azure/]]|Azure|
|>|>|>|!2019.10.28|
|2019.10.28|Silicon.fr[>img[iCSF/flag_fr.png]]|[[DevOps : une autre gestion du risque… et de la productivité|https://www.silicon.fr/devops-risque-productivite-311933.html]]|DevOps Risks|
|2019.10.28|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Cloud : avec JEDI, Microsoft devient le fournisseur clé du Pentagone|https://www.silicon.fr/jedi-cloud-microsoft-fournisseur-cle-pentagone-311937.html]]|Government JEDI|
|2019.10.28|Federal News Network| → [[JEDI to Microsoft? It ain't over yet|https://federalnewsnetwork.com/tom-temin-commentary/2019/10/jedi-to-microsoft-it-aint-over-yet/]]|Government JEDI|
|2019.10.28|Redmond Channel Partner| → [[How Permanent Is Microsoft's Shocking JEDI Win?|https://rcpmag.com/blogs/scott-bekker/2019/10/microsoft-shocking-jedi-win.aspx]]|Government JEDI|
|2019.10.28|Direction Informatique[>img[iCSF/flag_fr.png]]|[[Avons-nous raison d'être frileux envers le cloud?|https://www.directioninformatique.com/avons-nous-raison-detre-frileux-envers-le-cloud/80472]]|Misc|
|2019.10.28|Rick's Cloud|[[2019 State of the Cloud in the Enterprise|https://rickscloud.com/2019-state-of-the-cloud-in-the-enterprise/]]|Report|
|2019.10.28|VMblog|[[Cloud-Native DevSecOps: How to Secure Your Cloud|https://vmblog.com/archive/2019/10/28/cloud-native-devsecops-how-to-secure-your-cloud.aspx]]|SecDevOps|
|2019.10.28|The Register|[[Amazon is saying nothing about the DDoS attack that took down AWS, but others are|https://www.theregister.co.uk/2019/10/28/amazon_ddos_attack/]]|AWS Outage Aftermath|
|2019.10.28|HelpNet Security|[[DevOps firewall: How pre-configuring your cloud deployment can ensure compliance|https://www.helpnetsecurity.com/2019/10/28/devops-firewall/]]|DevSecOps|
|2019.10.28|Bank Info Security|[[Two Data Leaks Expose Millions of Records|https://www.bankinfosecurity.com/two-data-leaks-expose-millions-records-a-13299]]|Data_Leaks|
|2019.10.28|Jordan Potti|[[Offensive Cloud Distribution|https://github.com/jordanpotti/OffensiveCloudDistribution]] (to distribute large security scans across numerous cloud instances)|[[Tools|Outils-GitHub]]|
|2019.10.28|Sarah Gray|[[Security Best Practices - AWS Virtual Workshop|https://www.youtube.com/watch?v=mNUFa6wGEEk]] (vidéo de 1h30)|AWS Workshop|
|2019.10.28|//AWS//[>img[iCSF/flag_fr.png]]|[[Annonce de l'analyse d'image pour Amazon ECR|https://aws.amazon.com/fr/about-aws/whats-new/2019/10/announcing-image-scanning-for-amazon-ecr/]]|AWS Images|
|2019.10.28|Catchpoint|[[Four Ways to Mitigate the Impact of DNS Attacks|https://blog.catchpoint.com/2019/10/28/four-ways-to-mitigate-the-impact-of-dns-attacks/]]|AWS DDoS Outage|
|2019.10.28|//Microsoft//|[[Customize networking for DR drills: Azure Site Recovery|https://azure.microsoft.com/en-us/blog/customize-networking-for-dr-drills-azure-site-recovery/]]|Azure DRP|
|2019.10.28|//Microsoft//|[[IoT security will set innovation free: Azure Sphere general availability scheduled for February 2020|https://www.microsoft.com/security/blog/2019/10/28/iot-innovation-azure-sphere-general-availability-february-2020/]]|Azure_Sphere IoT|
|2019.10.28|//Zscaler//|[[Rethinking Office 365 Security and Networking Infrastructure|https://www.cbronline.com/opinion/office-365-networking-zscaler]]|O365 Architecture|
[>img(200px,auto)[iCSF/CCSEP2019.png]]Pour s'inscrire à la ''Cloud & Cyber Security Expo'' et disposer une deuxième aperçu du programme des conférences gratuites :

Suivez le lien → ''[[CloudSecurityAlliance.fr/go/jb1r|https://CloudSecurityAlliance.fr/go/jb1r]]''

[img(auto,60px)[iCSF/CCSA19h.jpg][https://CloudSecurityAlliance.fr/go/jb1r]]
!"//Cloud Security Alliance Health Information Management Working Group Co-Chair Dr. Jim Angle to Present at HIMSS//"
^^//Dr. Jim Angle, manager of Network Security – Vulnerability Management at Trinity Health and co-chair of CSA's Health Information Management Working Group, will be presenting "''Managing the Risk for Medical Devices Connected to the Cloud''" at the +++*[HIMSS Global Health Conference & Exhibition]> https://www.himssconference.org/ === (Orlando) on March 11 at 2:30 p.m. In his talk, Dr. Angle will share some of his key insights that laid the groundwork for the white paper of the same name by CSA's Health Information Management (HIM) Working Group, sharing with attendees how to apply the IoT Security Controls Framework to highly sensitive medical systems that support critical services.//
&rArr; Lire le [[communiqué de presse|https://cloudsecurityalliance.org/press-releases/2019/11/20/cloud-security-alliance-health-information-management-working-group-co-chair-dr-jim-angle-to-present-at-himss/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//The Four Pillars of CASB: Threat Protection//"
[>img(100px,auto)[iCSA/JBIBT.png]]^^Article publié le 18 novembre sur le blog de la CSA, et après l'avoir été il y a plus de 2 mois sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/blog/2019/11/18/the-four-pillars-of-casb-threat-protection/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/four-pillars-casb-threat-protection]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Digital Transformation, Cybersecurity, Cloud Apps, and Cloud Security//"
[>img(100px,auto)[iCSA/JBIBD.jpg]]^^Article publié le 18 novembre sur le blog de la CSA, et après l'avoir été il y a plus de 2 mois sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://cloudsecurityalliance.org/blog/2019/11/21/digital-transformation-cybersecurity-cloud-apps-and-cloud-security/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.bitglass.com/blog/digital-transformation-cybersecurity-cloud-apps-cloud-security]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Traduction en japonais de 2 documents du CSA//"
^^Traductions publiées le 18 novembre 2019 :[>img(100px,auto)[iCSA/J86PT.jpg]][>img(100px,auto)[iCSA/J14PG.png]]
* "Guideline on Effectively Managing Security Service in the Cloud"
** &rArr; Lien de [[téléchargement|https://cloudsecurityalliance.org/artifacts/guideline-on-effectively-managing-security-service-in-the-cloud-japanese-translation/]]
* "Top Threats to Cloud Computing: Egregious Eleven"
** &rArr; Lien de [[téléchargement|https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-egregious-eleven-japanese-translation/]]
^^
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CSA Announces Advanced Cloud Security Practitioner Training, a Highly Technical Hands-on Course for Technical Security Professionals//"
[>img(100px,auto)[iCSA/J73CCSK.png]]^^Annonce du 4 novembre pour une formation "Advanced Cloud Security Practitioner Training" les 10 et 11 décembre 2019 à Kansas City, Missouri.
Le formateur sera ''[[Rich Mogull|https://securosis.com/about/team]]'', qui est non seulement très compétent, mais aussi très pédagogue.
&rArr; Lire [[l'annonce|https://CloudSecurityAlliance.fr/go/jb4a/]] sur le site de la ''Cloud Security Alliance''
&rArr; Pour les [[détails et s'inscrire|https://CloudSecurityAlliance.fr/go/jb4i/]]^^
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//3 Technical Benefits of Service Mesh, and Security Best Practices//"
[>img(100px,auto)[iCSA/JB4B3.jpg]]^^Bien que publié le 4 novembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a plus d'un mois, le 26 septembre 2019 sur le site de la société Portshift.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/jb4z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/jb4x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201910>>
<<tiddler fAll2Tabs10 with: VeilleM","_201910>>
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|Aucune alerte pour le moment|
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Octobre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201910>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Octobre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Octobre 2019]]>><<tiddler fAll2LiTabs with: Actu","201910>>
<<tiddler fAll2LiTabs with: Blog","201910>>
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Octobre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201910>>
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Octobre 2019]]>>
!CloudAbuse Working Group Charter
Charte du groupe de travail "Cloud Abuse".[>img(100px,auto)[iCSA/CSAdoc.png]]
La date limite pour transmettre les commentaires est le 29 novembre 2019.
<<<
//The mission of the CloudAbuse working group is to promote operational security and aid in the timely sharing of indicators of abuse across all the member's services.
This mission is conducted through private information sharing within a community of trusted representatives of each member organization.//
<<<
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/jatc|https://cloudsecurityalliance.fr/go/jatc/]]''
!Privacy Level Agreement Working Group Charter
Charte du groupe de travail "Open Certification Framework" (OCF)[>img(100px,auto)[iCSA/CSAdoc.png]]
La date limite pour transmettre les commentaires est le 29 novembre 2019.
<<<
//The Cloud Security Alliance would like to invite you to review and comment on the updated Privacy Level Agreement Working Group Charter.
The Privacy Level Agreement (PLA) Working Group was originally established in 2011 with the objective to define good practices and tools to help both CSPs and cloud users in their journey toward the compliance with relevant European Union privacy legislations.
The draft CSA Code of Conduct and Certification are currently under the revision of the relevant Data Protection Authorities.
The goal of CSA is, clearly to obtain the approval of both of them by the European Data Protection Board.
The current version of the PLA CoP (V3.2) doesn't thought cover the requirements of the GDPR Art.46 on international data transfer.
Given the importance of the topic in the cloud market, the CSA has decided to take action and revise the current versions of its CoC and Certification so to be able to use them as tools for international data transfer.
Moreover, in its mission to support both CSPs and customers to overcome their cloud security and privacy challenges, the CSA has also decided to initiate an analysis of other relevant Privacy and Data Protection regulations applicable to the cloud market and define, on the basis of the results already achieved, new tools and best practices for global privacy compliance.
In summary, the extension of the scope of existing CSA's best practice and tools for GDPR compliance to international data transfer and global privacy compliance, would be the main goals of the new PLA WG.
This is your opportunity to provide feedback and identify any critical areas that we might miss in our working group's focus.
The open review and comments period starts today and ends on November 29, 2019.//
<<<
* Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/jatp|https://cloudsecurityalliance.fr/go/jatp/]]''
!Document "//Requirements for Bodies Providing STAR Certification//"
[>img(200px,auto)[iCSA/JATPR.png]]Publication de ce qui semble être un document de travail (avec quelques erreurs mineures) qui s'inspire de l'ISO ISO/IEC 27006:2015 qui porte sur les exigences pour les organismes procédant à l'audit et à la certification des systèmes de management de la sécurité de l'information.
__Extraits :__
<<<
//1 - General
* 1.1 - This document outlines how to conduct a STAR certification assessment to the Cloud Controls Matrix (CCM) as part of an ISO/IEC 27001 assessment.
* 1.2 - The controls set out in the CCM can be considered additional
//[...]//
4 - Requirements on a certification body
* 4.1 - A certification body must be a CSA Corporate Member in good standing
* 4.2 - A certification body conducting CCM assessments shall be ISO/IEC 27006 accredited by an IAF member accreditation body for delivery of ISO/IEC 27001 assessments.
* 4.3 - A certification body shall comply with all the requirements of ISO/IEC 27006 as well as this documents requirements when conducting a CCM assessment.
//[...]//
5 Competency requirements
* 5.1 - All assessors must be able to present evidence of passing an accredited lead auditor
course for ISO/IEC 27001 or be a qualified and experienced ISO/IEC 27001 assessor
for an IAF member accredited ISO/IEC 27001 certification body.
//[...]//
9 - Audit and Certification
9.1 - An assessment cycle will follow the assessment cycle for ISO/IEC 27001.
//[...]
<<<
//&rArr; télécharger le ''[[document|https://CloudSecurityAlliance.fr/go/jasr/]]
!Article "//Cloud Security Alliance Releases Anti-DDoS: Software-Defined Perimeter As a DDoS Prevention Mechanism//"
[>img(200px,auto)[iCSA/JASPS.png]]
<<<
//Document examines the operationalization of Software-Defined Perimeter as prevention mechanism against three well-known types of Distributed Denial of Service attacks

ORLANDO – (ISC)2 Security Congress – Oct. 28, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today released new research on Anti-DDoS: Software-Defined Perimeter as a DDos Prevention Mechanism. Produced by CSA's Software-Defined Working (SDP) Group, this paper sheds light on the use of a SDP as a tool to prevent Distributed Denial-of-Service (DDoS) attacks. It demonstrates the efficiency and effectiveness of a SDP against several well-known attacks including HTTP Flood, TCP SYN, and UDP Reflection.

The document focuses on protecting private services, such as private business applications, employee or customer portals, and email servers, which are well-suited to being protected from DDoS attacks by a Software-Defined Perimeter. Utilizing the Seven Layer OSI Model, various scenarios are laid out based on where the aforementioned attacks may be targeted (i.e. applications, transportation, and networks), which security professionals can use as guides for securing their own enterprise systems.

"Denial of Service attacks are - and continue to be - a problem. With the adoption of cloud services, the threat of network attacks against application infrastructure increases, since traditional perimeter-defense techniques cannot adequately protect servers," said Juanita Koilpillai, co-chair, CSA Software-Defined Perimeter Working Group, and CEO and President of Waverley Labs. "This document, the latest from the SDP Working Group, was created to aid those responsible for the evaluation, design, deployment, or operation of DDoS prevention solutions within their enterprise."

Typically performed against public-facing services running on the internet, such as web servers and DNS servers, DDoS attacks attempt to overwhelm a target and prevent it from delivering its services to legitimate users. SDPs are resilient against these types of attacks, however, because they utilize a computationally lightweight mechanism (SPA) to distinguish between authorized and unauthorized users, even from remote systems. Because the vast majority of DDoS traffic is initiated by unauthorized users, SDP gateways can reject it without incurring a heavy computational load on the server.

The Software-Defined Perimeter Working Group was created with the goal of developing a solution to stop network attacks against application infrastructure. Those interested in learning more about the group or participating in future research should visit the Software-Defined Perimeter Working Group page.//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jasa/]] sur le site de la CSA.
!Document "//Software-Defined Perimeter as a DDoS Prevention Mechanism//"
[>img(200px,auto)[iCSA/JASPS.png]]__Extraits__
<<<
//__''Goals:''__
The primary goal of this document is to increase the awareness and understanding of SDP as a tool to prevent DDoS attacks by demonstrating its efficiency and effectiveness against several wellknown attacks, including HTTP Flood, TCP SYN, and UDP Reflection.//
[...]
//__''SDP as a DDoS Defense Mechanism:''__ 
The techniques described above to detect, divert, filter and analyze are suitable for a large volume of packets associated with DDoS attacks. Many small malformed packets associated with resource depletion DDoS attacks typically bypass these techniques as they are hard to detect. However, these techniques are expensive and more frequently than not filter out good packets. SDPs are architected to allow ONLY good packets through while dropping all bad packets. In general, with SDPs, hosts are hidden, clients coordinate with (typically with multiple) perimeters so that good packets known to SDPs and upstream routers can be informed about bad packets to block. For the purpose of showing how SDPs can be used as a DDoS defense mechanism, we will use the open source reference implementation as an example. In the reference implementation, clients (users on devices) are cryptographically signed into the perimeter.//
[...]
//__''Summary:''__
The goal of this paper is to increase the awareness and understanding of SDP as a tool to prevent DDoS attacks by demonstrating its efficiency and effectiveness against several well- known attacks.
To that end we presented in the Introduction definitions of DDoS and DoS attacks. Then in the next section DDoS Attack Vectors, we presented a table DDoS attack Vectors by OSI and TCP/IP layers.
From this table we selected as our focus three well-known attacks:
# Layer 7 Application - HTTP Flood Attacks
# Layer 4 Transport - SYN "TCP" Flood
# Layer 3 Network - UDP Reflection Attacks
After selecting the vectors and attacks of focus we explained them conceptually in detail. This was followed by a section DDoS Attack Mitigations via Non SDP Defenses where we described non SDP mitigations that are available for use at various OSI layers.
We followed this up with SDP as DDoS Defense Mechanism. Here we first described the sequence of events that are followed to set up and configure SDP as a DDoS defense. Then we enumerated the protections afforded by the setup including
# Invisible services behind a deny-all SDP Gateway;
# Authenticating users on devices prior to opening up the firewall to establish connections;
# Using a dynamic firewall mechanism, to allow or which allows SDP to drop packets as fast as the switches serve them up during a DDoS attack.
Finally, we looked at the following three attacks using SDP as a defense mechanism:
# HTTP Flood Attack & SDP Defense
# TCP SYN Flood Attack & SDP Defense
# UDP Reflection Attack & SDP Defense
//
<<<
__Table des Matières__//
<<<
* Introduction
** DDoS and DoS Attacks Defined
** Goals
** Target Audience
** DDoS Attack Vectors
** DDoS Attack Vectors by OSI and TCP/IP Model Layer
** DDoS Attack Mitigations (via Non SDP Defenses)
* SDP as a DDoS Defense Mechanism
* HTTP Flood Attack & SDP Defense
** Battlefield
** Attack Explained
** Defense Explained
* TCP SYN Flood Attack and SDP Defense
** Battlefield
** Attack Explained
** Defense Explained
* UDP Reflection Attack & SDP Defense
** Battlefield
** Attack Explained
** Defense Explained
* Summary
* Glossary
* Other Reading
* Appendix
** Appendix 1: OSI & TCP/IP Layers & Logical Protocols
** Appendix 2: DDoS Attacks by OSI & TCP/IP Layers
** Appendix 3: DDoS & Other Attack Monitoring Maps
** Appendix 4: DDoS Biggest Attacks
<<<
//&rArr; télécharger le ''[[document|https://CloudSecurityAlliance.fr/go/jasp/]]
!1 - Les nouveautés CSA de la semaine du 21 au 27 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Corporate Contractors and the Requirement for Zero-Trust Network Access''+++*[»]> <<tiddler [[2019.10.21 - Blog : 'Corporate Contractors and the Requirement for Zero-Trust Network Access']]>>=== 
* Actu : Gouvernance du risque et certification européenne au Congrès CSA EMEA en Novembre à Berlin +++*[»]> <<tiddler [[2019.10.24 - Actu : Gouvernance du risque et certification européenne au Congrès CSA EMEA en Novembre à Berlin]]>>=== 
* __''À lire'' :__ ''Modèle MITRE ATT&CK adapté au Cloud''+++*[»]> <<tiddler [[2019.10.25 - Actu : Modèle MITRE ATT&CK adapté au Cloud]]>>=== 
!2 - Veille Web
La +++*[Veille Web]> <<tiddler [[2019.10.27 - Veille Hebdomadaire]]>>=== avec plus de 60 liens :
* Pannes ou attaques : Amazon AWS, Google GCP
* Fuites de données : Adobe Cloud, AutoClerk (fonctionnaires et militaires américains)
* Annonces : attribution du contrat JEDI pour le DoD à ... Microsoft (pour le moment)
* Rapports : Skybox Security
* Divers : Docker, Kubernetes, sécurité des containers
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** Teaser et inscription gratuite+++*[»]> <<tiddler [[2019.10.11 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (1/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.25|
|2019.10.25|Comparitech|[[7 million Adobe Creative Cloud accounts exposed to the public|https://www.comparitech.com/blog/information-security/7-million-adobe-creative-cloud-accounts-exposed-to-the-public/]]|DataLeak Adobe|
|2019.10.25|Bleeping Computer| → [[7.5 Million Records of Adobe Creative Cloud User Data Exposed|https://www.bleepingcomputer.com/news/security/75-million-records-of-adobe-creative-cloud-user-data-exposed/]]|DataLeak Adobe|
|2019.10.25|BetaNews| → [[Adobe exposed personal data of 7.5 million Creative Cloud users in unsecured database|https://betanews.com/2019/10/26/adobe-creative-cloud-data-leak/]]|DataLeak Adobe|
|2019.10.28|Security Week| → [[Adobe Exposed Creative Cloud Customer Information|https://www.securityweek.com/adobe-exposed-creative-cloud-customer-information]]|DataLeak Adobe|
|2019.10.25|The Register|[[You're flowing it wrong: Bad network route between Microsoft, Apple blamed for Azure, O365 MFA outage|https://www.theregister.co.uk/2019/10/25/microsoft_outage_explainer/]]|Outage O365|
|2019.10.25|DoD|!JEDI Cloud : [[Contracts For Oct. 25, 2019|https://www.defense.gov/Newsroom/Contracts/Contract/Article/1999639/]]|Government JEDI|
|2019.10.25|Silicon Angle| → [[In a big surprise, Pentagon grants Microsoft $10B JEDI cloud contract over Amazon|https://siliconangle.com/2019/10/25/surprise-move-pentagon-grants-microsoft-jedi-cloud-contract-amazon/]]|Government JEDI|
|2019.10.25|GeekWire| → [[Amazon 'surprised' after Pentagon awards coveted $10 billion JEDI cloud contract to rival Microsoft|https://www.geekwire.com/2019/microsoft-awarded-pentagons-10b-jedi-cloud-contract-huge-win-rival-amazon/]]|Government JEDI|
|2019.10.25|Federal News Network| → [[Microsoft wins DoD's controversial JEDI Cloud contract|https://federalnewsnetwork.com/defense-main/2019/10/microsoft-wins-dods-jedi-cloud-contract/]]|Government JEDI|
|2019.10.25|Defense One| → [[Microsoft Wins Massive JEDI Cloud Contract|https://www.defenseone.com/business/2019/10/microsoft-wins-massive-jedi-cloud-contract/160890/]]|Government JEDI|
|2019.10.26|The Register| → [[Pentagon beams down $10bn JEDI contract to Microsoft: Windows giant beats off Bezos|https://www.theregister.co.uk/2019/10/26/microsoft_wins_jedi_deal/]]|Government JEDI|
|2019.10.26|Security Week| → [[Pentagon Awards $10 Billion Cloud Contract to Microsoft, Snubbing Amazon|https://www.securityweek.com/pentagon-awards-10-billion-cloud-contract-microsoft-snubbing-amazon]]|Government JEDI|
|2019.10.27|BetaNews| → [[Microsoft awarded Pentagon's controversial JEDI contract|https://betanews.com/2019/10/27/microsoft-wins-jedi-contract/]]|Government JEDI|
|2019.10.25|DZone|[[Why MQTT Has Become the De-Facto IoT Standard|https://dzone.com/articles/why-mqtt-has-become-the-de-facto-iot-standard]]|MQTT|
|2019.10.25|CIO Dive|[[Senators press AWS on cloud security, call for FTC investigation|https://www.ciodive.com/news/senators-press-aws-on-cloud-security-call-for-ftc-investigation/565751/]]|CapitalOne Outage Lessons_Learnt|
|2019.10.25|//Google Cloud//|[[Exploring Container Security: Vulnerability management in open-source Kubernetes|https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-vulnerability-management-in-open-source-kubernetes]]|containers Kubernetes Vulnerability|
|2019.10.25|//Lacework//|[[NIST Cybersecurity Framework and Your Cloud|https://www.lacework.com/nist-cybersecurity-framework/]]|NIST|
|2019.10.25|//Threatpost//|[[Is AWS Liable in Capital One Breach?|https://threatpost.com/capital-one-breach-senators-aws-investigation/149567/]]|CapitalOne Lessons_Learnt|
|2019.10.25|//BSSI//|[[Retour sur la Hack.lu – Jour 3|https://blog.bssi.fr/retour-sur-la-hack-lu-jour-3/]]|Containers|
|>|>|>|!2019.10.24|
|2019.10.24|Hack.lu|![[Who contains the containers|https://cfp.hack.lu/hacklu19/talk/VJSHEV/]]|Containers|
|2019.10.24|RootShell.be| → [[Hack.lu 2019 Day #3 Wrap-Up|https://blog.rootshell.be/2019/10/24/hack-lu-2019-day-3-wrap-up/]]|Containers|
|2019.10.23|Container Journal|[[Kubernetes Without Scale: Setting up a Personal Cluster, Part 2|https://containerjournal.com/topics/container-ecosystems/kubernetes-without-scale-setting-up-a-personal-cluster-part-2/]] (2/2)|Kubernetes|
|2019.10.24|DZone|[[Kubernetes vs. Docker: Comparing The Two Container Orchestration Giants!|https://dzone.com/articles/kubernetes-vs-docker-comparing-the-two-container-o]]|Orchestration Kubernetes Docker|
|2019.10.24|CSO Online|[[5 cloud security basics and best practices|https://www.csoonline.com/article/3446458/5-cloud-security-basics-and-best-practices.html]]|Best_Practices|
|2019.10.24|//ThreatStack//|[[How to Create a Security Risk Assessment for Containers in 5 Steps|https://www.threatstack.com/blog/create-a-security-risk-assessment-for-containers-in-5-steps]]|Containers Risk_Assessment|
|2019.10.24|//CloudCheckr//|[[7 Ways to Improve Your Cloud Computing Return on Investment|https://cloudcheckr.com/cloud-cost-management/7-ways-to-improve-your-cloud-computing-return-on-investment-roi/]]|AWS|
|2019.10.24|//Containous//|[[13 Criteria for Choosing the Best Ingress Controller for Your Kubernetes Deployment|https://vmblog.com/archive/2019/10/24/13-criteria-for-choosing-the-best-ingress-controller-for-your-kubernetes-deployment.aspx]]|Kubernetes|
|2019.10.24|//Alcide//|[[Pod Security Policy|https://blog.alcide.io/pod-security-policy]]|Security_Policy|
|2019.10.24|//Skybox Security//|[[Cloud Infrastructure Vulnerabilities to Increase 50%, According to Skybox Security Report|https://www.prnewswire.com/news-releases/cloud-infrastructure-vulnerabilities-to-increase-50-according-to-skybox-security-report-300944494.html]] ([[rapport|https://lp.skyboxsecurity.com/WICD-2019-10-Cloud-Threat-Trends-Report_Reg.html]])|Report Skybox|
|2019.10.24|//Skybox Security//| → [[Cloud Trends Report Infographic 2019|https://lp.skyboxsecurity.com/WICD-2019-10-Cloud-Threat-Trends-Infographic_03-Infographic.html]] ([[pdf|https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Cloud_Trends_Infographic.pdf]])|Report Skybox|
|2019.10.28|HelpNet Security| → [[IaaS cloud vulnerabilities expected to increase 50% over 2018 figures|https://www.helpnetsecurity.com/2019/10/28/iaas-cloud-vulnerabilities-2019/]]|Report Skybox|
|2019.10.24|//Google//|![[Advancing customer control in the cloud|https://cloud.google.com/blog/topics/inside-google-cloud/advancing-customer-control-in-the-cloud]]|CLOUD_Act|
|2019.10.24|//Google//|![[Data incident response process|https://cloud.google.com/security/incident-response/]]|Incident_Response|
|>|>|>|!2019.10.23|
|2019.10.23|DZone|[[Docker Container - Volume and Data Recovery|https://dzone.com/articles/docker-container-volume-mount-and-data-recovery]]|Docker|
|2019.10.23|Container Journal|[[Kubernetes Without Scale: Reasons to Run a Personal Cluster, Part 1|https://containerjournal.com/topics/container-ecosystems/kubernetes-without-scale-reasons-to-run-a-personal-cluster/]] (1/2)|Kubernetes|
|2019.10.23|VMblog|[[Using DRaaS to Mitigate the Damage of Ransomware|https://vmblog.com/archive/2019/09/23/using-draas-to-mitigate-the-damage-of-ransomware.aspx]]|DRaaS Mitigation|
|2019.10.23|Eversheds Sutherland|[[Legal Alert: The CLOUD Act – A cross-border data access agreement rises from the fog|https://us.eversheds-sutherland.com/NewsCommentary/Legal-Alerts/226041/Legal-Alert-The-CLOUD-Act-A-cross-border-data-access-agreement-rises-from-the-fog]]|CLOUD_Act|
|2019.10.23|//Google Cloud//|[[Find and fix misconfigurations in your Google Cloud resources|https://cloud.google.com/blog/products/identity-security/find-and-fix-misconfigurations-in-your-google-cloud-resources]] (6/6)|GCP Misconfigurations|
|>|>|>|!2019.10.22|
|2019.10.22|The Register|[[Bezos DDoS'd: Amazon Web Services' DNS systems knackered by hours-long cyber-attack|https://www.theregister.co.uk/2019/10/22/aws_dns_ddos/]]|AWS DDoS Outage|
|2019.10.23|Catchpoint|! → [[AWS Users Blindsided by DDoS Attacks|https://blog.catchpoint.com/2019/10/23/aws-ddos-attacks/]]|AWS DDoS Outage|
|2019.10.23|TechRadar| → [[AWS hit by major DDoS attack|https://www.techradar.com/news/aws-hit-by-major-ddos-attack]]|AWS DDoS Outage|
|2019.10.23|IT Pro| → [[AWS servers hit by sustained DDoS attack|https://www.itpro.co.uk/amazon-web-services-aws/34679/aws-servers-hit-by-sustained-ddos-attack]]|AWS DDoS Outage|
|2019.10.23|CBR Online| → [[AWS Hit by DDoS Attack – Google Cloud Issues Unrelated|https://www.cbronline.com/news/aws-ddos-attack]]|AWS DDoS Outage|
|2019.10.24|Dark Reading| → [[Eight-Hour DDoS Attack Struck AWS Customers|https://www.darkreading.com/cloud/eight-hour-ddos-attack-struck-aws-customers/d/d-id/1336165]]|AWS DDoS Outage|
|2019.10.24|Security Week| → [[DDoS Attack Hits Amazon Web Services|https://www.securityweek.com/ddos-attack-hits-amazon-web-services]]|AWS DDoS Outage|
|2019.10.24|InfoSec Mag| → [[AWS Left Reeling After Eight-Hour DDoS|https://www.infosecurity-magazine.com/news/aws-customers-hit-by-eighthour-ddos/]]|AWS DDoS Outage|
|2019.10.22|Ajay Kumar|[[What is Azure Security Center and its Capabilities?|https://medium.com/@intouchajay/what-is-azure-security-center-and-its-capabilities-cf19edbd6983]]|Azure|
|2019.10.22|//TrendMicro//|![[The Shared Responsibility Model|https://blog.trendmicro.com/the-shared-responsibility-model/]]|Shared_Responsibility|
|2019.10.22|//Sophos//|[[Storing your stuff securely in the cloud|https://nakedsecurity.sophos.com/2019/10/22/storing-your-stuff-securely-in-the-cloud/]]|Misc|
|2019.10.22|//Digital Ocean//|[[Issues with accessing S3/RDS resources inside Droplets across all regions|https://status.digitalocean.com/incidents/1z3kmlvz69v6]]|Outage|
|2019.10.22|//Google Cloud//|[[Google Cloud Networking Incident #19020|https://status.cloud.google.com//incident/cloud-networking/19020]]|Outage GCP|
|2019.10.22|//ExtraHop//|[[4 Common Cloud Misconfigurations & What To Do About Them|https://www.extrahop.com/company/blog/2019/4-common-cloud-misconfigurations-and-what-to-do-about-them/]]|Misconfigurations|
|2019.10.22|//Tripwire//|[[Guide to Container Security - Everything You Need to Know|https://www.tripwire.com/state-of-security/devops/guide-container-security/]]|Containers Best_Practices|
|2019.10.22|//Microsoft//|[[Users can now check their sign-in history for unusual activity|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Users-can-now-check-their-sign-in-history-for-unusual-activity/ba-p/916066]]|AzureAD|
|2019.10.22|Security Week|[[New Azure AD Feature Detects Unauthorized Access Attempts|https://www.securityweek.com/new-azure-ad-feature-detects-unauthorized-access-attempts]]|AzureAD|
|2019.10.22|//Security Discovery//|[[Religious Website and Software Provider Leaks Customer and Credit Card Data for Many Months|https://securitydiscovery.com/cloversites/]]|DataLeak ElasticSearch|
|2019.10.22|//Uptycs//|[[3 Cloud Computing Security Issues & How To Get Them Under Control|https://www.uptycs.com/blog/cloud-computing-and-security]]|Misc|
|>|>|>|!2019.10.21|
|2019.10.21|CIGREF[>img[iCSF/flag_fr.png]]|[[Cloud de confiance : les entreprises membres du Cigref proposent à l'État leur collaboration|https://www.cigref.fr/cloud-de-confiance-entreprises-membres-du-cigref-proposent-a-etat-leur-collaboration]]|Sovereign_Cloud|
|2019.10.21|(ISC)2|[[PCI Compliance in AWS - Simplified|https://blog.isc2.org/isc2_blog/2019/10/pci-compliance-in-aws-simplified.html]]|AWS PCI_DSS|
|2019.10.21|DZone|[[Designing Your First App in Kubernetes: A Summary|https://dzone.com/articles/designing-your-first-app-in-kubernetes-a-summary]]|Kubernetes|
|2019.10.21|VPNmentor|[[Report: Travel Reservations Platform Leaks US Government Personnel Data|https://www.vpnmentor.com/blog/us-travel-military-leak/]]|Data_Leaks ElasticSearch|
|2019.10.21|ZDnet| → [[Open database leaked 179GB in customer, US government, and military records|https://www.zdnet.com/article/autoclerk-database-leaked-customer-government-and-military-personal-records/]]|Data_Leaks ElasticSearch|
|2019.10.22|InfoSecurity Mag| → [[US Military Personnel Exposed in Latest Cloud Data Leak|https://www.infosecurity-magazine.com/news/military-personnel-exposed-latest/]]|Data_Leaks ElasticSearch|
|2019.10.22|DataBreach Today| → [[Unsecure Database Exposed US Military Personnel Data: Report - Exposed Database Owned by AutoClerk Hotel Reservation Management System|https://www.databreachtoday.co.uk/unsecure-database-exposed-us-military-personnel-data-report-a-13280]]|Data_Leaks ElasticSearch|
|2019.10.22|The Register| → [[Messed Western: Vuln hunters say hotel giant's Autoclerk code exposed US soldiers' info, travel plans, passwords|https://www.theregister.co.uk/2019/10/22/autoclerk_army_data/]]|Data_Leaks ElasticSearch|
|2019.10.21|InfoSec Institute|[[Lessons learned: The Capital One breach|https://resources.infosecinstitute.com/lessons-learned-the-capital-one-breach/]]|CapitalOne|
|2019.10.21|CSO|[[Top cloud security controls you should be using|https://www.csoonline.com/article/3208905/top-cloud-security-controls-you-should-be-using.html]]|Controls|
|2019.10.21|CRN AU|[[Senate pushes fix to allow US access to local clouds|https://www.crn.com.au/news/senate-pushes-fix-to-allow-us-access-to-local-clouds-532613]]|CLOUD_Act|
|2019.10.21|//Heimdal//|[[New Microsoft Phishing Campaign Targets Office365 Users|https://heimdalsecurity.com/blog/new-microsoft-phishing-campaign-targets-office365-users/]]|O365 Phishing|
|2019.10.21|//Microsoft//|[[Unverified Sender|https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/unverified-sender-feature]]|O365 Mail|
|2019.10.21|Bleeping Computer| → [[Office 365 Now Warns About Suspicious Emails with Unverified Senders|https://www.bleepingcomputer.com/news/microsoft/office-365-now-warns-about-suspicious-emails-with-unverified-senders/]]|O365 Mail|
|2019.10.21|//eXemplify//|[[Why There May Be Room for Cloud Solutions in Your Compliance Strategy|http://www.exemplifygroup.com/why-there-may-be-room-for-cloud-solutions-in-your-compliance-strategy/]]|Compliance|
|2019.10.21|//Efficient IP//|[[Cloud to the Edge Brings IP Space Complexity|https://www.efficientip.com/cloud-edge/]]|Misc|
|2019.10.21|//Microsoft//|[[Run a disaster recovery drill for Azure VMs to a secondary Azure region|https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-dr-drill]]|Azure DRP|
[>img(150px,auto)[iCSF/MITRE.png]]Début octobre 2019, le [[MITRE]] a publié une extension du cadre ''MITRE ATT&CK'' pour le Cloud.

Ainsi, 36 techniques ont été ajoutées ou mises à jour pour couvrir le comportement d'attaquants contre les plates-formes Cloud.
Le ''MITRE ATT&CK Cloud'' est ainsi décliné pour :
* les plates-formes IaaS : Amazon Web Services (AWS), Microsoft Azure (Azure) et Google Cloud Platform (GCP)
* les plates-formes SaaS
* deux environnements plus spécifiques : Azure Active Directory (Azure AD) et Office 365

A noter :[>img(auto,50px)[iCSF/MITRE_ATTACK.png]]
* La matrice ''ATT&CK Cloud'' et ses déclinaisons peuvent être prises en compte séparément du reste de la matrice ''ATT&CK Enterprise''.
* La définition du mouvement latéral a été étendue afin d'intégrer l'accès et l'interaction avec le Cloud.
* La liste actuelle des plates-formes cloud sera étendue dans le courant de l'année prochaine.

Les différents élements sont les suivants :
* MITRE ATT&CK +++*[»]> <<tiddler [[MITRE ATTACK]]>>=== 
* MITRE ATT&CK Cloud +++*[»]> <<tiddler [[MITRE ATTACK Cloud]]>>=== 
* MITRE ATT&CK Cloud IaaS +++*[»]> <<tiddler [[MITRE ATTACK Cloud IaaS]]>>=== 
* MITRE ATT&CK Cloud SaaS +++*[»]> <<tiddler [[MITRE ATTACK Cloud SaaS]]>>=== 
* MITRE ATT&CK Cloud AzureAD +++*[»]> <<tiddler [[MITRE ATTACK Cloud AzureAD]]>>=== 
* MITRE ATT&CK Cloud O365 +++*[»]> <<tiddler [[MITRE ATTACK Cloud O365]]>>=== 

Lien → https://attack.mitre.org/matrices/enterprise/cloud/
[img(400px,2px)[iCSF/BluePixel.gif]]
[>img(300px,auto)[iCSA/JBICE.jpg]]__"''Cloud Security Alliance 2019 EMEA Congress Adds Focus on Risk Governance and European Cloud Certification Enablement''"__
Quelques précisions sur 2 sessions du prochain [[Congrès CSA EMEA|2019.11.20 - CSA Congress EMEA 2019 - Berlin]] qui se déroulera du 18 au 21 novembre 2019 à Berlin.
<<<
//__William Ochs, Rolf Becker will share insight from 60 years combined experience in banking and cybersecurity risks__
Berlin, Germany – Oct. 24, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today announced additions to its speaker line-up and session highlights for its [[upcoming CSA EMEA Congress (Berlin, Nov. 18-21, 2019)|2019.11.20 - CSA Congress EMEA 2019 - Berlin]]. Rolf Becker, Cloud Business Office Risk Governance, UBS Business Solutions AG, and Prof. William Ochs, EMEA Cloud Certification Enablement Manager for Cisco and co-chair of CSP CERT, will bring the issues surrounding risk governance and cloud certification enablement to the forefront, sharing their expertise after 30 years each in banking and cybersecurity, respectively. Registration is now open with special discounts being offered through November 1.

Those attending the [[2019 CSA EMEA Congress|2019.11.20 - CSA Congress EMEA 2019 - Berlin]] will also be privy to the inside scoop from some of the top cloud security media, learning about the elements behind a breaking story, research required, the missing pieces, challenges and how journalists might re-write the story over again.

"CSA has led the industry in research and development of best practices surrounding the General Data Protection Regulation (GDPR) and how it relates to cloud security. This year's ''CSA EMEA Congress'' will continue to build on lessons learned 18 months after GDPR's implementation as part of our ongoing mission to help both customers and cloud providers navigate the confluence of security, privacy, governance and compliance," said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance.

Focusing on two tracks — ''Cloud Privacy, Governance, and Compliance'' and ''Best Practices in Cybersecurity'' — attendees will have the chance to hear from some of the leading cloud and privacy thought leaders and policy makers.

The following panels and speakers have been added to the agenda:
* ''The European Cloud Certification Scheme: Forward Together''. Presenter: Prof. William Ochs, EMEA Cloud Certification Enablement Manager, Cisco and co-chair of CSP CERT.
** This session will review the origins of the European-wide Cloud Certification scheme, its security levels, and provide participants with both the current state of codification efforts and a picture of the next steps currently underway within both ENISA and the EU Commission. Alignment of the certification, with respect to CSA, will also be discussed. Participants will be prepared with a current understanding of CSPCERT's recommended steps for the EU Commission and ENISA, whom are key EU stakeholders with respect to cloud security certification strategies.
* ''Risk Governance on Cloud Adoption and Information Security in a Tightly Regulated Environment''. Presenter: Rolf Becker, UBS Business Solutions AG, Cloud Business Office Risk Governance.
** Cloud adoption is an enabler for efficiency, scalability, flexibility, and survival critical in a rapidly changing business environment. Attendees will learn how risk governance is an enabler for cloud adoption within highly regulated industries, such as financial services, and how it simultaneously helps organizations comply with regulatory and client demands for transparency and control.
* Panel: ''Press Perception of Cloud Technology''.
** With increased security threats to cloud technology and services quickly demanding the attention and reporting from the nation's top media, there is a lot to translate and comprehend to understand this highly complex and technical industry. In this session, some of the most credible and knowledgeable media in cloud reporting come together for a friendly discussion on cloud reporting greatness, grief and grunts. They'll pull back the curtain on some of their most recent reporting to help the audience understand the elements behind a breaking story, research required, the missing pieces, challenges and how they might re-write the story all over again. Attendees will also get a sneak peek into stories in development for the next cloud news item.
//
<<<
Pour en savoir plus et s'incrire :
* Annonce → ''[[CloudSecurityAlliance.fr/go/jaoa/|https://cloudsecurityalliance.fr/go/jaoa/]]''
* Détails et inscription → ''[[CloudSecurityAlliance.fr/go/jBjE/|https://cloudsecurityalliance.fr/go/jBjE/]]''
!"//Corporate Contractors and the Requirement for Zero-Trust Network Access//"
[>img(150px,auto)[iCSA/JALBC.jpg]]Article de blog publié le 21 octobre 2019 — Rédigé par Etay Bogner, VP, Zero-Trust Products Proofpoint, auparavant PDG de Meta Networks
<<<
//It's not a stretch to say that most industries and organizations today have contractors in the mix who need remote access to the company's network. Yet the traditional virtual private network (VPN) method of enabling access for corporate contractors — as well as other third parties such as vendors, partners, and customers — has a key flaw. The VPN model, by design, requires companies to place excessive trust in every contractor and third party who taps into the network, when a "zero trust" approach is really what's needed.

What I mean by that is that contractors generally only require access to specific applications on the network to conduct company business, not to have free reign over the whole enchilada. Companies take security risks by enabling their team of remote contractors to have excessive access. To limit those risks, IT administrators are wise to upgrade from a conventional VPN approach and adopting a software-defined perimeter (SDP) security model that enables the principles of zero-trust security. What it means to have zero-trust network access is that the solution not only provides segmented access for every user, but also verifies and audits that access.

Here's an example of what this might look like in practice if you have two remote contractors — let's call them A and B. With zero-trust SDP architecture, Remote Contractor A might have her access restricted to a single cloud-based application, as well as one application in the data center. Meanwhile, Remote Contractor B might only be able to access one application at headquarters. Neither Remote Contractor A nor Remote Contractor B are greenlighted to access the full corporate network/data center, but instead receive very finely grained access, as granted by IT, based on each manager's and/or department's project requirements.

As you can imagine, there are a number of clear benefits in providing zero-trust network access for all of your corporate contractors. Below is a summary of four of the key advantages:
# ''Risk reduction''. VPNs create a high-risk situation in terms of providing network access to remote contractors, as VPNs were not designed with this particular use case in mind. Alternatively, using a zero-trust SDP network allows for the creation of boundaries around any application based on identity and context. An SDP approach also allows an enterprise to ensure that each contractor's device follows a customized policy that's enforced. Meanwhile, any resources that a specific contractor is unauthorized to access remain invisible to the contractor, which reduces the surface for potential attacks.
# ''App-specific access, not full network access''. On a related note, the SDP allows your company to outline security policies at a granular level, associating specific remote contractors with the exact applications and/or services that they require. This is a huge security advantage compared to VPNs, which roll out free access to the entire corporate network. SDP can accomplish this goal easily since each contractor's user device can be assigned its own authenticated, unique identity, which then gets verified and authorized for every packet in real-time. Segmenting and securing access means that IT can designate each contractor the exact access he or she requires for a specific job to a limited subset of applications. This helps avoid potential security risks as mentioned above, as well as operational overhead.
# ''Easy management''. VPN configuration is notoriously complex, but an SDP approach allows for much simpler processes and management. You can use one cloud console to manage access policies for all enterprise resources in the cloud or data center. You can also easily tackle tasks like:
** Onboarding new remote contractors
** Assigning role-based policies
** Sending a link to enable remote contractors to access a specific application from their browser 
In particular, the onboarding of new contractors can be a real headache with a traditional VPN client, requiring annoying configuration issues and time-consuming troubleshooting, which can quickly become unsustainable if you're not managing contractors' devices. Fully onboarding a new remote contractor could potentially take days or even weeks in this circumstance, presenting impediments to your enterprise's ability to focus on key parts of your business. These distractions vanish when you switch to an SDP solution. # ''Superior experience for contractors''. No more VPN headaches for your remote contractors; SDP allows for a much more consistent and reliable experience with easy, transparent, worldwide access. The central management of a zero-trust network, which covers all of your applications and data, as well as all of your contractors and other third parties, assures not only granular security for the enterprise, but also a positive experience for users that will help improve retention of remote contractors. If you have a widely distributed workforce or work with remote contractors in any capacity, consider the above benefits when weighing whether to continue with a legacy-style VPN, or switch to an architecture that's user-centric and zero-trust. The latter offers secure, granular, controlled access to specific parts of your network or software platform and can be enforced consistently no matter where contractors are based or working — huge benefits in today's increasingly distributed work environment.// [...] <<< &rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jalb/]] sur le blog de la CSA. &rArr; https://blog.cloudsecurityalliance.org/2019/10/21/corporate-contractors-and-the-requirement-for-zero-trust-network-access/
!1 - Les nouveautés CSA de la semaine du 14 au 20 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Introducing Reflexive Security for integrating security, development and operations''+++*[»]> <<tiddler [[2019.10.14 - Blog : 'Introducing Reflexive Security for integrating security, development and operations']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.10.20 - Veille Hebdomadaire]] avec plus de 50 liens :
* __''À lire'' :__ Document "''Trusted Cloud: Microsoft Azure security, privacy, compliance, resiliency, and protected IP''"+++*[»]>
|2019.10.16|//Microsoft Azure//|[[Trusted Cloud: security, privacy, compliance, resiliency, and IP|https://azure.microsoft.com/en-us/blog/trusted-cloud-security-privacy-compliance-resiliency-and-ip/]] ([[document|http://download.microsoft.com/download/1/6/0/160216AA-8445-480B-B60F-5C8EC8067FCA/WindowsAzure-SecurityPrivacyCompliance.pdf]])|Compliance Resilience|
=== 
* Alerte : malware ''Graboid'' visant des containers Docker+++*[»]>
|2019.10.16|//PaloAlto Networks//|![[Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub|https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/]]|Docker 
CryptoJacking
Attacks| |2019.10.16|Bleeping Computer| → [[Unsecured Docker Hosts Attacked by New Graboid Cryptojacking Worm|https://www.bleepingcomputer.com/news/security/unsecured-docker-hosts-attacked-by-new-graboid-cryptojacking-worm/]]|~| |2019.10.16|Dark reading| → [[Cryptojacking Worm Targets and Infects 2,000 Docker Hosts|https://www.darkreading.com/cloud/cryptojacking-worm-targets-and-infects-2000-docker-hosts/d/d-id/1336104]]|~| |2019.10.16|DataBreach Today| → [['Graboid' Cryptojacking Worm Spreads Through Containers|https://www.databreachtoday.com/graboid-crytopjacking-worm-spreads-through-containers-a-13256]]|~| |2019.10.16|//Threatpost//| → [[Docker Containers Riddled with Graboid Crypto-Worm|https://threatpost.com/docker-containers-graboid-crypto-worm/149235/]]|~| ===, analyse de 2 vulnérabilités Kubernetes+++*[»]> |2019.10.16|//PaloAlto Networks//|![[Analysis of Two Newly Patched Kubernetes Vulnerabilities|https://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/]]|Kubernetes CVE-2019-11253 CVE-2019-16276| |2019.10.16|//Threatpost//| → [[Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS|https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/]]|Kubernetes CVE-2019-11253 CVE-2019-16276| === * Pannes : authentification O365 (18 oct.)+++*[»]> |2019.10.18|Bleeping Computer|[[Microsoft 365 Authentication Outage, Users Unable to Login|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-authentication-outage-users-unable-to-login/]]|Outage
O365| |2019.10.18|//Microsoft//| → [[Admins who are unable to access the admin center can find updates on the MFA outage MO193431 through status.office.com|https://mobile.twitter.com/MSFT365Status/status/1185211082941648897]]|~| |2019.10.18|Redmond Channel Partner| → [[Azure AD Outage Linked to Multifactor Authentication Issues|https://rcpmag.com/articles/2019/10/18/azure-ad-outage-linked-to-mfa.aspx]]|~| |2019.10.25|The Register| → [[You're flowing it wrong: Bad network route between Microsoft, Apple blamed for Azure, O365 MFA outage|https://www.theregister.co.uk/2019/10/25/microsoft_outage_explainer/]]|~| === * Divers : Cloud Souverain et "Cloud de Confiance", sécurisation de containers Docker !3 - Conférences et Salons * Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible : ** Premier teaser et inscription gratuite+++*[»]> <<tiddler [[2019.10.11 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (1/3)]]>>=== ** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== * Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== ** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]===
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.19|
|2019.10.19|//JumpCloud//|[[Top Cloud Directory Service|https://jumpcloud.com/blog/top-cloud-directory-service/]]|Directories|
|>|>|>|!2019.10.18|
|2019.10.18|Bleeping Computer|[[Microsoft 365 Authentication Outage, Users Unable to Login|https://www.bleepingcomputer.com/news/microsoft/microsoft-365-authentication-outage-users-unable-to-login/]]|Outage O365|
|2019.10.18|//Microsoft//| → [[Admins who are unable to access the admin center can find updates on the MFA outage MO193431 through status.office.com|https://mobile.twitter.com/MSFT365Status/status/1185211082941648897]]|Outage O365|
|2019.10.18|Redmond Channel Partner| → [[Azure AD Outage Linked to Multifactor Authentication Issues|https://rcpmag.com/articles/2019/10/18/azure-ad-outage-linked-to-mfa.aspx]]|Outage O365|
|2019.10.18|Security Boulevard|[[Hybrid Cloud's Impact on Financial Services Security|https://securityboulevard.com/2019/10/hybrid-clouds-impact-on-financial-services-security/]]|Misc|
|2019.10.18|JDSupra|[[Singapore Issues Guidelines on Personal Data Protection and Cloud Services|https://www.jdsupra.com/legalnews/singapore-issues-guidelines-on-personal-30298/]]|Singapore Regulations|
|2019.10.18|CBR Online|[[The Security Risks of Cloud Computing Start With You|https://www.cbronline.com/feature/security-risks-of-cloud-computin]]|Risks|
|2019.10.18|Container Journal|[[Multi-Cloud, Hybrid Cloud and Kubernetes|https://containerjournal.com/topics/container-ecosystems/multi-cloud-hybrid-cloud-and-kubernetes/]]|Kubernetes Hybrid_Cloud|
|>|>|>|!2019.10.17|
|2019.10.17|Anton Chuvakin|[[Move to Cloud: A Chance to Finally Transform Security?|https://medium.com/anton-on-security/move-to-cloud-a-chance-to-finally-transform-security-e9614aae4f9c]]|Misc|
|2019.10.17|Infosec Island|[[Myth Busters: How to Securely Migrate to the Cloud|http://www.infosecisland.com/blogview/25225-Myth-Busters-How-to-Securely-Migrate-to-the-Cloud.html]]|Migration|
|2019.10.17|Bleeping Computer|[[Microsoft Adds Azure AD Sign-In History to Detect Unusual Activity|https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-azure-ad-sign-in-history-to-detect-unusual-activity/]]|AzureAD Detection|
|2019.10.17|FedScoop|[[Pentagon developing JEDI cloud deployment security guidance|https://www.fedscoop.com/pentagon-jedi-security-guidance/]]|Government JEDI|
|2019.10.17|Solutions Review|[[8 Cloud Security Questions Your Business Needs to Ask|https://solutionsreview.com/cloud-platforms/8-cloud-security-questions-your-business-needs-to-ask/]]|Misc|
|2019.10.17|//Managed Methods//|[[5 Ways To Detect A Cloud Account Takeover|https://managedmethods.com/blog/5-ways-to-detect-a-cloud-account-takeover/]]|Detection|
|2019.10.17|//Panda Security//|[[48% of corporate data is now stored on the cloud|https://www.pandasecurity.com/mediacenter/security/cloud-security-encryption/]]|Storage|
|2019.10.17|//Radware//|[[Radware Unveils WAF for Kubernetes|https://containerjournal.com/topics/container-security/radware-unveils-waf-for-kubernetes/]]|Kubernetes WAF|
|2019.10.17|//CompareTheCloud|//|[[6 Pros and Cons of Cloud Storage for Business|https://www.comparethecloud.net/articles/6-pros-and-cons-of-cloud-storage-for-business/]]|Storage|
|2019.10.17|//Google Cloud//|[[Best practices for a more secure login in Google Cloud|https://cloud.google.com/blog/products/identity-security/best-practices-for-a-more-secure-login-in-google-cloud]]|GCP Authentication|
|2019.10.17|//AWS//|![[Denial of Service Attack Mitigation on AWS|https://aws.amazon.com/answers/networking/aws-ddos-attack-mitigation/]]|AWS DDoS Mitigation|
|>|>|>|!2019.10.16|
|2019.10.16|Sky News|[[Job applicants worried as hundreds of thousands of CVs exposed online|https://news.sky.com/story/job-applicants-worried-as-hundreds-of-thousands-of-cvs-exposed-online-11836935]]|DataBreach AWS Misconfiguration|
|2019.10.17|SiliconAngle| → [[250,000 resumes exposed in latest case of misconfigured cloud storage|https://siliconangle.com/2019/10/17/250000-resumes-exposed-latest-case-misconfigured-aws-cloud-storage/]]|DataBreach AWS Misconfiguration|
|2019.10.17|SC Magazine| → [[Open AWS buckets expose more than 200K CVs at two online recruitment firms|https://www.scmagazine.com/home/security-news/cloud-security/open-aws-buckets-expose-more-than-200k-cvs-at-two-online-recruitment-firms/]]|DataBreach AWS Misconfiguration|
|2019.10.16|Open Web Foundation|[[Rudr: A Kubernetes implementation of the Open Application Model specification|https://github.com/oam-dev/rudr]]|Kubernetes Tools|
|2019.10.16|Open Web Foundation| → [[Open Application Model|https://openappmodel.io/]]|Kubernetes Tools|
|2019.10.17|//Alibaba Cloud//| → [[Announcing the Open Application Model (OAM), an Open Standard for Developing and Operating Applications on Kubernetes and Other Platforms|https://medium.com/@Alibaba_Cloud/announcing-the-open-application-model-oam-an-open-standard-for-developing-and-operating-909c4fa16a6]]|Kubernetes Tools OAM|
|2019.10.16|CBR Online|[[Sovereign Cloud: Where in the World is Public Sector Data Stored?|https://www.cbronline.com/opinion/sovereign-cloud]]|Sovereign_Cloud|
|2019.10.16|//PaloAlto Networks//|![[Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub|https://unit42.paloaltonetworks.com/graboid-first-ever-cryptojacking-worm-found-in-images-on-docker-hub/]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|Bleeping Computer| → [[Unsecured Docker Hosts Attacked by New Graboid Cryptojacking Worm|https://www.bleepingcomputer.com/news/security/unsecured-docker-hosts-attacked-by-new-graboid-cryptojacking-worm/]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|Dark reading| → [[Cryptojacking Worm Targets and Infects 2,000 Docker Hosts|https://www.darkreading.com/cloud/cryptojacking-worm-targets-and-infects-2000-docker-hosts/d/d-id/1336104]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|DataBreach Today| → [['Graboid' Cryptojacking Worm Spreads Through Containers|https://www.databreachtoday.com/graboid-crytopjacking-worm-spreads-through-containers-a-13256]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|//Threatpost//| → [[Docker Containers Riddled with Graboid Crypto-Worm|https://threatpost.com/docker-containers-graboid-crypto-worm/149235/]]|Docker CryptoJacking Attacks Graboid|
|2019.10.16|//Tripwire//|[[Revisiting The Concepts of Disaster Recovery and Risk as Organizations Move Their Infrastructure To The Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/revisiting-the-concepts-of-disaster-recovery-and-risk-as-organizations-move-their-infrastructure-to-the-cloud/]]|DRP|
|2019.10.16|//PaloAlto Networks//|![[Analysis of Two Newly Patched Kubernetes Vulnerabilities|https://blog.paloaltonetworks.com/2019/10/cloud-kubernetes-vulnerabilities/]]|Kubernetes CVE-2019-11253 CVE-2019-16276|
|2019.10.16|//Threatpost//| → [[Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS|https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/]]|Kubernetes CVE-2019-11253 CVE-2019-16276|
|2019.10.16|//Microsoft Azure//|[[Trusted Cloud: security, privacy, compliance, resiliency, and IP|https://azure.microsoft.com/en-us/blog/trusted-cloud-security-privacy-compliance-resiliency-and-ip/]] ([[document|http://download.microsoft.com/download/1/6/0/160216AA-8445-480B-B60F-5C8EC8067FCA/WindowsAzure-SecurityPrivacyCompliance.pdf]])|Compliance Resilience|
|2019.10.16|//Forcepoint//|[[Exploring SaaS security best practices|https://www.forcepoint.com/blog/insights/exploring-saas-security-best-practices]]|Misc|
|>|>|>|!2019.10.15|
|2019.10.15|Ajay Kumar|[[How CASB Can Help Cloud Security Concerns?|https://medium.com/@intouchajay/how-casb-can-help-cloud-security-concerns-710b77941e19]]|CASB|
|2019.10.15|Security Week|![[Securing All Cloud Deployments With a Single Strategy|https://www.securityweek.com/securing-all-cloud-deployments-single-strategy]]|Strategy|
|2019.10.15|//AT&T Cybersecurity//|[[Security monitoring for managed cloud Kubernetes|https://www.alienvault.com/blogs/labs-research/security-monitoring-for-managed-cloud-kubernetes]]|Kubernetes Monitoring|
|2019.10.15|//CyberArk//|[[Keeping up with cloud threats|https://www.professionalsecurity.co.uk/products/cyber/keeping-up-with-cloud-threats/]]|Threats|
|>|>|>|!2019.10.14|
|2019.10.14|Les Echos[>img[iCSF/flag_fr.png]]|[[La France cherche son "cloud de confiance"|https://www.lesechos.fr/tech-medias/hightech/la-france-cherche-son-cloud-de-confiance-1139875]]|Sovereign_Cloud|
|2019.10.14|Wojciech|[[Fun with Amazon S3 - Leaks and bucket takeover attack|https://medium.com/@woj_ciech/fun-with-amazon-s3-leaks-and-bucket-takeover-attack-ddb17da1c431]]|AWS Data_Leaks S3|
|2019.10.14|0x00sec|![[Securing Docker Containers|https://0x00sec.org/t/securing-docker-containers/16913/1]]|Docker Best_Practices|
|2019.10.14|Infosec Institute|[[AWS vs. Azure vs. Cloud+: To specialize, generalize or both?|https://resources.infosecinstitute.com/aws-vs-azure-vs-cloud-plus/]]|Training Certification|
|2019.10.14|Dark Reading|[[When Using Cloud, Paranoia Can Pay Off|https://www.darkreading.com/cloud/when-using-cloud-paranoia-can-pay-off/d/d-id/1336075]]|Misc|
|2019.10.14|//Vera//|[[Mitigating Cloud Misconfiguration Risks to Your Data|https://vmblog.com/archive/2019/10/14/mitigating-cloud-misconfiguration-risks-to-your-data.aspx]]|Risks|
|2019.10.14|//JumpCloud//|[[GPOs "as-a-Service"|https://jumpcloud.com/blog/gpos-as-a-service/]]|GPO|
|2019.10.14|//Viruss//|[[Defining Cloud Security – Is It the Endpoint, Your Data, or the Environment?|http://www.viruss.eu/virus-news/defining-cloud-security-is-it-the-endpoint-your-data-or-the-environment/]]|Misc|
|2019.10.14|//Tripwire//|[[Private Cloud vs Public Cloud Security Challenges|https://www.tripwire.com/state-of-security/security-data-protection/cloud/private-public-cloud-security-challenges/]]|Challenges|
|2019.10.14|//Securosis//|[[Enterprise DevSecOps: Security Test Integration and Tooling|https://securosis.com/blog/enterprise-devsecops-security-test-integration-and-tooling]]|DevSecOps|
!"//Introducing Reflexive Security for integrating security, development and operations//"
[>img(150px,auto)[iCSA/JAEBI.jpg]]Article de blog publié le 14 octobre 2019 — Rédigé par le groupe de travail CSA DevSecOps
<<<
//Organizations today are confronted with spiraling compliance governance costs, a shortage of information security professionals, and a disconnect between strategic security and operational security. Due to these challenges, more and more companies value agility and integrated operations. In short, a security management program must now deliver more for less to match the needs of becoming cost efficient. 

How can organizations accomplish this task? In order to answer that question, CSA recently published a document defining ''Reflexive Security'', a new framework that addresses today's increasing risks and cybersecurity threats. 

[>img(250px,auto)[iCSA/J87PS.png]]__Information Security Management through Reflexive Security - Six Pillars in the Integration of Security, Development and Operations__+++*[»]> <<tiddler [[2019.08.07 - Publication : 'Six Pillars of DevSecOps']]>>=== 
This document provides a flexible framework that: 
* Focuses on collaboration and integration 
* Is outcome-oriented 
* Provides a "reflexive" response to risks. 

The word "Reflexive" comes from the reflexive relation in mathematical sets, where every element in such a relation is related to itself. In Reflexive Security, every action taken is related to the context of the security at hand and needs of the organization itself. 

__Reflexive Security versus ISMS__
While the information security management system (ISMS) approach is well-defined by the International Standard ISO/IEC 27001, organizations who thrive with agile development or other collaborative-oriented processes have found it valuable to use the Reflexive Security framework. They value it for its non-prescriptive, holistic, needs-based, and interactive approach, especially with their existing activities that are already tightly-integrated. 

Reflexive Security builds on the examples from Agile development and DevOps movements, and is solely focused on a collaborative and integrated environment. It is especially suited for cloud environments, which are crucial for facilitating efficiencies for development and operation teams. Compared to the ISMS approach, Reflexive Security is like using Agile software development versus the Waterfall mindset. 

Reflexive Security also emphasizes security across organizational roles that reacts to external and internal threats. Similar to the body's immune system, Reflexive Security values the balance of decentralization and centralization over a top-down leadership approach. This is so responsibilities and activities of information security management are infused to all members of the organization. 

The document describes the core principles of Reflexive Security in "Six Pillars," which leads to the "Six Benefits," and also explores a number of strategies for the fulfillment of this framework. 

__The Six Pillars of Reflexive Security (abbreviated as "RAMPAC"):__
* ''Responsible collectively'': Security leadership plays a shepherding role for information security within an organization; everyone is responsible for an organization's security.
* ''Pragmatic'': Security should provide value, not a hindrance.
* ''Align and bridge'': Organizational risks and requirements must be fully aligned in order to derive maximum effectiveness and value from security processes.
* ''Automate'': Automated security practices are the core of optimizing process efficiency.
* ''Measure and improve'': Performance that cannot be measured cannot be improved.
* ''Collaborate and integrate'': Arguably the most important Pillar. Security can only be achieved through collaboration, not confrontation. A security-aware and collaborative culture is necessary for everyone to feel comfortable reporting potential anomalies. 

__The Six Benefits of Reflexive Security:__
* ''Human-centric'': Security is integrated and internalized as an aspect of everyone's work, and requires mind-share within every employee.
* ''Elastic'': Growing maturity of a Reflexive Security approach could lead to achievement of formal ISMS requirements, while being flexible enough to only target critical areas for maximum value based on actual risks.
* ''Apt and holistic'': Focused on business needs and responding to the actual risk context faced by the organization when compared to traditional information security management.
* ''Resilient'': Security no longer relies on a single security function, but security practices are integrated with business processes and embedded throughout the organization. 
* ''Tailored'': Prioritized approach to provision stronger protection to core or more vulnerable processes over those less exploitable. 
* ''Dynamic'': The protection of business goals is performed by integrating security with business processes, allowing the organization to react faster and more effectively to threats and incidents. 

__Key Takeaways__
Reflexive Security is an information security management strategy that is dynamic, interactive, holistic, and effective. It represents cultural practices extrapolated from existing collaborative concepts and practices, and provides a set of widely implicating and easily understandable principles that affect an organization's cybersecurity posture. This approach is especially suitable for organizations operating under resource and personnel constraints in today's fast-paced and challenging cybersecurity landscape.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jaeb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 7 au 13 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Cloud Penetration Testing the Capital One Breach''+++*[»]> <<tiddler [[2019.10.10 - Blog : 'Cloud Penetration Testing the Capital One Breach']]>>=== 
* Blog : ''It's all about the Data! – Preventative Security''+++*[»]> <<tiddler [[2019.10.08 - Blog : 'It's all about the Data! – Preventative Security']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.10.13 - Veille Hebdomadaire]] avec plus de 70 liens :
* __''À consulter'' :__ "Azure Benchmark" du CIS+++*[»]> 
|2019.10.10|//Microsoft//|[[CIS Azure Security Foundations Benchmark open for comment|https://azure.microsoft.com/en-us/blog/cis-azure-security-foundations-benchmark-open-for-comment/]] ([[draft|https://azure.microsoft.com/mediahandler/files/resourcefiles/azure-cloud-security-benchmark-draft/azure-cloud-security-benchmark-draft.pdf]])|Azure CIS_Benchmark|
|2019.10.10|Center for Internet Security| → [[CIS Microsoft Azure Foundations Benchmark v1.0.0 Now Available|https://www.cisecurity.org/blog/cis-microsoft-azure-foundations-benchmark-v1-0-0-now-available/]] ([[téléchargement|https://www.cisecurity.org/benchmark/azure/]])|Azure CIS_Benchmark|
=== 
* Sécurité des Managed Service Providers : un appel à commentaires sur un document du ''NIST'' et quelques pistes d'amélioration par MalwareBytes
* Rapports et sondages : FireEye, Thales
* Divers : CLOUD Act en Australie et en Suisse, réduction de la surface d'attaque
!3 - Conférences et Salons
* Le programme de la ''Cloud & Cyber Security Expo'' des ''27 et 28 novembre'' à Paris est partiellement disponible :
** Premier teaser et inscription gratuite+++*[»]> <<tiddler [[2019.10.11 - Actu : Cloud & Cyber Security Expo - Inscription et Extrait du Programme (1/3)]]>>=== 
** Animation d'une table ronde sur la ''Cyber-Résilence dans le Cloud''+++*[»]> <<tiddler [[2019.10.07 - Actu : Cloud & Cyber Security Expo les 27 et 28 novembre 2019]]>>=== 
* Les inscriptions pour le ''Congrès Européen'' des ''18 au 21 novembre'' à Berlin sont toujours ouverte+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
** Contactez-nous pour avoir une réduction sur votre inscription.+++*[»]> → [img(200px,auto)[iCSF/Email-CSA_FR.png]]=== 
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.12|
|2019.10.12|CyberDefense Mag|[[What Can You Do To Secure Your Data In The Cloud?|https://www.cyberdefensemagazine.com/what-can-you-do/]]|Risks|
|2019.10.12|//BitDefender//|[[Organizations Fail to Implement Cloud Security Basics - And it Bites Them|https://businessinsights.bitdefender.com/organizations-fail-to-implement-cloud-security-basics]]|Threats Guidance|
|>|>|>|!2019.10.11|
|2019.10.11|Security Boulevard|[[The Progression to Cloud Directory Services|https://securityboulevard.com/2019/10/the-progression-to-cloud-directory-services/]]|Directories|
|2019.10.11|Silicon Republic|[[AWS's Abby Fuller on balancing progress with security|https://www.siliconrepublic.com/enterprise/abby-fuller-amazon-web-services-cloud]]|Misc|
|2019.10.11|//Duo Security//|![[Imperva Breach Stemmed From Compromised Internal Compute Instance|https://duo.com/decipher/imperva-breach-stemmed-from-compromised-internal-compute-instance]]|DataBreach Imperva Analysis|
|2019.10.11|//MalwareBytes//|![[Securing the managed service provider (MSP)|https://blog.malwarebytes.com/business-2/2019/10/securing-the-managed-service-provider-msp/]]|MSP|
|>|>|>|!2019.10.10|
|2019.10.11|DZone|[[Top 5 Security Practices for AWS Backup|https://dzone.com/articles/top-5-security-practices-for-aws-backup]]|AWS Backups|
|2019.10.11|//OVHcloud//|[[Looking Back at OVHCloud Summit 2019|https://www.ovh.com/blog/looking-back-at-ovhcloud-summit-2019/]]|OVHcloud|
|2019.10.10|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[OVH affirme son identité cloud et joue l'alternative de confiance|https://www.silicon.fr/ovh-cloud-confiance-263407.html]]|OVHcloud|
|>|>|>|!2019.10.10|
|2019.10.10|AllNews.ch[>img[iCSF/flag_fr.png]]|[[CLOUD Act américain: l'ASB demande des clarifications|https://www.allnews.ch/content/r%C3%A9glementation/cloud-act-am%C3%A9ricain-l%E2%80%99asb-demande-des-clarifications]]|CLOUD_Act Switzerland|
|2019.10.10|Dark Reading|[[Network Security Must Transition into the Cloud Era|https://www.darkreading.com/cloud/network-security-must-transition-into-the-cloud-era/a/d-id/1335978]]|Networking|
|2019.10.10|nixCraft|[[Set Up a Basic Iptables Firewall on Amazon Linux AMI|https://www.cyberciti.biz/faq/set-up-a-basic-iptables-firewall-on-amazon-linux-ami/]]|AWS AMI Firewall|
|2019.10.10|MyLastWatchdog|[[CASBs help companies meet 'shared responsibility' for complex, rising cloud risks|https://www.lastwatchdog.com/my-take-casbs-help-companies-meet-shared-responsibility-for-complex-rising-cloud-risks/]]|CASB Shared_Responsibility|
|2019.10.10|CBR Online|![[Does Containerisation Spell the End for Virtualisation?|https://www.cbronline.com/news/kubernetes-and-containerisation]]|Kubernetes Containers|
|2019.10.10|Cloud Native Computing Foundation|[[How to make containers an architect's best friend|
|2019.10.10|Open Access Government|[[Top five areas of focus for CISOs when it comes to the cloud and cybersecurity|https://www.openaccessgovernment.org/cisos-cloud-and-cybersecurity/75363/]]|Guidance|
|2019.10.10|//Microsoft Azure//|[[16 new built-in roles - including Global reader - now available in preview|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/16-new-built-in-roles-including-Global-reader-now-available-in/ba-p/900749]]|AzureAD|
|2019.10.11|Bleeping Computer| → [[Microsoft Improves Azure Active Directory Security with New Roles|https://www.bleepingcomputer.com/news/microsoft/microsoft-improves-azure-active-directory-security-with-new-roles/]]|AzureAD|
|2019.10.10|//Managed Methods//|[[How Cloud DLP Fits Into Your Cybersecurity Infrastructure|https://managedmethods.com/blog/cloud-dlp-your-cybersecurity-infrastructure/]]|DLP|
|2019.10.10|//eXemplify//|[[The 4 Industries That Get the Most Out of Cloud Security|http://www.exemplifygroup.com/the-4-industries-that-get-the-most-out-of-cloud-security/]] (infographie)|Misc|
|2019.10.10|//CloudCheckr//|[[Why the Best Financial Services Are Turning to the Cloud for Risk Management|https://cloudcheckr.com/cloud-cost-management/why-the-best-financial-services-are-turning-to-the-cloud-for-risk-management/]]|Risks|
|2019.10.10|//Alibaba Cloud//|[[Building a Serverless Application on Alibaba Cloud (Part 1)|https://medium.com/@Alibaba_Cloud/building-a-serverless-application-on-alibaba-cloud-part-1-91a439e5a949]] (1/2)|Alibaba Serverless|
|2019.10.10|//Alibaba Cloud//|[[Building a Serverless Application on Alibaba Cloud (Part 2)|https://medium.com/@Alibaba_Cloud/building-a-serverless-application-on-alibaba-cloud-part-2-d710e722cf8e]] (2/2)|Alibaba Serverless|
|2019.10.10|//Threatstack//|[[20 DevSecOps Pros Reveal the Most Important Considerations in Building a DevSecOps Pipeline|https://www.threatstack.com/blog/20-devsecops-pros-reveal-the-most-important-considerations-in-building-a-devsecops-pipeline]]|DevSecOps|
|2019.10.10|//Securosis//|[[Enterprise DevSecOps: How Security Works With Development|https://securosis.com/blog/enterprise-devsecops-how-security-works-with-development]]|DevSecOps|
|2019.10.10|//Cloudbric//|[[A Guide to PCI Compliance in the Cloud|https://www.cloudbric.com/blog/2019/10/pci-compliance-cloud-guide/]]|PCI_DSS Compliance|
|2019.10.10|//Microsoft//|[[CIS Azure Security Foundations Benchmark open for comment|https://azure.microsoft.com/en-us/blog/cis-azure-security-foundations-benchmark-open-for-comment/]] ([[draft|https://azure.microsoft.com/mediahandler/files/resourcefiles/azure-cloud-security-benchmark-draft/azure-cloud-security-benchmark-draft.pdf]])|Azure CIS_Benchmark|
|2019.10.10|Center for Internet Security| → [[CIS Microsoft Azure Foundations Benchmark v1.0.0 Now Available|https://www.cisecurity.org/blog/cis-microsoft-azure-foundations-benchmark-v1-0-0-now-available/]] ([[téléchargement|https://www.cisecurity.org/benchmark/azure/]])|Azure CIS_Benchmark|
|2019.10.10|//ExtraHop//|[[Boost Your Security in AWS|https://www.extrahop.com/company/blog/2019/essential-aws-security-features-to-know/]]|AWS|
|>|>|>|!2019.10.09|
|2019.10.09|Bleeping Computer|[[Beware of Fake Amazon AWS Suspension Emails for Unpaid Bills|https://www.bleepingcomputer.com/news/security/beware-of-fake-amazon-aws-suspension-emails-for-unpaid-bills/]]|AWS Phishing|
|2019.10.09|CyberSecurity Insiders|[[Cloud Security breach leads to a leak of 957,000 patient records|https://www.cybersecurity-insiders.com/cloud-security-breach-leads-to-a-leak-of-957000-patient-records/]]|Data_Breaches Misconfigurations|
|2019.10.09|DevOps.com|[[Common Cloud Security Mistakes and How to Avoid Them|https://devops.com/common-cloud-security-mistakes-and-how-to-avoid-them/]]|Risks Guidance|
|2019.10.09|Container Journal|[[Demystifying Persistent Storage Myths for Stateful Workloads in Kubernetes|https://containerjournal.com/topics/container-networking/demystifying-persistent-storage-myths-for-stateful-workloads-in-kubernetes/]]|Persistence Kubernetes|
|2019.10.09|The Register|[[US charges Singapore coin miner with conning cloud firms out of compute time|https://www.theregister.co.uk/2019/10/09/singapore_coin_miner_charged/]]|CryptoMining|
|2019.10.09|//Rapid7//|![[Avoiding the Zombie Cloud Apocalypse: How to Reduce Exposure in the Cloud|https://blog.rapid7.com/2019/10/09/avoiding-the-zombie-cloud-apocalypse-how-to-reduce-exposure-in-the-cloud/]]|Zombies|
|2019.10.09|//Kaspersky//|[[Protecting public clouds from common vulnerabilities|https://www.kaspersky.com/blog/vulnerabilities-in-public-clouds/28905/]]|Public_Cloud RDP SSH|
|2019.10.09|//Alibaba Cloud//|[[SSH Tunnelling With Alibaba Cloud To Expose A Local Environment|https://medium.com/@Alibaba_Cloud/ssh-tunnelling-with-alibaba-cloud-to-expose-a-local-environment-7dccfeabc5a6]]|Alibaba SSH|
|>|>|>|!2019.10.08|
|2019.10.08|Silicon.fr[>img[iCSF/flag_fr.png]]|![[Cloud souverain : quels candidats pour les trois contrats|https://www.silicon.fr/cloud-souverain-candidats-263205.html]]|Sovereign_Cloud|
|2019.10.08|NIST|![[Improving Cybersecurity of Managed Service Providers|https://www.nccoe.nist.gov/projects/building-blocks/managed-service-providers]] ([[draft|https://www.nccoe.nist.gov/sites/default/files/library/project-descriptions/msp-ic-project-description-draft.pdf]], [[commentaires|https://www.nccoe.nist.gov/sites/default/files/library/msp-comments.xlsx]])|NIST MSP|
|2019.10.09|MSSP Alerts| → [[MSP Cybersecurity Initiative: NIST, NCCoE Seek Comments|https://www.msspalert.com/cybersecurity-news/msp-cybersecurity-initiative-nist-nccoe-seek-comments/]]|NIST MSP|
|2019.10.08|RIPE|[[Internet Clouds are (also) Unpredictable: A Study on the Effects of Recent Traffic Engineering Trends In Cloud Provider Networks|https://labs.ripe.net/Members/marco_chiesa/internet-clouds-are-also-unpredictable]]|Networking Latency|
|2019.10.08|Security Week|[[Cloud is Creating Security and Network Convergence|https://www.securityweek.com/cloud-creating-security-and-network-convergence]]|Misc|
|2019.10.08|Marcel Afrahim|[[Sesame Street Store & Volusion customers are comprised; how the cookie monster is stealing credit card info|https://medium.com/@marcelx/sesame-street-volusion-customers-are-comprised-how-the-cookie-monster-is-stealing-cc-numbers-21eb51ec613b]]|Supply-Chain_Attack DataBreach GCP|
|2019.10.08|ZDnet| → [[Hackers breach Volusion and start collecting card details from thousands of sites|https://www.zdnet.com/article/hackers-breach-volusion-and-start-collecting-card-details-from-thousands-of-sites/]]|Supply-Chain_Attack DataBreach GCP|
|2019.10.08|Security Boulevard|[[Public Cloud Transformation: Keys to Data Security|https://securityboulevard.com/2019/10/public-cloud-transformation-keys-to-data-security/]]|Misc|
|2019.10.08|InformationAge|[[Cyber security for IoT and edge computing|https://www.information-age.com/cyber-security-for-iot-and-edge-computing-123485616/]]|IoT|
|2019.10.08|SecureCloudBlog|[[Advisories 1-2: Azure AD and Common WS-Trust MFA Bypass explained|https://securecloud.blog/2019/10/08/advisories-1-2-azure-ad-and-common-ws-trust-mfa-bypass-explained/]]|AzureAD Attack|
|2019.10.07|ITnews AU|[[Australia, US negotiate CLOUD Act data swap pact|https://www.itnews.com.au/news/australia-us-negotiate-cloud-act-data-swap-pact-532005]]|CLOUD_Act Australia|
|2019.10.08|HelpNet Security|[[Organizations need tools that support DevOps security|https://www.helpnetsecurity.com/2019/10/08/devops-security-tools/]]|Report Trendmicro|
|2019.10.08|NextGov|[[Do You Know What's Hiding in the Cloud?|https://www.nextgov.com/ideas/2019/10/do-you-know-whats-hiding-cloud/160442/]]|Misc|
|2019.10.08|//Threatpost//|[[Intimate Details on Healthcare Workers Exposed as Cloud Security Lags|https://threatpost.com/intimate-details-healthcare-workers-exposed-cloud-security/149007/]]|Risks|
|2019.10.08|//Thales//|![[Organizations worldwide failing to adequately protect sensitive data in the cloud|https://www.thalesesecurity.com/about-us/newsroom/news-releases/thales-study-organizations-worldwide-failing-adequately-protect]]|Report Thales|
|2019.10.08|//Thales//| → [[infographie '2019 Cloud Security Study|https://go.thalesesecurity.com/rs/480-LWA-970/images/2019-Ponemon-Cloud-Security-in.pdf]] et [[rapport '2019 Cloud Security Study|https://go.thalesesecurity.com/rs/480-LWA-970/images/2019-Cloud-Security-Report-sd.pdf]]|Report Thales|
|2019.10.08|Info Security Mag| → [[Global Study Finds Orgs Are Failing to Protect Data in the Cloud|https://www.infosecurity-magazine.com/news/orgs-failing-protect-data-cloud/]]|Report Thales|
|2019.10.08|VMblog| → [[Thales Study: Organizations Worldwide Failing to Adequately Protect Sensitive Data in the Cloud|https://vmblog.com/archive/2019/10/08/thales-study-organizations-worldwide-failing-to-adequately-protect-sensitive-data-in-the-cloud.aspx]]|Report Thales|
|2019.10.10|HelpNet Security| → [[Only 32% of organizations employ a security-first approach to cloud data storage|https://www.helpnetsecurity.com/2019/10/10/cloud-data-storage-security/]]|Report Thales|
|2019.10.08|//FireEye//|[[FireEye Email Threat Update: How Attackers are Getting Ahead in the Cloud|https://www.fireeye.com/blog/products-and-services/2019/10/how-attackers-are-getting-ahead-in-the-cloud.html]] ([[détails|https://www.fireeye.com/solutions/ex-email-security-products/power-of-one.html]])|Report FireEye Threats|
|2019.10.08|Security Week| → [[Email Attacks Using Cloud Services are Increasing|https://www.securityweek.com/email-attacks-using-cloud-services-are-increasing]]|Report FireEye Threats|
|2019.10.08|//LogRhythm//|[[Six Tips for Securing Your Azure Cloud Environment|https://logrhythm.com/six-tips-for-securing-your-azure-cloud-environment/]]|Azure Best_Practices|
|2019.10.08|//Gremlin//|![[After the Retrospective: Heroku Incident #1892|https://www.gremlin.com/blog/heroku-incident-1892/]]|Lessons_Learnt AWS Heroku|
|>|>|>|!2019.10.07|
|2019.10.07|Journal du Net[>img[iCSF/flag_fr.png]]|[[Stockage : mieux protéger ses données avec le modèle flash-to-flash-to-cloud|https://www.journaldunet.com/solutions/expert/71828/stockage---mieux-proteger-ses-donnees-avec-le-modele-flash-to-flash-to-cloud.shtml]]|Storage Flash|
|2019.10.07|ZDnet|[[Australia inches closer to compelling access to US data under CLOUD Act|https://www.zdnet.com/article/australia-inches-closer-to-compelling-access-to-us-data-under-cloud-act/]]|CLOUD_Act Australia|
|2019.10.07|Technopedia|[[How Cloud Computing is Changing Cybersecurity|https://www.techopedia.com/how-cloud-computing-is-changing-cybersecurity/2/33941]]|Challenges|
|2019.10.07|Maarten Goet|[[Azure Sentinel: designing access and authorizations that meet the enterprise needs|https://medium.com/wortell/azure-sentinel-designing-access-and-authorizations-that-meet-the-enterprise-needs-501bfdafaa5f]]|Azure Snetinel|
|2019.10.07|DZone|![[The Complete Kubernetes Collection [Tutorials and Tools]|https://dzone.com/articles/the-complete-kubernetes-collection-tutorials-and-tools]]|Kubernetes Tools Tutorials|
|2019.10.07|Solutions review|[[5 Tips for Designing a Flawless Cloud Security Policy|https://solutionsreview.com/cloud-platforms/5-tips-for-designing-a-flawless-cloud-security-policy/]]|Security_Policy|
|2019.10.07|Darknet.org.uk|[[LambdaGuard - AWS Lambda Serverless Security Scanner|https://www.darknet.org.uk/2019/10/lambdaguard-aws-lambda-serverless-security-scanner/]]|Tools LambdaGuard|
|2019.10.07|//Trendmicro//|[[Trend Micro Survey Finds Lack of IT Security Input In DevOps Introduces Cyber Risk for 72% of Companies|https://devops.com/trend-micro-survey-finds-lack-of-it-security-input-in-devops-introduces-cyber-risk-for-72-of-companies/]]|Report Trendmicro|
|2019.10.07|//Microsoft Azure//|[[Customer Provided Keys with Azure Storage Service Encryption|https://azure.microsoft.com/en-us/blog/customer-provided-keys-with-azure-storage-service-encryption/]]|Azure Encryption|
|2019.10.07|//Alcide//|[[Cloud-native applications need a unified continuous security approach|https://www.helpnetsecurity.com/2019/10/07/cloud-native-applications-security/]]|Misc|
|2019.10.07|//Zscaler//[>img[iCSF/flag_fr.png]]|[[L'avenir de la prévention contre la perte de données est dans le Cloud|http://www.globalsecuritymag.fr/L-avenir-de-la-prevention-contre,20191007,91390.html]]|DLP|
|2019.10.07|//ExtraHop//|[[Your Enterprise is Cloud-First. Is Your Security?|https://www.extrahop.com/company/blog/2019/cloud-native-security-infographic/]]|Survey|
[>img(200px,auto)[iCSF/CCSEP2019.png]]Pour s'inscrire à la ''Cloud & Cyber Security Expo'' et disposer une premier aperçu du programme des conférences gratuites :

Suivez le lien → ''[[CloudSecurityAlliance.fr/go/jabr|https://CloudSecurityAlliance.fr/go/jabr]]''

[img(auto,60px)[iCSF/CCSA19h.jpg][https://CloudSecurityAlliance.fr/go/jabr]]
!"//Cloud Penetration Testing the Capital One Breach//"
[>img(200px,auto)[iCSA/JAABC.jpg]]Article de blog publié le 10 octobre 2019 — Rédigé par Alexander Getsin, Lead Author for Cloud Penetration Testing Playbook
<<<
//''Aligning the Capital One breach with the CSA Cloud Penetration Testing Playbook''

In March 2019, Capital One suffered a unique cloud breach. 140,000 Social Security numbers and 80,000 linked bank account numbers were exposed, along with some 1 million Canadian Social Insurance Numbers. It isn't the numbers that make the breach special and worth learning about.

The initial point of compromise in this breach was a misconfigured proxy (modSecuritymodProxy, a Web Application Firewall), employed by Capital One. The attacker used the misconfigured instance to steal credentials from the meta-data service of the cloud instance. This is arguably the first high-profile breach using this technique. Capital One had to deal with a novel attack that employed a cutting-edge technique exclusive to cloud environments. Despite their impressive efforts at cloud security, their chances were slim in this case.

Just a few months ago, the Cloud Security Alliance's (CSA) Top Threats Working Group published the +++*[Cloud Penetration Testing Playbook]> <<tiddler [[2019.07.12 - Publication : 'Cloud Penetration Testing Playbook']]>>===. This playbook identifies this very attack technique. The playbook also describes 94 other public cloud attack vectors, concerns, considerations and test cases for testing and attacking public cloud environments and systems.

''What was the Breach?''
The initial compromise technique employed in this breach was the abuse of a particular feature of a misconfigured proxy (a web application firewall) employed by Capital One. The nginx server hosting the web application firewall accepts web requests meant for backend applications, processes and fulfills or responds to them as a proxy does. This specific nginx misconfiguration allowed requests to the meta-data service at 169.254.169.254.

AWS infrastructure services and consumers use the meta-data service to store environment variables. Some of the many variables and data stored in the AWS meta-data service (similar to GCP and Azure) are the temporary STS credentials that allow the instance to assume any role that has been passed to it. Anyone familiar with curl or a proxy client (such as Burp proxy) can generate requests to this meta-data service if they have local access to the instance, or if the instance is misconfigured to serve web requests to its local meta-data service.

The latter was the case: the vulnerable nginx WAF proxied web requests to itself and also served any other requests. The attacker called its iam/info meta-data to get available role names and then the temporary credentials meta-data to obtain the actual credentials at
> {{{ http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name }}}
At that point, the attacker was in. Amongst other privileges, the role associated with the WAF instance had S3 bucket privileges. It's easy AWS CLI work from there. 

''What Made this Breach Special?''
This is arguably the first high-profile breach using this technique. It is novel and special in a few other ways: 
* The breach depended on a misconfiguration of a non-cloud component (the WAF software) to target an attack vector unique to cloud instances
* An ex-employee of the cloud service provider targeted clients of the cloud service provider

The more important point is that Capital One had to deal with a previously unexplored attack. AWS recognizes Capital One as a leader in cloud usage with impressive efforts at security. The fact that an ex-engineer of the CSP exploited the technical weakness only stands to show how exclusive the knowledge required, and how hard to counter this attack was.

This incident highlights increasingly sophisticated attacks that attackers can use to compromise cloud environments. The CSA Top Threats Working Group playbook provides guidance on how to test for such misconfigurations in your cloud infrastructure, reducing the knowledge gap.

''What's the Cloud Penetration Testing Playbook?''
The Cloud Penetration Testing Playbook represents a collective effort to provide guidance for the penetration testing of systems in public cloud environments.  It provides a set of testing objectives, as well as legal and compliance concerns. The overall document aims to educate key decision-makers on the complexities of penetration testing in a multi-stakeholder and vulnerabilities within a multi-layered information technology stack.

While this resource is activity-specific (penetration testing), it outlines the various methods by which attackers can and do target cloud environments. To protect information systems, defenders should be aware of the methods including those used by the Capital One threat actor.. The playbook covers most of the aspects and methodology of similar attack: 

__Initial compromise employed by the Capital One threat actor involved a misconfigured proxy server exposing temporary credentials residing in its meta-data service.__
Covered in ''Pg 13'' (of the Cloud Penetration Testing Playbook)
* c. Test for spoofing of user identity and other entities
* v. Steal credentials from meta-data of proxy or http forwarding servers (credentials in AWS meta-data)

__Data exfiltration via export of EC2 snapshots__
Covered in ''Pg 14'' (of the Cloud Penetration Testing Playbook)
* f. Test for Information disclosure (privacy breach or data leak)
* ix. Steal virtual machine images and snapshots from storage accounts; analyze them for sensitive data (likeAzure vm vhd snapshots

__Data exfiltration via download of S3 bucket objects__
Covered in ''Pg 14'' (of the Cloud Penetration Testing Playbook)
* f. Test for Information disclosure (privacy breach or data leak)iv. Exfiltrate data from publicly accessible datastore services (S3, RDS, RDS snapshots, Redshift clusters, elastic search domains) or private stores with cli / dumps (s3 aws cli get, dynamodump), and/or configure them accordingly for exfiltration).

''What Should You Do About This?''
This knowledge is now available. The playbook is a resource that CSA and Top Threats Working Group will continue to improve on.//[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/jaac/]] sur le blog de la CSA.
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//It's all about the Data! – Preventative Security//"
[>img(200px,auto)[iCSA/JA8BI.jpg]]Article de blog publié le 8 octobre 2019 — Rédigé par John DiMaria, Assurance Investigatory Fellow, CSA
<<<
//I have always said I am a "data guy." Decisions made with data eliminate all bias, opinions, and ad hoc decisions that cause potential costly moves.
In my most recent podcast interview with Phillip Merrick, CEO of Fugue, he discussed how vendors sometimes use security events in order to sell fear, uncertainty, and doubt (FUD) to sell products. Nothing wrong with keeping up with world events and learning from others' mistakes, but there is a difference between prevention and reaction.

''Reactive Security''
Think about it. Smoke alarms go off after something happens; usually, a fire that causes smoke to rise and enter the alarm. At that point, running out of the building is the standard "reaction." Sure, there are all kinds of incidents that can scare you and make you run out and buy the latest technology to warn you when there is a fire, and even call 911 for you. But while you definitely need smoke alarms, doesn't it make sense to do a full evaluation of your premises and see what you can do to prevent that fire in the first place? Then, even if a fire does happen, there is a good chance the damage will be less than if you had done nothing at all. Even if you did just buy all the latest and greatest technology, how you know you addressed the critical areas unless you did a full evaluation first?
Preventative Security

The point is, why not spend your budget dollars wisely by using good data-driven decisions. A smart strategy means less complexity. Evaluate where you are at, give yourself credit for what you already have in place and spend dollars wisely on the areas that have little or no protection and/or areas that could use improvement. The fire department can provide you with a checklist or questionnaire pointing out things you should evaluate before you spend money so you know what you really need (and what you don't). Whereas a company that wants to sell you equipment can give you a hundred reasons why you should by their product, even before they know if you even need it. 

Security is similar. Evaluate where you are at today, draw out where you need to be tomorrow, and act on the differences - simple, smart, and cost-effective (not to mention a valuable budget justification).

''CSA's Questionnaire to Assess Cloud Compliance''
Think of the Consensus Assessments Initiative Questionnaire (CAIQ) as fulfilling the same purpose as the fire risk questioner. It allows you to evaluate where you are at today in meeting internationally accepted cloud-specific controls. The CAIQ is based upon the Cloud Controls Matrix (CCM) and provides a set of Yes/No questions a cloud consumer or cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix. It's vendor-neutral, and some of the improvements may not even require technology, but if they do, you'll be a smarter shopper.

[>img(500px,auto)[iCSA/JA8BI.png]]As I mentioned above – simple, smart and cost effective. Once you feel you are ready and have addressed any gaps, you can submit your CAIQ to the STAR Registry and join the other 600 plus cloud service providers that have chosen to post their completed questionnaire for not only their customers to see, but potential clients as well, increasing the level of transparency and trust. The great thing is, it is scalable, and you can build on that initial step by graduating to STAR Continuous. STAR Continuous improves upon that "point in time" or "point over a period of time" analysis by requiring that the CAIQ be updated every 30 days, increasing the level of assurance. 

If you feel it is an advantage or requirement to go even further, again, you can progress to STAR Level 2; Third-Party certification or attestation and even Level 3; continuous monitoring. See the "STAR Levels" figure on the right.

Following are costs due to non-compliance as per an Independent survey conducted by Ponemon Institute on behalf of Globalscape+++*[»]>
→ http://dynamic.globalscape.com/files/Whitepaper-The-True-Cost-of-Compliance-with-Data-Protection-Regulations.pdf
=== 
These costs, as shown in this report, are 2.71 times the cost of compliance:
* Business disruption
* Productivity losses
* Revenue losses
* Fines, penalties and
* settlement costs

''Evaluate if you are compliant.''
If you are, give yourself credit and let the world know and continue to improve and advance as applicable. If not, act on the differences, fill the gaps, and then let the world know and continue to improve and consider the other levels of STAR based on your business needs and compliance requirements.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/ja8b/]] sur le blog de la CSA.
[img(25%,1px)[iCSF/BluePixel.gif]]
!Participation au Salon ''Cloud & Cyber Security Paris'' les 27 et 28 novembre 2019
[>img(200px,auto)[iCSF/CCSEP2019.png]]Le [[Chapitre Français]] de la [[Cloud Security Alliance]] animera :
* la table-ronde "''Cyber-résilience : anticiper, maître-mot de la sécurité''" 
* le mercredi 27 novembre 2019, entre 13h05 et 13h45.

Le salon se déroulera sur 2 jours : les ''mercredi 27 et jeudi 28 novembre 2019 à Paris, Porte de Versailles''
L'entrée donne accès aux cinq espaces du Salon :
* Cloud Expo Europe, DevOps Live, Cloud & Cyber Security Expo, Data Centre World, et Big Data World
[img[iCSF/JBRSC.png]]
|Table98|k
| ! 
Pour une invitation gratuite, suivez le lien → [[CloudSecurityAlliance.fr/go/CCSEP19|https://CloudSecurityAlliance.fr/go/CCSEP19]]
  | Pour en savoir plus sur le salon : <<< //__''Cloud & Cyber Security Expo Paris 27-28 novembre 2019, Paris Porte de Versailles''__ Nous avons la chance de vivre dans un monde numérique ouvert et interconnecté. Mais comment éviter les dangers auquel il nous expose ? Devenu un rassemblement incontournable d'experts cybersécurité en France, Cloud & Cyber Security Expo Paris vous donnera les clés pour mettre en place une infrastructure numérique plus sûre et sécurisée dans votre département ou votre société. Protéger votre entreprise, c'est aussi protéger vos clients et votre pérennité. Vous apprendrez à mieux détecter, prévenir et gérer les multiples menaces en matière de cybersécurité. Venez rencontrer Sophos, Darktrace , Rohde & Schwarz CyberSecurity, Tenable, Guardicore, Hermitage Solutions, Gemalto, ITrust, Okta, BSI Group et bien d'autres ! 250 experts de l'industrie seront également présents lors d'études de cas, tables rondes et conférences pour vous guider et vous inspirer : Groupe Servier, Dailymotion, Groupe Casino, Rémy Cointreau, Médiamétrie, Carrefour Banque & Assurance, EDF Renouvelables ... Ne prenez pas le risque de passer à côté !// <<<
!1 - Les nouveautés CSA de la semaine du 30 septembre au 6 octobre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : prolongation jusqu'au ''25 octobre'' pour commenter la traduction en français de 3 documents CSA+++*[»]> <<tiddler [[2019.09.19 - Actu : Demande de validation la traduction en français de 3 documents CSA]]>>=== 
* Blog : ''Why you can't have backdoored crypto that is secure''+++*[»]> <<tiddler [[2019.10.03 - Blog : 'Why you can't have backdoored crypto that is secure']]>>=== 
* Actu : Appel à commentaires, document ''Critical Controls Implementation for SAP''+++*[»]> <<tiddler [[2019.10.03 - Actu : Appel à commentaires, document 'Critical Controls Implementation for SAP']]>>=== 
* Actu : Lancement d'un ''forfait CCSK''+++*[»]> <<tiddler [[2019.10.03 - Actu : Lancement d'un forfait CCSK]]>>===, le ''Foundation Exam Bundle''+++*[»]> <<tiddler [[2019.10.03 - Actu : Forfait CCSK 'Foundation Exam Bundle]]>>=== 
* Publication : document ''Guidelines for CPAs Providing CSA STAR Attestation v2''+++*[»]> <<tiddler [[2019.10.04 - Publication : 'Guidelines for CPAs Providing CSA STAR Attestation v2']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.10.06 - Veille Hebdomadaire]] avec une cinquantaine de liens, dont :
* __''À lire'' :__ où l'on repartle du Cloud souverain avec ''Dassault Systèmes'' et ''OVH''+++*[»]>
|2019.10.03|Reuters|[[France recruits Dassault Systemes, OVH for alternative to U.S. cloud firms|https://www.reuters.com/article/us-france-dataprotection/france-recruits-dassault-systemes-ovh-for-alternative-to-u-s-cloud-firms-idUSKBN1WI189]]|Sovereign_Cloud|
|2019.10.03|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Cloud souverain : Bruno Lemaire relance Dassault Systèmes et OVH|https://www.silicon.fr/cloud-souverain-bruno-lemaire-relance-dassault-systemes-et-ovh-262679.html]]|Sovereign_Cloud|
=== 
* Divers : les zombies du Cloud+++*[»]>
|2019.10.02|//Fugue//|[[Zombie Cloud Infrastructure is a Major Security Risk|https://www.fugue.co/blog/zombie-cloud-infrastructure-is-a-major-security-risk]]|Risks Infrastructure Zombies|
===, comparaison PaaS et KaaS (Kubernetes as a Service)+++*[»]>
|2019.09.30|Container Journal|[[PaaS vs. KaaS: A Primer|https://containerjournal.com/topics/container-ecosystems/paas-vs-kaas-a-primer/]]|PaaS KaaS|
=== 
* Sondages : ''Insight''+++*[»]>
|2019.09.30|Insight| → [[2019 Europe Index Intelligent Technology™ d'Insight|https://fr.insight.com/content/dam/insight-web/en_GB/images/2019/09/index-intelligent-technology-insight-france.pdf]]|Report|
|2019.10.02|Global Security Mag[>img[iCSF/flag_fr.png]]| → [[Selon l'Insight Intelligent Technology Index 2019, Les services cloud inutilisés coûtent 9,6 millions d'euros aux entreprises|http://www.globalsecuritymag.fr/Selon-l-Insight-Intelligent,20190926,91105.html]]|Survey ITI|
=== 
* Rapports : évaluation Microsoft Azure pour les services du gouvernement australien+++*[»]>
|2019.10.02|//Microsoft Azure//|[[Over 100 Azure services support PROTECTED Australian government data|https://azure.microsoft.com/en-us/blog/over-100-azure-services-support-protected-australian-government-data/]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[Australia specific assessment and compliance reports, FAQs and White Papers|https://servicetrust.microsoft.com/viewpage/AustraliaV3]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[2019 Microsoft Azure IRAP (Information Security Registered Assessor Program) Assessment Report|https://servicetrust.microsoft.com/viewpage/AustraliaV3?command=Download&downloadType=Document&downloadId=ffcb3aeb-475e-4f23-8a8f-2fc7dac18d68&tab=d1b1d320-3d79-11e9-9157-b7b7eba45f26&docTab=d1b1d320-3d79-11e9-9157-b7b7eba45f26_GRC_Assessment_Reports]]|Azure Government Australia|
=== 
|!Octobre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.10.06|
|2019.10.06|//Tripwire//|[[Automating Secure Configuration Management in the Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/automating-secure-configuration-management-cloud/]]|Misc|
|2019.10.06|//Tripwire//|[[Secure Configuration in Cloud – IaaS, PaaS and SaaS Explained|https://www.tripwire.com/state-of-security/security-data-protection/cloud/secure-configuration-cloud-iaas-paas-saas/]]|Challenges|
|2019.10.06|//Alcide//|[[Kubernetes Network Policies Best Practices|https://blog.alcide.io/kubernetes-network-policies-best-practices]]|Kubernetes|
|2019.10.06|Alexandre Blanc|[[A backup strategy against ransomwares and threats (part 3)|https://www.linkedin.com/pulse/backup-strategy-against-ransomwares-threats-part-3-alexandre/]] (3/3)|Backups Ransomware|
|2019.10.06|Redmond Channel Partner|[[Multifactor Authentication for All at Heart of Azure AD Changes|https://rcpmag.com/articles/2019/11/06/multifactor-authentication-for-all-azure-ad.aspx]]|AzureAD MFA|
|>|>|>|!2019.10.04|
|2019.10.04|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[OVH-Outscale : le cloud souverain vraiment ressuscité ?|https://www.lemondeinformatique.fr/actualites/lire-ovh-outscale-le-cloud-souverain-vraiment-ressuscite-76657.html]]|Sovereign_Cloud France|
|2019.10.04|FCW|[[US, UK reach CLOUD Act agreement|https://fcw.com/articles/2019/10/04/cloud-act-uk-deal-johnson.aspx]]|CLOUD_Act|
|2019.10.04|IT World Canada|[[Using the Cloud Securely: A conversation between two cybersecurity leaders|https://www.itworldcanada.com/sponsored/using-the-cloud-securely-a-conversation-between-two-cybersecurity-leaders]] ([[podcast .mp3|https://i.itworldcanada.com/wp-content/uploads/2019/10/Box-Audio-Mixdown-1.mp3]])|Misc|
|2019.10.04|SecureCloudBlog|[[Azure AD – Add Custom claims for WS-Federation applications|https://securecloud.blog/2019/10/03/azure-ad-add-custom-claims-for-ws-federation-applications/]]|AzureAD|
|2019.10.04|//Risk Recon//|[[5 Risk Factors for Deciding Where to Host Cloud-Eligible Assets|https://blog.riskrecon.com/5-risk-factors-for-deciding-where-to-host-cloud-eligible-assets]]|Risks Hosting|
|2019.10.04|DevOps.com|[[ESG Survey Sees Long DevSecOps Road Ahead|https://devops.com/esg-survey-sees-long-devsecops-road-ahead/]]|Report ESG|
|>|>|>|!2019.10.03|
|2019.10.03|Reuters|[[France recruits Dassault Systemes, OVH for alternative to U.S. cloud firms|https://www.reuters.com/article/us-france-dataprotection/france-recruits-dassault-systemes-ovh-for-alternative-to-u-s-cloud-firms-idUSKBN1WI189]]|Sovereign_Cloud|
|2019.10.03|Silicon.fr[>img[iCSF/flag_fr.png]]| → [[Cloud souverain : Bruno Lemaire relance Dassault Systèmes et OVH|https://www.silicon.fr/cloud-souverain-bruno-lemaire-relance-dassault-systemes-et-ovh-262679.html]]|Sovereign_Cloud|
|2019.10.03|DZone|![[How To Avoid Data Breaches In The Cloud|https://dzone.com/articles/how-to-avoid-data-breaches-in-the-cloud]]|Data_Breaches|
|2019.10.03|GovLoop|[[Survey Findings: The State of Cloud Adoption|https://www.govloop.com/survey-findings-the-state-of-cloud-adoption/]]|Survey|
|2019.10.03|The Register|[[Are your Office 365 biz accounts secure? Don't find out the hard way... There are tools to keep staff, customers safe|https://www.theregister.co.uk/2019/10/03/office_365_security_compliance/]]|O365 Compliance|
|2019.10.03|Bleeping Computer|[[Office 365 Admins Can Now Block Malicious Microsoft Query IQY Files|https://www.bleepingcomputer.com/news/microsoft/office-365-admins-can-now-block-malicious-microsoft-query-iqy-files/]]|O365|
|2019.10.02|//Microsoft Azure//|[[All your creds are belong to us!|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/All-your-creds-are-belong-to-us/ba-p/855124]]|Authentication|
|2019.10.03|//Fugue//|[[Cloud Security Posture Management: Benefits and Uses|https://www.fugue.co/blog/cloud-security-posture-management-benefits-and-uses]]|Security_Posture Misconfigurations|
|2019.10.03|//Managed Methods//|[[Where Cloud Security Fits In Your Cybersecurity Infrastructure|https://managedmethods.com/blog/cybersecurity-infrastructure-cloud-security/]]|Infrastructure|
|2019.10.03|//ThreatStack//|[[Cloud Security Professional Development & Educational Resource Roundup|https://www.threatstack.com/blog/cloud-security-professional-development-educational-resource-roundup]]|Education|
|2019.10.03|//Google Cloud//|[[4 steps to stop data exfiltration with Google Cloud|https://cloud.google.com/blog/products/identity-security/4-steps-to-stop-data-exfiltration-with-google-cloud]] (5/6)|GCP Exfiltration|
|2019.10.03|//Google Cloud//|[[Take time for discovery and assessment - and consider a partner - for a successful cloud migration|https://cloud.google.com/blog/products/cloud-migration/take-time-for-discovery-and-assessment-and-consider-a-partner-for-a-successful-cloud-migration]]|Migration|
|2019.10.03|//AWS//|[[Amazon Elasticsearch Service provides option to mandate HTTPS|https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-elasticsearch-service-provides-option-to-mandate-https/]] ([[details|https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-data-protection.html]])|AWS|
|2019.10.03|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Un Office 365 sécurisé, une perle rare ?|https://www.riskinsight-wavestone.com/2019/10/office-365/]]|O365|
|>|>|>|!2019.10.02|
|2019.10.02|Les Echos[>img[iCSF/flag_fr.png]]|[[Cloud Act : halte à la désinformation !|https://www.lesechos.fr/idees-debats/cercle/cloud-act-halte-a-la-desinformation-140599]]|CLOUD_Act|
|2019.10.02|Dark Reading|[[Controlling Data Leakage in Cloud Test-Dev Environments|https://www.darkreading.com/cloud/controlling-data-leakage-in-cloud-test-dev-environments/a/d-id/1335909]]|Data_Leaks|
|2019.10.02|TechTarget|[[Healthcare cybersecurity threatened by cloud misconfigurations|https://searchhealthit.techtarget.com/news/252471750/Healthcare-cybersecurity-threatened-by-cloud-misconfigurations]]|Misconfigurations|
|2019.10.02|DZone|[[Overview of AWS Security Tools and Processes|https://dzone.com/articles/aws-overview-of-security-processes]]|AWS|
|2019.10.02|CyberDefense Mag|[[Cloud Security Essentials - Session Monitoring|https://www.cyberdefensemagazine.com/cloud-security-essentials/]]|Monitoring|
|2019.10.02|CyberDefense Mag|[[Why Zero Trust is the Right Security Model for the Cloud|https://www.cyberdefensemagazine.com/why-zero-trust-is-the-right-security-model-for-the-cloud/]]|Zero_Trust|
|2019.10.02|//Microsoft Azure//|![[Over 100 Azure services support PROTECTED Australian government data|https://azure.microsoft.com/en-us/blog/over-100-azure-services-support-protected-australian-government-data/]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[Australia specific assessment and compliance reports, FAQs and White Papers|https://servicetrust.microsoft.com/viewpage/AustraliaV3]]|Azure Government Australia|
|2019.10.02|//Microsoft Azure//| → [[2019 Microsoft Azure IRAP (Information Security Registered Assessor Program) Assessment Report|https://servicetrust.microsoft.com/viewpage/AustraliaV3?command=Download&downloadType=Document&downloadId=ffcb3aeb-475e-4f23-8a8f-2fc7dac18d68&tab=d1b1d320-3d79-11e9-9157-b7b7eba45f26&docTab=d1b1d320-3d79-11e9-9157-b7b7eba45f26_GRC_Assessment_Reports]]|Azure Government Australia|
|2019.10.02|//Box//|[[Box debuts new security controls, other enhancements to workflow automation tools|https://siliconangle.com/2019/10/02/box-debuts-new-security-controls-enhancements-workflow-automation-tools/]]|Box|
|2019.10.02|//Google//[>img[iCSF/flag_fr.png]]|[[Eric Haddad, Google Cloud : nous mettons notre priorité sur la security-by-design et de privacy-by-design|http://www.globalsecuritymag.fr/Eric-Haddad-Google-Cloud-nous,20191003,91138.html]]|GCP Security_by_Design|
|2019.10.02|//Google Cloud//|[[Archive media for the long term with preservation masters|https://cloud.google.com/blog/products/storage-data-transfer/archive-media-for-the-long-term-with-preservation-masters]]|Storage|
|2019.10.02|//Fugue//|![[Zombie Cloud Infrastructure is a Major Security Risk|https://www.fugue.co/blog/zombie-cloud-infrastructure-is-a-major-security-risk]]|Risks Infrastructure Zombies|
|2019.10.02|//Security Intelligence//|[[6 Steps to Modernize Your On-Premises Identity and Access Management Architecture|https://securityintelligence.com/posts/6-steps-to-modernize-your-on-premises-identity-and-access-management-architecture/]]|IAM|
|2019.10.02|//Cyware//|[[Understanding and Preparing for Container security threats|https://cyware.com/news/understanding-and-preparing-for-container-security-threats-26031da9]]|Containers Threats|
|2019.10.02|//McAfee//|[[Security is Shifting to a Unified Cloud Edge|https://securingtomorrow.mcafee.com/business/cloud-security/security-is-shifting-to-a-unified-cloud-edge/]]|Misc|
|2019.10.02|Alexandre Blanc|[[A backup strategy against ransomwares and threats (part 2)|https://www.linkedin.com/pulse/backup-strategy-against-ransomwares-threats-part-2-alexandre/]] (2/3)|Backups Ransomware|
|>|>|>|!2019.10.01|
|2019.10.01|IT Word Canada|[[Canadian government data is getting cloudier, signaling a 'massive leap of faith' in public cloud, says Microsoft|https://www.itworldcanada.com/article/canadian-government-data-is-getting-cloudier-signaling-a-massive-leap-of-faith-in-public-cloud-says-microsoft/422307]]|Misc|
|2019.10.01|Trenches of IT|[[How I Passed the AWS Certified Security – Specialty|https://www.trenchesofit.com/2019/10/01/how-i-passed-aws-security/]]|Training AWS|
|2019.10.01|HelpNet Security|[[Managing and monitoring privileged access to cloud ecosystems|https://www.helpnetsecurity.com/2019/10/01/cloud-pam/]]|Access_Controls|
|2019.10.01|//Gigamon//|[[What Is a Private Cloud? Your Data with a Room of Its Own|https://blog.gigamon.com/2019/10/01/what-is-private-cloud-your-data-with-a-room-of-its-own/]]|Private_Cloud|
|2019.10.01|//ThreatStack//|[[The Top 3 Security Mistakes SaaS Companies are Making|https://www.threatstack.com/blog/the-top-3-security-mistakes-saas-companies-are-making]]|SaaS|
|2019.10.01|//JumpCloud//|[[Benefits of Cloud-Based RADIUS Servers|https://jumpcloud.com/blog/benefits-cloud-radius-servers/]]|Radius|
|2019.10.01|//JumpCloud//|[[Security-as-a-Service: IAM|https://jumpcloud.com/blog/secaas-iam/]]|IAM|
|2019.10.01|//Netwrix//|[[The Capital One Hack: 3 Questions about Data Security in the Cloud|https://blog.netwrix.com/2019/10/01/the-capital-one-hack-3-questions-about-data-security-in-the-cloud/]]|CapitalOne Lessons_Learnt|
|2019.10.01|Alexandre Blanc|[[A backup strategy against ransomwares and threats (part 1)|https://www.linkedin.com/pulse/backup-strategy-against-ransomwares-threats-part-1-alexandre/]] (1/3)|Backups Ransomware|
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.30|
|2019.09.30|Container Journal|![[PaaS vs. KaaS: A Primer|https://containerjournal.com/topics/container-ecosystems/paas-vs-kaas-a-primer/]]|
|2019.09.30|Helpnet Security|[[DevSecOps is emerging as the main methodology for securing cloud-native applications|https://www.helpnetsecurity.com/2019/09/30/securing-cloud-native-applications/]]|DevSecOps|
|2019.09.30|KitPloit|[[Terraform AWS Secure Baseline|https://www.kitploit.com/2019/09/terraform-aws-secure-baseline-terraform.html]]|Tools AWS Terraform|
|2019.09.30|ZDnet|[[Docker is in deep trouble|https://www.zdnet.com/article/docker-is-in-deep-trouble/]]|Docker|
|2019.10.02|Informatique News[>img[iCSF/flag_fr.png]]| → [[En difficulté, Docker cherche de nouveaux financements|ttps://www.informatiquenews.fr/en-difficulte-docker-cherche-de-nouveaux-financements-63772]]|Docker|
|2019.09.30|CyberSecurity Hub|[[Cloud Security: A CISO Guide|https://www.cshub.com/cloud/articles/cloud-security-a-ciso-guide]]|Risks|
|2019.09.30|JDSupra|[[Luxembourg Cloud computing rules for investment fund managers: a reminder of the obligations 6 months before their Cloud Register must be drawn up|https://www.jdsupra.com/legalnews/luxembourg-cloud-computing-rules-for-47103/]]|Luxembourg|
|2019.09.30|Insight| → [[2019 Europe Index Intelligent Technology™ d'Insight|https://fr.insight.com/content/dam/insight-web/en_GB/images/2019/09/index-intelligent-technology-insight-france.pdf]]|Report|
|2019.10.02|Global Security Mag[>img[iCSF/flag_fr.png]]| → [[Selon l'Insight Intelligent Technology Index 2019, Les services cloud inutilisés coûtent 9,6 millions d'euros aux entreprises|http://www.globalsecuritymag.fr/Selon-l-Insight-Intelligent,20190926,91105.html]]|Survey ITI|
|2019.09.30|//Google Cloud//|[[Detect and respond to high-risk threats in your logs with Google Cloud|https://cloud.google.com/blog/products/identity-security/detect-and-respond-to-high-risk-threats-in-your-logs-with-google-cloud]] (4/6)|GCP Threats Detection|
|2019.09.30|//Rapid7//|[[You Can Have It Both Ways with AppSec: Security and Speed|https://blog.rapid7.com/2019/09/30/you-can-have-it-both-ways-with-appsec-security-and-speed/]]|SAST DAST|
|2019.09.30|//Spanning//|[[Why Multi-Factor Authentication (MFA) Is a Must-Have in the Microsoft World and Beyond|https://spanning.com/blog/why-multi-factor-authentication-is-a-must-have/]]|O365 MFA|
!"//Guidelines for CPAs Providing CSA STAR Attestation v2//"
Document annoncé comme publié le 20 septembre 2019, mais daté du 27 septembre 2019 et mis en ligne le 3 octobre 2019.
<<<
[>img(200px,auto)[iCSA/J9KAG.png]]//This document provides guidance for CPAs in conducting a STAR Attestation. This document is not meant to replace any American Institute of Certified Public Accountant (AICPA) Standards or AICPA Service Organization Control® (SOC) related guidance. Refer to [[aicpa.org/soc|http://www.aicpa.org/soc]] for information about SOC and how to obtain SOC related standards and guidance.//
<<<
__Table des matières :__
<<<
* Part 1 – Professional Requirements
## General
## Requirements for engagement performance
## Competency requirements
## Scope of Attestation
## Criteria establishment and selection
* Part 2 – Additional CSA Guidelines
## CSA Competency
## Scope
## Submitting materials to CSA
<<<
&rArr; ''[[CloudSecurityAlliance.fr/go/ja4s/|https://CloudSecurityAlliance.fr/go/ja4s/]]
!"//Why you can't have backdoored crypto that is secure//"
[>img(150px,auto)[iCSA/JA3BW.jpg]]Article de blog publié le 3 octobre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//So as you have probably seen some parts of the US government are again making noise about end-to-end encryption.

We've seen this before (clipper chip, key escrow, etc., etc.). The new twist is that they appear to be trying a thin end of the wedge approach, banning end-to-end encryption in consumer applications (like Whatsapp, Signal and so on) but large corporations will be allowed to have end-to-end encryption to protect their systems. 

Let's ignore the whole consumer vs. corporate argument for a minute (does the CSA qualify? Would we be allowed to have internally secure communications? What about small and medium businesses? What about people who are self-employed?). 

So in order to be effective against an attacker that steals your laptop or cell phone, the encryption system also needs to be effective against a nation-state that takes (e.g. at the border, legally) your laptop or cell phone. Is this a lawful matter with a warrant and judicial transparency? Or is this part of a widespread crackdown by a repressive regime on pro-democracy supporters? Security can either be controlled by the end-user(s) involved in some specific communication/data processing, or it can also be controlled by some third party (e.g., the data processing platform). If a third party is involved, then that third party can choose to reveal the data without consent or even knowledge in most cases of the end parties, due to a lawful warrant, or because they decided to monetize your data and sell it to advertisers. Once you lose technical control of your encryption and privacy you are at risk of a number of attacks, ranging from bribery and theft from the third party to that third party going bankrupt and your data assets being auctioned off to the highest bidder. 

This is why the CSA is actively exploring and engineering Blockchain solutions that involve end-to-end privacy and technical controls that are placed in the hands of the end-users, because anything less is just a data breach away from failure.//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/ja3b/]] sur le blog de la CSA.
[img(25%,1px)[iCSF/BluePixel.gif]]
Un appel à commentaires dont la date de clôture est le ''3 novembre 2019'' : "''Critical Controls Implementation for SAP''".
<<<
//The Critical Controls Implementation for SAP is the first in a series of implementation documents that the CSA ERP Security Working Group aims to develop. These documents will focus on specific ERP technologies, starting with SAP. The Critical Controls Implementation for SAP document will be released in 2 parts. Part 1 will feature the first 10 controls with the second part featuring the rest at a later date. The document takes a technical and granular approach including information such as implementation checklists and SAP transaction numbers.//
<<<
__Extrait :__
<<<
The Critical Controls Implementation for SAP is the first document in a series of implementation documents we hope to develop that focuses on specific ERP technologies. The documents will be released in 2 parts. The first part of the document will provide controls implementation guidance for the following controls:
* APP01 - Secure Landscape
* APP02 - Baseline Secure Configurations
* APP03 - Security Vulnerabilities
* INT01 – Secure Integrations and API
* DAT01 – Continuous Monitoring
* DAT02 – Data Separation
* DAT03 – Data Encryption
* BUS01 -  Inventory of Business Assets, Data and Processes
* BUS02 - Business Process Controls
* BUS03 - Continuous Compliance
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/ja3c/|https://cloudsecurityalliance.fr/go/ja3c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(300px,auto)[iCSA/CCSK_cwet.jpg]]La [[Cloud Security Alliance]] annonce le lancement d'un forfait CCSK .
<<<
//__''CSA Announces Availability of Certificate of Cloud Security Knowledge Foundation Exam Bundle''__
Exam bundle makes it even easier to demonstrate knowledge in key areas of cloud security

SEATTLE – October 3, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced the availability of the Certificate of Cloud Security Knowledge (CCSK) Foundation Exam bundle. Now, those looking to demonstrate their competency in key cloud security areas such as governance and compliance can take the ''CCSK Foundation'' self-paced online course and receive an exam token for just $795 (a $890 value).

"There is a tremendous skills gap facing modern enterprises today, and cost shouldn't be an impediment to furthering one's career in a high-growth field with a rising demand for security professionals who can demonstrate a deep knowledge of cloud security," said Ryan Bergsma. "We're proud to be able to provide today'sinfosec leaders with an affordable option to advancement."

After purchasing the ''CCSK Foundation'' Exam bundle, students will be able to access the training for 60 days (with an automatic 30-day extension on request and further extensions at CSA's discretion). Tokens are valid for two years and include two attempts. The bundle includes seven modules:
# ''CCSK Foundation'' Introduction.
** A preview of the ''CSA CCSK Foundation Course'' content and class structure, along with the study materials that will be used throughout the course.
# Cloud Architecture.
** The fundamentals of cloud computing, including definitions, architectures, and the role of virtualization. Key topics include fundamental characteristics, cloud service and delivery models, and the Shared Responsibilities Model.
# Infrastructure Security for Cloud.
** Core infrastructure security- including networks, management interfaces, and administrator credentials. Students will also learn about virtual networking and workload security, including the basics of containers and serverless.
# Managing Cloud Security and Risk.
** Considerations and tools for risk assessment, governance, legal issues and compliance. Students will learn important considerations for managing security for cloud computing and be introduced to important CSA risk tools.
# Data Security for Cloud.
** Data security lifecycle, cloud storage models, data security issues and managing encryption. This module covers information lifecycle management for the cloud and how to apply security controls, with an emphasis on public cloud.
# Securing Cloud Applications, Users and Related Technologies.
** Identity management and application security for cloud deployments. Topics in this module include federated identity and different IAM applications, secure development, and managing application security in and for the cloud.
# Cloud Security Operations.
** Evaluating, selecting, and managing cloud computing providers. This module also discusses the role of Security as a Service providers and the impact of cloud on incident response.

The vendor-neutral CCSK tests for a broad foundation of cloud security knowledge, covering such topics as architecture, governance, compliance, operations, encryption, and virtualization. The CCSK exam body of knowledge is the CSA Security Guidance v4, the CSA Cloud Control Matrix and the ENISA Cloud Computing Risk Assessment report. Those interested in taking the exam can also choose to take advantage of a variety of CCSK training programs, including free self-study prep courses, in-person training sessions, and instructor-led online classes. Since it was launched in 2010, thousands of IT and security professionals have upgraded their skillsets and enhanced their careers by obtaining the CCSK.//
<<<
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/ja3a/|https://cloudsecurityalliance.fr/go/ja3a/]]''
* Le forfait est décrit [[ici|2019.10.03 - Actu : Forfait CCSK 'Foundation Exam Bundle']].
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CCSK_cwet.jpg]]Le forfait "''Foundation Exam Bundle''" comprend la formation en ligne pour les 7 modules et un jeton pour passer l'examen.
<<<
//Teaches the fundamentals of cloud security including: architecture, data security, managing risk and more. This course comes with a test token for students to take the CCSK exam.

* [>img(100px,auto)[iCSA/CCSK_0.jpg]]''Introduction: CCSK Foundation Introduction''
** Introduction to the CSA CCSK Foundation Course content and class structure. During this module you will be introduced to your instructor, Rich Mogull and familiarize yourself with the study materials you'll be using throughout the course. 

* [>img(100px,auto)[iCSA/CCSK_1.jpg]]''Module 1: Cloud Architecture''
** The fundamentals of cloud computing, including definitions, architectures, and the role of virtualization. Key topics include fundamental characteristics, cloud service and delivery models, and the Shared Responsibilities Model. 

* [>img(100px,auto)[iCSA/CCSK_2.jpg]]''Module 2: Infrastructure Security for Cloud''
** Core infrastructure security- including networks, management interfaces, and administrator credentials. Students will also learn about virtual networking and workload security, including the basics of containers and serverless. 

* [>img(100px,auto)[iCSA/CCSK_3.jpg]]''Module 3: Managing Cloud Security and Risk''
** Considerations and tools for risk assessment, governance, legal issues and compliance. Students will learn important considerations for managing security for cloud computing and be introduced to important CSA risk tools. 

* [>img(100px,auto)[iCSA/CCSK_4.jpg]]''Module 4: Data Security For Cloud''
** Data security lifecycle, cloud storage models, data security issues and managing encryption. This module covers information lifecycle management for the cloud and how to apply security controls, with an emphasis on public cloud. 

* [>img(100px,auto)[iCSA/CCSK_5.jpg]]''Module 5: Securing Cloud Applications, Users and Related Technologies''
** Identity management and application security for cloud deployments. Topics in this module include federated identity and different IAM applications, secure development, and managing application security in and for the cloud. 

* [>img(100px,auto)[iCSA/CCSK_6.jpg]]''Module 6: Cloud Security Operations''
** Evaluating, selecting, and managing cloud computing providers. This module also discusses the role of Security as a Service providers and the impact of cloud on incident response. 
//
<<<
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → * Lien → ''[[CloudSecurityAlliance.fr/go/ja3k/|https://cloudsecurityalliance.fr/go/ja3k/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Guardians of the Cloud: The Latest Security Findings//"
[>img(100px,auto)[iCSA/JA7BG.jpg]]^^Bien que publié le 7 octobre 2019 sur le blog de la CSA, cet article l'a déjà été il y a presque 3 mois, le 17 juillet 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/ja7z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/ja7x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//What to Expect at the 2019 Colorado Chapter Forum//"
[>img(100px,auto)[iCSA/JA2BW.jpg]]^^Annonce de la réunion du chapitre du Colorado et de son programme. Elle se tiendra le jeudi 7 novembre 2019 à Denver, et sera suivie d'une formation CCSK le lendemain.
&rArr; Lire [[l'article|https://blog.cloudsecurityalliance.org/2019/10/02/what-to-expect-at-the-2019-colorado-chapter-forum/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Cloud Security Posture Management: Why You Need It Now//"
[>img(100px,auto)[iCSA/JA1BC.jpg]]^^Bien que publié le 1er octobre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 2 mois, le 5 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/ja1z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/ja1x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201909>>
<<tiddler fAll2Tabs10 with: VeilleM","_201909>>
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|2019.05.30|!MITRE|[[CVE-2019-12491|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12491]]: ^^OnApp allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors^^|OnApp CVE-2019-12491|
|2019.06.07|//OnApp//|[[OnApp General Security Advisory|https://docs.onapp.com/rn/general-security-advisory]]|CVE-2019-12491 OnApp|
|2019.09.26|//Skylight//|[[All Your Cloud Are Belong To Us (CVE-2019-12491)|https://skylightcyber.com/2019/09/26/all-your-cloud-are-belong-to-us-cve-2019-12491/]]|CVE-2019-12491 OnApp|
|2019.09.26|MotherBoard| → [[Thousands of Cloud Computing Servers Could Be Owned With 'Very Simple' Attack, Researchers Say|https://www.vice.com/en_us/article/ywanev/thousands-of-cloud-computing-servers-could-be-owned-with-very-simple-attack-researchers-say]]|CVE-2019-12491 OnApp|
|2019.09.26|Dark Reading| → [[Cloud Vulnerability Could Let One Server Compromise Thousands|https://www.darkreading.com/cloud/cloud-vulnerability-could-let-one-server-compromise-thousands/d/d-id/1335943]]|CVE-2019-12491 OnApp|
|>|>|>|!|
|2019.09.08|!MITRE|[[CVE-2019-16097|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16097]]: ^^core/api/user.go [...] allows non-admin users to create admin accounts via the POST /api/users API^^|Harbor CVE-2019-16097|
|2019.09.18|//PaloAlto Networks//|[[Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)|https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/]]|Harbor CVE-2019-16097|
|2019.09.19|Bleeping Computer| → [[Critical Bug In Harbor Container Registry Gives Admin Access|https://www.bleepingcomputer.com/news/security/critical-bug-in-harbor-container-registry-gives-admin-access/]]|Harbor CVE-2019-16097|
|2019.09.20|GBHackers on Security| → [[Critical Vulnerability in Harbor let Hackers to Escalate Privilege by Sending Malicious Request|https://gbhackers.com/critical-vulnerability-harbor/]]|Harbor CVE-2019-16097|
|2019.09.02|Harbor|[[Disallow creating an admin user when registration #8917|https://github.com/goharbor/harbor/pull/8917]]|CVE-2019-16097 Patch|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Septembre 2019]]>>
<<tiddler fAll2LiTabs with: NewsL","201909>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Septembre 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Septembre 2019]]>><<tiddler fAll2LiTabs with: Actu","201909>>
<<tiddler fAll2LiTabs with: Blog","201909>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Septembre 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201909>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Septembre 2019]]>>
!1 - Les nouveautés CSA de la semaine du 23 au 29 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Il ne reste plus que 3 jours pour commenter la traduction en français de 3 documents CSA+++*[»]> <<tiddler [[2019.09.19 - Actu : Demande de validation la traduction en français de 3 documents CSA]]>>=== 
* Blog : ''How Blockchain Might Save Us All''+++*[»]> <<tiddler [[2019.09.27 - Blog : 'How Blockchain Might Save Us All']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.09.29 - Veille Hebdomadaire]] avec une soixantaine de liens :
* __''À lire'' :__ Démarche ayant amené Amazon a renforcer la sécurité de ses buckets S3+++*[»]> 
|2019.09.23|HelpNet Security|![[How data breaches forced Amazon to update S3 bucket security|https://www.helpnetsecurity.com/2019/09/23/s3-bucket-security/]]|AWS S3|
=== 
* __''À lire'' :__ Recommandations sécurité sur Office 365 de l'Agence nationale de Cyber Sécurité finlandaise+++*[»]> 
|2019.09.23|NCSC-FI|![[Protection against Microsoft Office 365 credential phishing and data breaches|https://www.kyberturvallisuuskeskus.fi/en/ohjeet]] ([[guide .pdf|https://www.kyberturvallisuuskeskus.fi/sites/default/files/media/publication/T_MS365_eng_200919.pdf]])|O365 Best_Practices|
|2019.09.23|Bleeping Computer| → [[Finnish Govt. Releases Guide on Securing Microsoft Office 365|https://www.bleepingcomputer.com/news/security/finnish-govt-releases-guide-on-securing-microsoft-office-365/]]|O365 Best_Practices|
=== 
* Alerte : CVE-2019-12491 affectant ''OnApp'' la plate-forme d'orchestration utilisée par de très nombreux prestataires Cloud+++*[»]> <<tiddler [[2019.09.30 - Alertes]]>>=== 
* Rapports et sondages : "''Cloud-Native Breaches''" (ESG)+++*[»]> 
|2019.09.24|//ESG//|[[You Might Be Cloud-First, But Security Is Still an Afterthought|https://www.businesswire.com/news/home/20190924005500/en/Cloud-First-Security-Afterthought]]|Report ESG DevSecOps|
|2019.09.24|//Capsule8//| → [[Retooling CyberSecurity Programs for the Cloud-first Era|https://info.capsule8.com/retooling-cybersecurity-programs-for-the-cloud]]|Report ESG DevSecOps|
|2019.09.24|DevOps.com| → [[DevSecOps Becomes a Higher Cloud-Native Priority|https://devops.com/devsecops-becomes-a-higher-cloud-native-priority/]]|Report ESG DevSecOps|
|2019.09.25|HelpNet Security| → [[Security capabilities are lagging behind cloud adoption|https://www.helpnetsecurity.com/2019/09/25/security-capabilities-cloud-adoption/]]|Report ESG DevSecOps|
===, "''Cloud Security Intelligence''" (Coalfire)+++*[»]> 
|2019.09.25|//Coalfire//|![[Cloud Security Intelligence Report|https://www.coalfire.com/Resources/White-Papers/Cloud-Security-Intelligence-Report]]|Study Threats|
===, "''Cloud-Native Breaches''" (McAfee)+++*[»]> 
|2019.09.24|//McAfee//|[[McAfee Report Demonstrates Cloud-Native Breaches Differ Greatly From Malware Attacks of the Past|https://www.businesswire.com/news/home/20190924005213/en/McAfee-Report-Demonstrates-Cloud-Native-Breaches-Differ-Greatly]]|Report McAfee|
|2019.09.24|//McAfee//| → [[Cloud-Native: The Infrastructure-as-a-Service (IaaS) Adoption and Risk Report|https://www.mcafee.com/enterprise/en-us/forms/gated-form.html?docID=be66d487-f531-4484-ba0c-558b534ff779&esheet=52099611&newsitemid=20190924005213]]|Report McAfee|
|2019.09.24|Dark Reading| → [[Cloud-Native Breaches Differ Greatly from Malware Attacks of the Past: McAfee Report|https://www.darkreading.com/cloud/cloud-native-breaches-differ-greatly-from-malware-attacks-of-the-past-mcafee-report/d/d-id/1335890]]|Report McAfee|
|2019.09.24|HelpNet Security| → [[99% of misconfiguration incidents in the cloud go unnoticed|https://www.helpnetsecurity.com/2019/09/25/cloud-misconfiguration-incidents/]]|Report McAfee|
=== 
* Offres produits : annonce Microsoft d'Azure Sentinel+++*[»]> 
|2019.09.25|//Microsoft Azure//|[[Azure Sentinel - the cloud-native SIEM that empowers defenders is now generally available|https://www.microsoft.com/security/blog/2019/09/24/azure-sentinel-cloud-native-siem-empowers-defenders-generally-available/]]|Azure SIEM|
=== 
|>|>|>|!Alerte|
|2019.09.08|MITRE|[[CVE-2019-12491|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12491]]: ^^OnApp allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors^^|OnApp CVE-2019-12491|
|2019.09.26|//Skylight//|[[All Your Cloud Are Belong To Us (CVE-2019-12491)|https://skylightcyber.com/2019/09/26/all-your-cloud-are-belong-to-us-cve-2019-12491/]]
 → Voir ci-dessous|CVE-2019-12491 OnApp| |>|>|>|| |!Septembre|!Sources|!Titres et Liens|!Keywords| |>|>|>|!2019.09.29| |2019.09.29|Christophe Parisel|![[An overview of security postures in Azure and AWS|https://www.linkedin.com/pulse/overview-security-postures-azure-aws-christophe-parisel/]]|Security_Posture Azure AWS| |2019.09.29|Forbes|[[New Cybersecurity Companies Have Their Heads In The Cloud|https://www.forbes.com/sites/jonmarkman/2019/09/29/new-cybersecurity-companies-have-their-heads-in-the-cloud/]]|Misc| |2019.09.29|//DivvyCloud//|[[Securing Your Cloud to Support Successful Mergers & Acquisitions|https://divvycloud.com/blog/cloud-security-mergers-acquisitions/]]|Misc| |>|>|>|!2019.09.28| |2019.09.28|Cyber Defense Mag|[[Why Cyber Security is Redefining SMEs' Business Operations on the Cloud|https://www.cyberdefensemagazine.com/why-cyber-security/]]|SMEs| |>|>|>|!2019.09.27| |2019.09.27|Bleeping Computer|[[Office 365 to Get Automated Incident Response for Hacked Accounts|https://www.bleepingcomputer.com/news/microsoft/office-365-to-get-automated-incident-response-for-hacked-accounts/]]|O365 automation Incidents| |2019.09.27|Security Boulevard|[[A Seismic Shift for Decrypted Visibility in the Cloud|https://securityboulevard.com/2019/09/a-seismic-shift-for-decrypted-visibility-in-the-cloud/]]|Encryption| |2019.09.27|//MarketResearch//[>img[iCSF/flag_fr.png]]|[[Le marché mondial des services de sécurité basés sur le cloud devrait gagner en popularité dans le monde entier d'ici 2025|https://www.loftvpro.com/le-marche-mondial-des-services-de-securite-bases-sur-le-cloud-devrait-gagner-en-popularite-dans-le-monde-entier-dici-2025/]]|Market| |2019.09.27|//Veracode//|[[Live From Gartner Security & Risk Mgmt Summit: How to Approach Container Security|https://www.veracode.com/blog/security-news/live-gartner-security-risk-mgmt-summit-how-approach-container-security]]|Containers| |2019.09.27|//BlueCat//|[[How to start achieving visibility in the cloud|https://www.helpnetsecurity.com/2019/09/27/visibility-in-the-cloud/]]|Visibility| |2019.09.27|//Oracle//|[[Multicloud is the New On-Prem|https://www.linkedin.com/pulse/multicloud-new-on-prem-matthew-o-keefe-ph-d-/]]|Multi_Cloud| |>|>|>|!2019.09.26| |2019.09.26|Solutions Numériques[>img[iCSF/flag_fr.png]]|[[IAM/IDaaS, la clé d'une approche "Zero Trust"|https://www.solutions-numeriques.com/dossiers/iam-idaas-la-cle-dune-approche-zero-trust/]]|IAM IDaaS| |2019.09.26|Cyber Defense Mag|[[Escaping the Gravitational Pull of Data Insecurity|https://www.cyberdefensemagazine.com/escaping-the-gravitational/]]|Data Regulations| |2019.09.26|//Skylight//|![[All Your Cloud Are Belong To Us (CVE-2019-12491)|https://skylightcyber.com/2019/09/26/all-your-cloud-are-belong-to-us-cve-2019-12491/]]|CVE-2019-12491 OnApp| |2019.09.26|MotherBoard| → [[Thousands of Cloud Computing Servers Could Be Owned With 'Very Simple' Attack, Researchers Say|https://www.vice.com/en_us/article/ywanev/thousands-of-cloud-computing-servers-could-be-owned-with-very-simple-attack-researchers-say]]|CVE-2019-12491 OnApp| |2019.09.26|Dark Reading| → [[Cloud Vulnerability Could Let One Server Compromise Thousands|https://www.darkreading.com/cloud/cloud-vulnerability-could-let-one-server-compromise-thousands/d/d-id/1335943]]|CVE-2019-12491 OnApp| |2019.09.26|Dark Reading|[[Why You Need to Think About API Security|https://www.darkreading.com/application-security/why-you-need-to-think-about-api-security/a/d-id/1335861]]|APIs| |2019.09.26|Dark Reading|[[Why Clouds Keep Leaking Data|https://www.darkreading.com/edge/theedge/why-clouds-keep-leaking-data/b/d-id/1335921]]|Data_Leaks CSA| |2019.09.26|KitSploit|[[Kube-Alien - Tool To Launches Attack on K8s Cluster from Within|https://www.kitploit.com/2019/09/kube-alien-tool-to-launches-attack-on.html]]|[[Tools|Outils-GitHub]]| |2019.09.26|//Zscaler//|[[Phishing attacks abusing appspot.com and web.app domains on Google Cloud|https://www.zscaler.com/blogs/research/phishing-attacks-abusing-appspotcom-and-webapp-domains-google-cloud]]|Phishing GCP| |2019.09.26|//CloudCheckr//|[[Understanding the Shared Responsibility Model for Cloud Security|https://cloudcheckr.com/cloud-security/shared-responsibility-model/]]|Shared_Responsibility| |2019.09.26|//DivvyCloud//|[[Lion Air Data Breach! Another Misconfigured S3 Bucket|https://divvycloud.com/blog/lion-air-data-breach-another-misconfigured-s3-bucket/]]|Data_Leak AWS_S3 Malindo| |2019.09.26|//Threatpost//|[[CISOs: Support Vendor Security Ops for Best Cloud Results|https://threatpost.com/cisos-support-vendor-security-ops-for-best-cloud-results/148665/]]|SaaS Survey McKinsey| |2019.09.26|//Microsoft Azure//|[[How to prevent phishing attacks that target your customers with DMARC and Office 365|https://www.microsoft.com/security/blog/2019/09/26/how-to-prevent-phishing-attacks-dmarc-office-365/]]|O365 Phishing Prevention| |2019.09.26|//WeScale//[>img[iCSF/flag_fr.png]]|![[Le guide de Chaos Engineering : Partie 1|https://blog.wescale.fr/2019/09/26/le-guide-de-chaos-engineering-part-1/]] (1/3)|Chaos_Engineering| |2019.09.26|//StackRox//|![[12 Kubernetes configuration best practices|https://www.stackrox.com/post/2019/09/12-kubernetes-configuration-best-practices/]]|Kubernetes Best_Practices| |2019.09.26|BuildAzure|[[Security of Azure Container Registry Image Promotion Flow|https://buildazure.com/security-azure-container-registry-image-promotion/]]|Azure Registry| |>|>|>|!2019.09.25| |2019.09.25|Bleeping Computer|[[Microsoft Phishing Attack Uses Google Redirects to Evade Detection|https://www.bleepingcomputer.com/news/security/microsoft-phishing-attack-uses-google-redirects-to-evade-detection/]]|O365 Phishing| |2019.09.25|FedScoop|[[Energy is using cyber risk assessments to make cloud decisions|https://www.fedscoop.com/energy-cyber-risk-cloud-budgeting/]]|Risk_Management FAIR| |2019.09.25|Cybersecurity Insiders|[[CCSP and CCSK: Which Cloud Security Credential Is Right For You?|https://www.cybersecurity-insiders.com/ccsp-and-ccsk-which-cloud-security-credential-is-right-for-you/]]|CCSK| |2019.09.25|BetaNews|[[How to use Windows 10's Cloud Download recovery feature|https://betanews.com/2019/09/25/windows-10-cloud-download/]]|Misc| |2019.09.25|Infosec Institute|[[CCSP exam and CBK changes in August|https://resources.infosecinstitute.com/ccsp-exam-and-cbk-changes-in-august/]]|Training| |2019.09.25|NextGov|[[How Federal Agencies Can Be More Proactive About Cloud Security|https://www.nextgov.com/ideas/2019/09/how-federal-agencies-can-be-more-proactive-about-cloud-security/160073/]]|Risks| |2019.09.25|TechradarPro|[[Choosing the right cloud container platform|https://www.techradar.com/news/choosing-the-right-cloud-container-platform]]|Containers| |2019.09.25|Channel Daily News|[[Who should the CISO report to, and other CloudSec 2019 takeaways|https://channeldailynews.com/news/who-should-the-ciso-report-to-and-other-cloudsec-2019-takeaways/68969]]|Misc| |2019.09.25|//Microsoft Azure//|[[Azure Sentinel - the cloud-native SIEM that empowers defenders is now generally available|https://www.microsoft.com/security/blog/2019/09/24/azure-sentinel-cloud-native-siem-empowers-defenders-generally-available/]]|Azure SIEM Sentinel| |2019.09.26|//Microsoft Azure//| → [[Azure Sentinel general availability: A modern SIEM reimagined in the cloud|https://azure.microsoft.com/en-us/blog/azure-sentinel-general-availability-a-modern-siem-reimagined-in-the-cloud/]]|Azure SIEM Sentinel| |2019.02.28|//Microsoft Azure//| → [[Announcing new cloud-based technology to empower cyber defenders|https://blogs.microsoft.com/blog/2019/02/28/announcing-new-cloud-based-technology-to-empower-cyber-defenders/]]|Azure SIEM Sentinel| |2019.09.25|//Microsoft Azure//|[[Top 5 use cases to help you make the most of your Cloud Access Security Broker|https://www.microsoft.com/security/blog/2019/09/25/top-5-use-cases-cloud-access-security-broker/]] (1/4)|CASB| |2019.02.25|//Microsoft Azure//|![[Ensuring secrecy orders are the exception not the rule when the government seeks data owned by our customers|https://blogs.microsoft.com/on-the-issues/2019/09/25/ensuring-secrecy-orders-are-the-exception-not-the-rule-when-the-government-seeks-data-owned-by-our-customers/]]|Regulations| |2019.09.26|Ars technica| → [[Microsoft: Customers are entitled to know about federal data requests|https://arstechnica.com/tech-policy/2019/09/microsoft-battles-feds-over-gag-orders-in-law-enforcement-data-requests/]]|Regulations| |2019.09.25|//Bitglass//|[[The Four Pillars of CASB: Identity|https://www.bitglass.com/blog/four-pillars-casb-identity]]|CASB| |2019.09.25|//Proofpoint//|[[Cloud Attacks Prove Effective Across Industries in the First Half of 2019|https://www.proofpoint.com/us/threat-insight/post/cloud-attacks-prove-effective-across-industries-first-half-2019]]|Report Proofpoint| |2019.09.25|UnderNews[>img[iCSF/flag_fr.png]]| → [[85 % des organisations ont subi au moins une cyberattaque via le cloud au cours du premier semestre 2019|https://www.undernews.fr/reseau-securite/85-des-organisations-ont-subi-au-moins-une-cyberattaque-via-le-cloud-au-cours-du-premier-semestre-2019.html]]|Report Proofpoint| |2019.09.25|//Markerbench//|[[Why CISOs should Care About Cloud "Drift"|http://www.markerbench.com/blog/2019/09/25/drifting-along/]]|Misc| |2019.09.25|//Puppet//|[[2019 State of DevOps Report|https://puppet.com/resources/whitepaper/state-of-devops-report]]|Report Puppet DevOps| |2019.09.25|//Puppet//|[[2019 State of DevOps Report Reveals Shifting Security Left is Insufficient; Organizations Must Fundamentally Change How They Work Earlier in the Software Delivery Cycle|https://www.globenewswire.com/news-release/2019/09/25/1920660/0/en/2019-State-of-DevOps-Report-Reveals-Shifting-Security-Left-is-Insufficient-Organizations-Must-Fundamentally-Change-How-They-Work-Earlier-in-the-Software-Delivery-Cycle.html]]|Report Puppet DevOps| |2019.09.25|//Coalfire//|![[Cloud Security Intelligence Report|https://www.coalfire.com/Resources/White-Papers/Cloud-Security-Intelligence-Report]]|Study Threats| |>|>|>|!2019.09.24| |2019.09.24|Cybersecurity Insiders|[[Why IaaS requires cloud security automation|https://www.cybersecurity-insiders.com/why-iaas-requires-cloud-security-automation/]]|IaaS Automation| |2019.09.24|Solutions Reviews|[[Cloud Compliance: How to Maintain Compliance in Your Cloud Deployment|https://solutionsreview.com/cloud-platforms/cloud-compliance-how-to-maintain-compliance-in-your-cloud-deployment/]]|Compliance| |2019.09.24|//ESG//|[[Enterprise Strategy Group Study Finds Very Few Companies Are Securing the Majority of Their Cloud-Native Apps With DevSecOps Practices|https://www.businesswire.com/news/home/20190926005105/en/Enterprise-Strategy-Group-Study-Finds-Companies-Securing]]|Report ESG DevSecOps| |2019.09.24|//Data Theorem//|[[Security for DevOps - Enterprise Survey Report, September 2019|https://www.datatheorem.com/resources/reports/esg-security-for-devops]]|Report ESG DevSecOps| |2019.09.24|//ESG//|[[You Might Be Cloud-First, But Security Is Still an Afterthought|https://www.businesswire.com/news/home/20190924005500/en/Cloud-First-Security-Afterthought]]|Report ESG DevSecOps| |2019.09.24|//Capsule8//| → [[Retooling CyberSecurity Programs for the Cloud-first Era|https://info.capsule8.com/retooling-cybersecurity-programs-for-the-cloud]]|Report ESG DevSecOps| |2019.09.24|DevOps.com| → [[DevSecOps Becomes a Higher Cloud-Native Priority|https://devops.com/devsecops-becomes-a-higher-cloud-native-priority/]]|Report ESG DevSecOps| |2019.09.25|HelpNet Security| → [[Security capabilities are lagging behind cloud adoption|https://www.helpnetsecurity.com/2019/09/25/security-capabilities-cloud-adoption/]]|Report ESG DevSecOps| |2019.09.26|Dark Reading| → [[Cloud-Native Applications: Shift to Serverless is Underway|https://www.darkreading.com/cloud/cloud-native-applications-shift-to-serverless-is-underway/d/d-id/1335931]]|Report ESG DevSecOps| |2019.09.26|InfoSecurity Mag| → [[Secure DevOps Practices Expected to Increase for Cloud Apps|https://www.infosecurity-magazine.com/news/secure-devops-cloud-apps/]]|Report ESG DevSecOps| |2019.09.24|//McAfee//|[[McAfee Report Demonstrates Cloud-Native Breaches Differ Greatly From Malware Attacks of the Past|https://www.businesswire.com/news/home/20190924005213/en/McAfee-Report-Demonstrates-Cloud-Native-Breaches-Differ-Greatly]]|Report McAfee| |2019.09.24|//McAfee//| → [[Cloud-Native: The Infrastructure-as-a-Service (IaaS) Adoption and Risk Report|https://www.mcafee.com/enterprise/en-us/forms/gated-form.html?docID=be66d487-f531-4484-ba0c-558b534ff779&esheet=52099611&newsitemid=20190924005213]]|Report McAfee| |2019.09.24|Dark Reading| → [[Cloud-Native Breaches Differ Greatly from Malware Attacks of the Past: McAfee Report|https://www.darkreading.com/cloud/cloud-native-breaches-differ-greatly-from-malware-attacks-of-the-past-mcafee-report/d/d-id/1335890]]|Report McAfee| |2019.09.24|HelpNet Security| → [[99% of misconfiguration incidents in the cloud go unnoticed|https://www.helpnetsecurity.com/2019/09/25/cloud-misconfiguration-incidents/]]|Report McAfee| |2019.09.24|//PaloAlto Networks//|[[5 Considerations Before Building Your Own Cloud Security Tool|https://blog.paloaltonetworks.com/2019/09/cloud-security-tool/]]|Tools| |2019.09.24|//McAfee//|[[McAfee Cloud Adoption and Risk Report - Uncovering the scale of risk in the cloud|https://www.mcafee.com/enterprise/en-us/solutions/lp/cloud-adoption-risk.html]] ou [[ici|https://cloudsecurity.mcafee.com/cloud/en-us/forms/white-papers/wp-cloud-adoption-risk-report-2019-banner-cloud-mfe.html]]|Report McAfee| |2019.09.24|//Digital Shadows//|![[SecDevOps: Continued Database Exposures Point to Growing Challenges|https://www.digitalshadows.com/blog-and-research/secdevops-continued-database-exposures-point-to-growing-challenges/]]|SecDevOps BreachesData_| |2019.09.24|//Digital Shadows//| → [[Timeline of Inadvertant Data Breaches (2017-2019)|https://www.slideshare.net/digitalshadows/inadvertant-data-breaches]]|Data_Breaches| |2019.09.24|//Threatstack//|[[16 Kubernetes Experts Share the Most Interesting Current Trends to Look for in Kubernetes|https://www.threatstack.com/blog/16-kubernetes-experts-share-the-most-interesting-current-trends-to-look-for-in-kubernetes]]|Kubernetes Trends| |2019.09.24|//Pupuweb//|[[5 Essentials for Hybrid Identity Management and Security|https://pupuweb.com/essentials-hybrid-identity-management-security/]]|IAM| |2019.09.24|//Clever Cloud//[>img[iCSF/flag_fr.png]]|![[Le grand retour du "cloud souverain": une histoire de gouvernance et de protectionnisme|https://www.frenchweb.fr/le-grand-retour-du-cloud-souverain-une-histoire-de-gouvernance-et-de-protectionnisme/376626]]|Sovereign_Cloud| |2019.09.24|Dev.to|[[Best Practices for Event-Driven Microservice Architecture|https://dev.to/heroku/best-practices-for-event-driven-microservice-architecture-2lh7]]|Misc| |>|>|>|!2019.09.23| |2019.09.23|NCSC-FI|![[Protection against Microsoft Office 365 credential phishing and data breaches|https://www.kyberturvallisuuskeskus.fi/en/ohjeet]] ([[guide .pdf|https://www.kyberturvallisuuskeskus.fi/sites/default/files/media/publication/T_MS365_eng_200919.pdf]])|O365 Best_Practices| |2019.09.23|Bleeping Computer| → [[Finnish Govt. Releases Guide on Securing Microsoft Office 365|https://www.bleepingcomputer.com/news/security/finnish-govt-releases-guide-on-securing-microsoft-office-365/]]|O365 Best_Practices| |2019.09.23|HelpNet Security|![[How data breaches forced Amazon to update S3 bucket security|https://www.helpnetsecurity.com/2019/09/23/s3-bucket-security/]]|AWS S3| |2019.09.23|Container Journal|[[Harbor Container Registry Project Advances|https://containerjournal.com/topics/container-management/harbor-container-registry-project-advances/]]|Harbor| |2019.09.23|CloudTweaks|[[Implementing Serverless Microservices Architecture on AWS|https://cloudtweaks.com/2019/09/implementing-serverless-microservices-architecture/]]|Serverless| |2019.09.23|Finextra|[[Sibos 2019: Cloud services- huge burden of security responsibility|https://www.finextra.com/newsarticle/34457/sibos-2019-cloud-services--huge-burden-of-security-responsibility]]|Shared_Responsibility| |2019.09.23|Cybersecurity Insiders|[[Controlling Access Is a Key Component of Security for Hybrid IT|https://www.cybersecurity-insiders.com/controlling-access-is-a-key-component-of-security-for-hybrid-it/]]|Access_Controls| |2019.09.23|The Next Web|[[More than 60% of Ethereum nodes run in the cloud, mostly on Amazon Web Services|https://thenextweb.com/hardfork/2019/09/23/ethereum-nodes-cloud-services-amazon-web-services-blockchain-hosted-decentralization/]]|AWS Blockchain| |2019.09.23|//Microsoft Azure//|[[How to develop your service health alerting strategy|https://azure.microsoft.com/en-us/blog/how-to-develop-your-service-health-alerting-strategy/]]|Monitoring| |2019.09.23|//Clearswift//|[[Big brands don't guarantee big security: how to bolster your information security in the cloud|https://www.clearswift.com/blog/2019/09/23/big-brands-don%E2%80%99t-guarantee-big-security-how-bolster-your-information-security-cloud]]|Risks| |2019.09.23|//Qualys//|[[Empower your Cloud Ops Teams – Publish Qualys CloudView Security Assessment Reports to their Slack Channel|https://blog.qualys.com/news/2019/09/23/empower-your-cloud-ops-teams-publish-qualys-cloudview-security-assessment-reports-to-their-slack-channel]]|SecOps| |2019.09.23|//Arbor//|[[How Cybercrime-as-a-Service Is Growing the Black Market|https://www.armor.com/blog/how-cybercrime-as-a-service-is-growing-the-black-market/]]|Crimeware|
!"//How Blockchain Might Save Us All//"
[>img(150px,auto)[iCSA/J9RBH.jpg]]Article de blog publié le 27 septembre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//I've been seeing a lot of articles claiming that Blockchain will save us from hackers, and ransomware, and all sorts of other Cyber-Shenanigans. So… will Blockchain save us all? Yes, well ... sort of, it's complicated.
Let's start with a story:

__''The evolution of web browsers''__
Web browsers. Through the 1990's and 2000's the web browser became a dominant piece of software. Through the late 2000's the dominance of JavaScript became obvious, with high speed Internet it became possible to deliver multi megabyte web pages (currently cnn.com is 1.4 megabytes, YoutTube is 1.9 and even the "lean" front page of google.com is 0.45). But the performance of running JavaScript in the web browser… well let's be honest. It was becoming awful. So awful in fact that it was beginning to impact Google, who wanted to deliver rich web pages and services using JavaScript, but… the experience was so slow and awful people were getting turned off of it. Now if you're the scale of Google the solution is simple: you engineer and release a really fast web browser with a really fast JavaScript engine (V8).
This has two main effects:
* It gives people a choice of a fast web browser and…
* It shames all the other slow web browsers into improving, or being so bad that they get left behind. 

__''…and the evolution of Blockchain''__
[>img(150px,auto)[iCSA/J7OBU.jpg]]I can't help but feel that Blockchain is sort of having the same effect. For example backups. A critical component of information security is having backups. Without backups you can't recover from an attack to a known good state very easily (even if the attacker didn't delete records did he modify any? Do you have anything to compare to?). Blockchain solves the backup problem in two simple ways: everyone has a full copy of the data if they want, and the data itself has protections that will show if it was tampered or modified. Even better I can be reasonably certain I have ALL the data and that it is up to date (it's 3am, do you know if your backups are up to date?).
When it comes to ransomware the biggest problem we see again and again is that the data that got encrypted is now effectively gone because nobody has a proper backup of it that can be recovered easily, if at all. Now to be clear I don't think we should switch every data storage medium over to some Blockchain based version (I also don't think Bitcoin is going to suddenly replace the world's banking system), but I do think we should maybe ask "why can't we have some of the benefits of Blockchain in our other data storage and processing systems?"
You can read more about Blockchain uses cases in CSA's latest research report [[here|2019.07.31 - Publication : 'Documentation of Relevant Distributed Ledger Technology and Blockchain Use Cases v2']]//
[...]
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9rb/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 16 au 22 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Demande de validation la traduction en français de 3 documents CSA+++*[»]> <<tiddler [[2019.09.19 - Actu : Demande de validation la traduction en français de 3 documents CSA]]>>=== 
* Blog : ''CAIQ V3 Updates''+++*[»]> <<tiddler [[2019.09.17 - Blog : 'CAIQ V3 Updates']]>>=== 
* Publ : ''Consensus Assessment Initiative Questionnaire (CAIQ) v3.1''+++*[»]> <<tiddler [[2019.09.17 - Publication : 'Consensus Assessment Initiative Questionnaire (CAIQ) v3.1']]>>=== 
* Actu : Appel à commentaires sur le document ''Best Practices in Implementing a Secure Microservices Architecture''+++*[»]> <<tiddler [[2019.09.16 - Actu : Appel à commentaires, document 'Best Practices in Implementing a Secure Microservices Architecture']]>>=== 
* Blog : ''Sidechains, beacon chains and why we shouldn't give up on Blockchain performance quite yet''+++*[»]> <<tiddler [[2019.09.18 - Blog : Sidechains, beacon chains and why we shouldn't give up on Blockchain performance quite yet]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.09.22 - Veille Hebdomadaire]] avec plus de 70 liens :
* __''À lire'' :__ Bilan sur la ''panne Amazon S3 du 28 février 2017''+++*[»]> 
|2019.09.16|Gremlin|![[The 2017 Amazon S3 Outage|https://www.gremlin.com/blog/the-2017-amazon-s-3-outage/]]|AWS Outage Lessons_Learnt|
=== 
* __''À lire'' :__ ''évaluer la sécurité de ses containers et de Kubernetes''+++*[»]> 
|2019.09.18|Container Journal|![[10 Questions To Assess Your Container and Kubernetes Security|https://containerjournal.com/topics/container-security/10-questions-to-assess-your-container-and-kubernetes-security/]]|Containers Kubernetes|
=== 
* ''Alertes'' : ''goHarbor.io''+++*[»]> <<tiddler [[2019.09.30 - Alertes]]>>=== 
* Rapports et sondages : ''Virtustream''+++*[»]> 
|2019.09.19|//Virtustream//|[[Services Experts to Accelerate Cloud Migrations and Drive Productivity Gains|https://www.businesswire.com/news/home/20190919005138/en/New-Research-Finds-70-Enterprises-Cloud-Managed]]|Report MSP|
|2019.09.20|//Virtustream//[>img[iCSF/flag_fr.png]]| → [[70% des entreprises font appel à des experts en service cloud managés pour accélérer les migrations|http://www.globalsecuritymag.fr/70-des-entreprises-font-appel-a,20190920,90905.html]]|Report MSP|
=== 
* Piratages et fuites de données : Erreurs de ''configurations''+++*[»]> 
|2019.09.20|//PaloAlto Networks//|![[Top 3 AWS Critical Cloud Misconfigurations and How to Remediate|https://blog.paloaltonetworks.com/2019/09/cloud-aws-critical-cloud-misconfigurations/]]|AWS Misconfigurations|
|2019.09.17|Cyber Security Hub|[[Behind The Data Breach: Understanding Cloud Security And Misconfigurations|https://www.cshub.com/cloud/articles/behind-the-data-breach-understanding-cloud-security-and-misconfigurations]]|Misconfigurations|
|2019.09.16|//PaloAlto Networks//|[[Top 10 Configuration Risks or Mistakes in Amazon Web Services (AWS) Deployment|https://pupuweb.com/configuration-risks-mistakes-aws/]]|AWS Risks Misconfigurations|
=== avec l'exemple de Malindo/Lion Air (S3)+++*[»]> 
|2019.09.17|Bleeping Computer|[[Millions of Lion Air Passenger Records Exposed and Exchanged on Forums|https://www.bleepingcomputer.com/news/security/millions-of-lion-air-passenger-records-exposed-and-exchanged-on-forums/]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|South China Morning Post| → [[Malindo Air confirms data breach, exposing millions of passengers' personal data|https://www.scmp.com/news/asia/southeast-asia/article/3027780/malindo-air-confirms-data-breach-exposing-millions]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|Malindo| → [[Press Statement on Data Breach|https://www.malindoair.com/news-events/2019/09/18/Press-Statement-on-Data-Breach]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Malindo| → [[Data breach investigation details|https://www.malindoair.com/news-events/2019/09/19/Data-breach-investigation-details]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Dark reading| → [[Lion Air the Latest to Get Tripped Up by Misconfigured AWS S3|https://www.darkreading.com/attacks-breaches/lion-air-the-latest-to-get-tripped-up-by-misconfigured-aws-s3-/d/d-id/1335864]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|InfoSecurity Mag| → [[Lion Air Breach Hits Millions of Passengers|https://www.infosecurity-magazine.com/news/lion-air-breach-hits-millions-of/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|Information Security Newspaper| → [[Lion Air Group data breach: 35 million passenger data is leaked from AWS servers|https://www.securitynewspaper.com/2019/09/20/lion-air-group-data-breach-35-million-passenger-data-is-leaked-from-aws-servers/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|ZDnet| → [[AWS says servers secure following Malindo Air data breach|https://www.zdnet.com/article/aws-says-servers-secure-following-malindo-air-data-breach/]]|Data_Leak AWS_S3 Malindo|
=== et de la fuite de données en Equateur
* Divers : Cloud et posture sécurité, annonces Oracle et Google (Anthos), conteneurs et bonnes pratiques, ..
!3 - Contacts
<<tiddler .ReplaceTiddlerTitle with: [[2019.09.22 - Newsletter Hebdomadaire]]>>
|>|>|>|!Alerte|
|2019.09.08|MITRE|[[CVE-2019-16097|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16097]]: ^^core/api/user.go [...] allows non-admin users to create admin accounts via the POST /api/users API^^|Harbor CVE-2019-16097|
|2019.09.18|//PaloAlto Networks//|[[Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)|https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/]]|Harbor CVE-2019-16097|
|2019.09.19|Bleeping Computer| → [[Critical Bug In Harbor Container Registry Gives Admin Access|https://www.bleepingcomputer.com/news/security/critical-bug-in-harbor-container-registry-gives-admin-access/]]|Harbor CVE-2019-16097|
|2019.09.20|GBHackers on Security| → [[Critical Vulnerability in Harbor let Hackers to Escalate Privilege by Sending Malicious Request|https://gbhackers.com/critical-vulnerability-harbor/]]|Harbor CVE-2019-16097|
|2019.09.02|Harbor|[[Disallow creating an admin user when registration #8917|https://github.com/goharbor/harbor/pull/8917]]|CVE-2019-16097 Patch|
|>|>|>|!|
|>|>|>||
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.22|
|2019.09.22|nixCraft|[[Amazon Linux AMI update installed packages for security|https://www.cyberciti.biz/faq/amazon-linux-ami-update-installed-packages-for-security/]]|AWS AMI|
|2019.09.22|Kitploit|[[ArmourBird CSF - Container Security Framework|https://www.kitploit.com/2019/09/armourbird-csf-container-security.html]]|[[Tools|Outils-GitHub]] ArmourBird_CSF|
|2019.09.22|//Tripwire//|[[Building a Foundation for "Smart" Steel Factories with Fog Computing, the Cloud and Cybersecurity|https://www.tripwire.com/state-of-security/ics-security/foundation-smart-steel-factories-fog-cloud-cybersecurity/]]|Smart_Factory|
|>|>|>|!2019.09.20|
|2019.09.20|GBHackers on Security|[[How Does World's Highly Secured Google Network Works? Google's Effort & Dedication|https://gbhackers.com/google-dedicate-cyber-security/]]|Google|
|2019.09.20|Security Boulevard|[[Debunking the 5 Biggest Cloud Security Myths|https://securityboulevard.com/2019/09/debunking-the-5-biggest-cloud-security-myths/]]|Risks|
|2019.09.20|Solutions Review|[[How Do You Adapt Security When You Move to the Cloud?|https://solutionsreview.com/cloud-platforms/how-do-you-adapt-security-when-you-move-to-the-cloud/]]|Recommendations|
|2019.09.20|Redmond Channel Partner|[[Microsoft Readies Raft of Updates to Office 365 and Azure Tools|https://rcpmag.com/articles/2019/09/20/office-365-azure-tools-updates.aspx]]|O365 Azure|
|2019.09.20|IT Pro[>img[iCSF/flag_fr.png]]|[[L'adoption du Cloud va plus vite que l'évolution de la sécurité|https://www.itpro.fr/ladoption-du-cloud-va-bien-plus-vite-que-levolution-de-la-securite/]]|Report Symantec|
|2019.09.20|//Sekurigi//[>img[iCSF/flag_fr.png]]|[[Plan de Reprise d'Activites : Le Cloud à la Rescousse ?|https://www.sekurigi.com/2019/09/plan-de-reprise-dactivites-le-cloud-a-la-rescousse/]]|BCP DRP|
|2019.09.20|//PaloAlto Networks//|![[Top 3 AWS Critical Cloud Misconfigurations and How to Remediate|https://blog.paloaltonetworks.com/2019/09/cloud-aws-critical-cloud-misconfigurations/]]|AWS Misconfigurations|
|2019.09.20|//Google Cloud//|[[How to deploy a Windows container on Google Compute Engine|https://cloud.google.com/blog/products/containers-kubernetes/how-to-deploy-a-windows-container-on-google-compute-engine]]|Containers Windows|
|2019.09.20|//Gartner//|![[The Future of Network Security Is in the Cloud|https://www.zscaler.com/gartner-secure-access-service-edge-sase]]|Gartner Network|
|2019.09.20|//Zscaler//| → [[New Report from Gartner Research: The Future of Network Security Is in the Cloud|https://www.zscaler.com/blogs/corporate/new-report-gartner-research-future-network-security-cloud]]|Gartner Network|
|2019.09.20|//Zscaler//[>img[iCSF/flag_fr.png]]| → [[L'avenir de la prévention contre la perte de données est dans le cloud|https://www.informatiquenews.fr/lavenir-de-la-prevention-contre-la-perte-de-donnees-est-dans-le-cloud-didier-guyomarch-zscaler-63501]]|DLP|
|2019.09.20|//Iland//|[[Use Office 365 Backup to Protect Data from Ransomware, Insider Threats and Accidents|https://pupuweb.com/office-365-backup-protect-data-ransomware-insider-threats-accidents/]]|O365|
|2019.09.20|//JumpCloud//|[[Cloud LDAP Solution|https://jumpcloud.com/blog/cloud-ldap-solution/]]|LDAP|
|2019.09.20|//CyberArk//|[[Eight Ways to Create a Pod|https://www.cyberark.com/threat-research-blog/eight-ways-to-create-a-pod/]]|Kubernetes|
|2019.09.20|//NuData//|[[Q&A: How cloud computing protects Canadians against hackers|http://www.digitaljournal.com/tech-and-science/technology/q-a-how-cloud-computing-protects-canadians-against-hackers/article/558298]]|Threats|
|2019.09.20|Redmond Channel Partner|[[Microsoft Readies Raft of Updates to Office 365 and Azure Tools|https://rcpmag.com/articles/2019/09/20/office-365-azure-tools-updates.aspx]]|Azure|
|>|>|>|!2019.09.19|
|2019.09.19|Compare The Cloud|[[Top five considerations to consider when migrating security to the cloud|https://www.comparethecloud.net/articles/top-five-considerations-to-consider-when-migrating-security-to-the-cloud/]]|Migration|
|2019.09.19|Security Boulevard|[[CLOUD Act, GDPR Changing Data Protection Game|https://securityboulevard.com/2019/09/cloud-act-gdpr-changing-data-protection-game/]]|CLOUD_Act GDPR|
|2019.09.19|The Register| → [[German Government Report Digital Sovereignty|https://www.theregister.co.uk/2019/09/19/german_government_report_digital_sovereignty/]]|Sovereignty Germany|
|2019.09.20|CBR Online|[[Is the German Government Set to Kiss Goodbye to Microsoft, Amid "Digital Sovereignty" Fears?|https://www.cbronline.com/news/germany-digital-sovereignty-bmi]]|Sovereignty Germany|
|2019.09.19|//F5 Networks//[>img[iCSF/flag_fr.png]]|[[Bonnes pratiques de sécurité pour les conteneurs logiciels|http://www.globalsecuritymag.fr/Bonnes-pratiques-de-securite-pour,20190919,90894.html]]|Containers|
|2019.09.19|//Alliancy//[>img[iCSF/flag_fr.png]]|[[Cloud et cybersécurité : deux systèmes antagoniques ?|https://www.alliancy.fr/expertise/cloud/2019/09/19/cloud-et-cybersecurite-2-systemes-antagoniques]]|Misc|
|2019.09.19|//Google Cloud//|[[3 steps to detect and remediate security anomalies with Cloud Anomaly Detection|https://cloud.google.com/blog/products/identity-security/3-steps-to-detect-and-remediate-security-anomalies-with-cloud-anomaly-detection]] (3/6)|Detection|
|2019.09.19|//Trendmicro//|[[Beyond The Standard CISO Cloud Security Guide|https://blog.trendmicro.com/beyond-the-standard-ciso-cloud-security-guide/]]|Strategy|
|2019.09.19|//Managed Methods//|[[CASB 2.0: Cloud Security, Visibility and Control|https://managedmethods.com/blog/casb-2-0-cloud-security-visibility-and-control/]]|CASB|
|2019.09.19|//Trustwave//|[[Overcoming Security Policy Management Hurdles in the Cloud|https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/overcoming-security-policy-management-hurdles-in-the-cloud/]]|Policy|
|2019.09.19|//Bitglass//|[[How to tackle security in the cloud era|https://www.teiss.co.uk/cyber-security-cloud/]]|Best_Practices|
|2019.09.19|//Nucleaus Cyber//|[[Sharing Data Inside and Outside of the (Drop)Box|https://vmblog.com/archive/2019/09/19/sharing-data-inside-and-outside-of-the-drop-box.aspx]]|Dropbox|
|2019.09.19|//ThreatStack//|[[10 Automated Testing Tools That Threat Stack Uses - and Why|https://www.threatstack.com/blog/10-automated-testing-tools-that-threat-stack-uses-and-why]]|Tools|
|2019.09.19|//McAfee//|[[Detecting and Preventing Insider Threats in the Cloud|https://www.skyhighnetworks.com/cloud-security-blog/detecting-and-preventing-insider-threats-in-the-cloud/]]|Insider_Threats|
|2019.09.19|//Fugue//|[[Cloud Network Security 101: AWS Security Groups vs NACLs|https://www.fugue.co/blog/cloud-network-security-101-aws-security-groups-vs-nacls]]|AWS Access_Controls|
|2019.09.19|//Caylent//|[[AWS CloudWatch Container Insights|https://caylent.com/aws-cloudwatch-container-insights]]|AWS Containers|
|2019.09.19|//Virtustream//|[[Services Experts to Accelerate Cloud Migrations and Drive Productivity Gains|https://www.businesswire.com/news/home/20190919005138/en/New-Research-Finds-70-Enterprises-Cloud-Managed]]|Report MSP|
|2019.09.20|//Virtustream//[>img[iCSF/flag_fr.png]]| → [[70% des entreprises font appel à des experts en service cloud managés pour accélérer les migrations|http://www.globalsecuritymag.fr/70-des-entreprises-font-appel-a,20190920,90905.html]]|Report MSP|
|2019.09.19|//Outpost24//|![[Top 10 Cloud security myths infographic|https://outpost24.com/blog/Top-10-Cloud-security-myths-infographic]]|Myths|
|>|>|>|!2019.09.18|
|2019.09.18|Container Journal|![[10 Questions To Assess Your Container and Kubernetes Security|https://containerjournal.com/topics/container-security/10-questions-to-assess-your-container-and-kubernetes-security/]]|Containers Kubernetes|
|2019.09.18|Container Journal|[[Kubernetes 1.16 Update Tackles Stability and Scale|https://containerjournal.com/topics/container-ecosystems/kubernetes-1-16-update-tackles-stability-and-scale/]]|Kubernetes|
|2019.09.18|//Rapid7//|[[Cloud Security Fundamentals: Strategies to Secure Cloud Environments|https://blog.rapid7.com/2019/09/18/cloud-security-fundamentals-strategies-to-secure-cloud-environments/]]|Strategy Best_Practices|
|2019.09.18|Silicon.fr[>img[iCSF/flag_fr.png]]|[[CLOUD Act : pour AWS, la parade est dans le chiffrement des données|https://www.silicon.fr/cloud-act-aws-chiffrement-des-donnees-260865.html]]|CLOUD_Act AWS Encryption|
|2019.09.18|Fortinet[>img[iCSF/flag_fr.png]]|[[Quatre concepts essentiels pour la sécurité du cloud|https://cyberexperts.tech/quatre-concepts-essentiels-pour-la-securite-du-cloud/]]|Misc|
|2019.09.18|//Cameyo//|[[Removing Yet Another Barrier to Cloud Migration: RDP Security|https://cameyo.com/removing-yet-another-barrier-to-cloud-migration-rdp-security/]]|RDP|
|2019.09.18|Redmond Channel Partner|[[Microsoft Unveils Service To Keep Azure Connections Private|https://rcpmag.com/articles/2019/09/18/microsoft-azure-connections-private.aspx]]|Azure|
|>|>|>|!2019.09.17|
|2019.09.17|Dark Reading|![[Five Common Cloud Configuration Mistakes|https://www.darkreading.com/cloud/five-common-cloud-configuration-mistakes/a/d-id/1335768]]|Miconfigurations|
|2019.09.17|HelpNet Security|[[Five ways to manage authorization in the cloud|https://www.helpnetsecurity.com/2019/09/17/manage-authorization-in-the-cloud/]]|Authorization|
|2019.09.17|Security Boulevard|[[Who's Financially Responsible for Cybersecurity Breaches?|https://securityboulevard.com/2019/09/whos-financially-responsible-for-cybersecurity-breaches/]]|Breaches|
|2019.09.17|Cyber Security Hub|[[Behind The Data Breach: Understanding Cloud Security And Misconfigurations|https://www.cshub.com/cloud/articles/behind-the-data-breach-understanding-cloud-security-and-misconfigurations]]|Misconfigurations|
|2019.09.17|CIO Dive|[[Skepticism slows cloud and SaaS adoption|https://www.ciodive.com/news/skepticism-slows-cloud-and-saas-adoption/563017/]]|SaaS|
|2019.09.17|ComputerWeekly|[[Top five cloud storage pitfalls|https://www.computerweekly.com/feature/Top-five-cloud-storage-pitfalls]]|Storage|
|2019.09.17|Compare The Cloud|[[A guide to cloud-based Digital Asset Management|https://www.comparethecloud.net/articles/a-guide-to-cloud-based-digital-asset-management/]]|Asset_Management|
|2019.09.17|Infosec Institute|[[SSCP versus CCSP: Cloud security or systems security?|https://resources.infosecinstitute.com/sscp-versus-ccsp-cloud-security-or-systems-security/]]|Training|
|2019.09.17|The Register|[[VMware on AWS: Low-risk option or security blanket for those who don't like change?|https://www.theregister.co.uk/2019/09/17/vmware_on_aws_why_and_why_not/]]|AWS VMware|
|2019.09.17|Bleeping Computer|[[Millions of Lion Air Passenger Records Exposed and Exchanged on Forums|https://www.bleepingcomputer.com/news/security/millions-of-lion-air-passenger-records-exposed-and-exchanged-on-forums/]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|South China Morning Post| → [[Malindo Air confirms data breach, exposing millions of passengers' personal data|https://www.scmp.com/news/asia/southeast-asia/article/3027780/malindo-air-confirms-data-breach-exposing-millions]]|Data_Leak AWS_S3 Malindo|
|2019.09.18|Malindo| → [[Press Statement on Data Breach|https://www.malindoair.com/news-events/2019/09/18/Press-Statement-on-Data-Breach]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Malindo| → [[Data breach investigation details|https://www.malindoair.com/news-events/2019/09/19/Data-breach-investigation-details]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|Dark reading| → [[Lion Air the Latest to Get Tripped Up by Misconfigured AWS S3|https://www.darkreading.com/attacks-breaches/lion-air-the-latest-to-get-tripped-up-by-misconfigured-aws-s3-/d/d-id/1335864]]|Data_Leak AWS_S3 Malindo|
|2019.09.19|InfoSecurity Mag| → [[Lion Air Breach Hits Millions of Passengers|https://www.infosecurity-magazine.com/news/lion-air-breach-hits-millions-of/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|Information Security Newspaper| → [[Lion Air Group data breach: 35 million passenger data is leaked from AWS servers|https://www.securitynewspaper.com/2019/09/20/lion-air-group-data-breach-35-million-passenger-data-is-leaked-from-aws-servers/]]|Data_Leak AWS_S3 Malindo|
|2019.09.20|ZDnet| → [[AWS says servers secure following Malindo Air data breach|https://www.zdnet.com/article/aws-says-servers-secure-following-malindo-air-data-breach/]]|Data_Leak AWS_S3 Malindo|
|2019.09.17|//Tripwire//|![[Concerns and Challenges Towards an Effective Cloud Security|https://www.tripwire.com/state-of-security/security-data-protection/cloud/concerns-challenges-towards-effective-cloud-security/]]|Security_Posture|
|2019.09.17|//StackRox//|[[Why securing Kubernetes and containers can't come 'after the app'|https://siliconangle.com/2019/09/17/why-securing-kubernetes-and-containers-cant-come-after-the-app-sumoilluminate-startupoftheweek/]]|Kubernetes|
|2019.09.17|//Alston & Bird//|[[Proposed Regulations Classifying Cloud Transactions and Digital Content Released|https://www.alston.com/en/insights/publications/2019/09/proposed-regulations-classifying-cloud]]|Regulations|
|2019.09.17|//CloudRanger//|[[Self-service Disaster Recovery for AWS environments|https://cloudranger.com/self-service-disaster-recovery-for-aws-environments/]]|AWS DRaaS|
|2019.09.17|//Rhino Security Labs//|[[Abusing VPC Traffic Mirroring in AWS|https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws/]]|AWS|
|2019.09.17|//Microsoft Azure//|[[SAP on Azure Architecture - Designing for security|https://azure.microsoft.com/en-us/blog/sap-on-azure-architecture-designing-for-security/]]|Azure SAP|
|2019.09.17|//Microsoft Azure//|[[Announcing Azure Private Link|https://azure.microsoft.com/en-us/blog/announcing-azure-private-link/]]|Azure|
|2019.09.17|//NetSparker//|[[7 Crucial Components of Cyber Incident Recovery|https://www.netsparker.com/blog/web-security/incident-recovery/]]|Recovery|
|2019.09.17|//Caylent//|[[50+ Useful Kubernetes Tools|https://caylent.com/50-useful-kubernetes-tools]]|Kubernetes Tools|
|2019.09.17|//Google Cloud//|[[How Google adopted BeyondCorp: Part 3 (tiered access)|https://security.googleblog.com/2019/09/how-google-adopted-beyondcorp-part-3.html]] (3/4)|Tiered_Access|
|2019.09.17|Nino Crudele|[[Advanced Security automation in Microsoft Azure|https://ninocrudele.com/advanced-security-automation-in-microsoft-azure]]|Azure Automation|
|>|>|>|!2019.09.16|
|2019.09.16|IT Expresso[>img[iCSF/flag_fr.png]]|[[!CLOUD Act : pourquoi ça vous concerne|https://www.itespresso.fr/cloud-act-pourquoi-ca-vous-concerne-210997.html]]|CLOUD_Act|
|2019.09.16|ZDNet[>img[iCSF/flag_fr.png]]|[[Le cloud hybride, une approche intéressante pour la sécurité des données et de la continuité d'activité|https://www.zdnet.fr/actualites/le-cloud-hybride-une-approche-interessante-pour-la-securite-des-donnees-et-de-la-continuite-d-activite-39890677.htm]]|Hybrid_Cloud|
|2019.09.16|Gremlin|![[The 2017 Amazon S3 Outage|https://www.gremlin.com/blog/the-2017-amazon-s-3-outage/]]|AWS Outage Lessons_Learnt|
|2019.09.16|DZone|[[Getting Started With AWS Networking Services - Part 2|https://dzone.com/articles/getting-started-with-aws-networking-services-part]] (2/2)|AWS|
|2019.09.16|The Hacker News|[[How Cloud-Based Automation Can Keep Business Operations Secure|https://thehackernews.com/2019/09/how-cloud-based-automation-can-keep.html]]|M%isc|
|2019.09.16|NextGov|[[Agencies to Security Industry: Automate Cloud Compliance Faster|https://www.nextgov.com/ideas/2019/09/agencies-security-industry-automate-cloud-compliance-faster/159895/]]|Compliance|
|2019.09.16|VPNmentor|[[Report: Ecuadorian Breach Reveals Sensitive Personal Data|https://www.vpnmentor.com/blog/report-ecuador-leak/]]|DataLeak ElasticSearch Ecuador|
|2019.09.16|ZDNet| → [[Database leaks data on most of Ecuador's citizens, including 6.7 million children|https://www.zdnet.com/article/database-leaks-data-on-most-of-ecuadors-citizens-including-6-7-million-children/]]|DataLeak ElasticSearch Ecuador|
|2019.09.20|CyberSecurity Hub| → [[Incident Of The Week: Cloud Misconfiguration Exposes 20 Million Ecuador Citizen Records|https://www.cshub.com/data/articles/incident-of-the-week-cloud-misconfiguration-exposes-20-million-ecuador-citizen-records]]|DataLeak ElasticSearch Ecuador|
|2019.09.16|//PaloAlto Networks//|[[Top 10 Configuration Risks or Mistakes in Amazon Web Services (AWS) Deployment|https://pupuweb.com/configuration-risks-mistakes-aws/]]|AWS Risks Misconfigurations|
|2019.09.16|//AWS//|[[You all know why you should encrypt your cloud data – now learn where and how…|https://www.theregister.co.uk/2019/09/16/aws_encryption_webinar/]]|AWS Encryption|
|2019.09.16|//Google Cloud//|[[Anthos simplifies application modernization with managed service mesh and serverless for your hybrid cloud|https://cloud.google.com/blog/topics/hybrid-cloud/anthos-simplifies-application-modernization-with-managed-service-mesh-and-serverless-for-your-hybrid-cloud]]|GCP Anthos|
|2019.09.17|Container Journal| → [[Google Extends Scope of Anthos Cloud Platform|https://containerjournal.com/topics/container-management/google-extends-scope-of-anthos-cloud-platform/]]|GCP Anthos|
|2019.09.16|//Avanan//|[[5 Reasons Microsoft Safe Links Make Office 365 Less Safe|https://www.avanan.com/resources/microsoft-atp-safe-links]]|O365|
|2019.09.16|//Oracle//|[[Oracle Cloud Automates Security for Critical Workloads|https://www.prnewswire.com/news-releases/oracle-cloud-automates-security-for-critical-workloads-300918989.html]]|Oracle|
[>img[iCSF/cloud-security-alliance-fr.png]]La [[Cloud Security Alliance]] a lancé la traduction de 3 outils majeurs dans 10 langues : allemand, danois, espagnol, italien, japonais, néerlandais, portugais, roumain, suédois, et ... français.
Il s'agit de feuilles Excel dans lesquelles il vous est demandé d'adapter les traductions ou de les commenter.
Pour chaque document, les 10 traductions sont dans un répertoire //Google Drive// dédié, et pour travailler sur la version française, il faut sélectionner le document commençant par "''FR-''"

Les 3 documents sont les suivants :
* "''Cloud Controls Matrix''" (CCM) : document "FR-CSA_CCM_v.3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99c/|https://cloudsecurityalliance.fr/go/j99c/]]''
* "''Consensus Assessments Initiative Questionnaire''" (CAIQ) : document "FR-CAIQ_v3.0.1-09-01-2017_FINAL.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99q/|https://cloudsecurityalliance.fr/go/j99q/]]''
* "''Code of Conduct''" du "''Privacy Level Agreement''" (PLA CoC) : document "FR-CoC_GDPR_Annex_1_Compliance_Assessment_Template.xlsx"
:→ ''[[CloudSecurityAlliance.fr/go/j99p/|https://cloudsecurityalliance.fr/go/j99p/]]''

La date limite initialement fixée au 2 octobre 2019 a été repoussée au ''25 octobre 2019''.
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Sidechains, beacon chains and why we shouldn't give up on Blockchain performance quite yet//"
[>img(150px,auto)[iCSA/J8QBO.png]]Article de blog publié le 18 septembre 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//If you've been in IT you've probably learned one of the simple lessons:
* Scaling out is hard and can be expensive, but scaling up is easy and even more expensive. In simple terms if you can scale out you can keep costs down, ideally at a linear growth rate (e.g. handling twice as much web traffic by simply buying a second server).
* Scaling up is often easier, you want code to run twice as fast, simply get a computer that has a much faster CPU (both capability and clock rate wise), but scaling up quickly hits boundaries (like what's the fastest single system you can buy).
* What usually ends up happening is you try to identify as many spots as possible where you can turn serial operations into parallel operations, and do them not only on multiple systems, but at the same time. 

__''Scaling for Blockchain''__
Blockchains are no different. The majority of current Blockchain technologies are sold as decentralized and massively parallel, and they are. But while most current Blockchain technologies create multiple blocks at the same time, only one block is picked or "wins consensus" at which point all the other work is thrown out, and a new block is started on (so not very efficient). Bitcoin is an extreme example with each block taking about 10 minutes to create. So despite having millions of systems mining for a valid Bitcoin it can only do a total of 1 block every 10 minutes (worse, this is a chosen value for a variety of economic reasons, in other words an arbitrary limitation that probably won't change much in the future). Even if you are mining large blocks to improve throughput this 10 minute creation time introduces a major amount of latency; payments that are processed on the main Bitcoin Blockchain take at least 10 minutes to clear and sometimes longer. Imagine trying to use a Bitcoin payment system at the supermarket and having to wait 10 or more minutes for the payment system to tell you if the payment went through or not before you can leave with your groceries. The technology and choices used by the Ethereum Blockchain are better, with blocks taking 10 to 19 seconds to create, but this is still a lot longer than most electronic payment systems take to process and approve a payment. 

__''Using Side Chains (or shared chains)''__
[>img(50%,auto)[Ethereum 2.0 overall architecture. Original diagram by Hsiao-Wei Wang|iCSA/J9IBS.png]]The obvious solution is to not only allow for more parallel block creation but to pick more than one winner. There are a number of names for the various strategies here but they are often referred to as side chains or shard chains, or more technology specific names like Ethereum's "beacon chain" proposal. As you can see from the diagram below the beacon chain is a non trivial matter, if you want to understand it there are a number of good write ups on it.

So yet again we have a classic bad news/good news situation. The bad news is that the current Blockchain technology doesn't scale very well, typically has high latencies, and low throughput. The good news is that the fundamental concept of Blockchain (an immutable distributed ledger technology with distributed consensus mechanisms) is good, and people are working on the scaling, latency and throughput, and more.//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9ib/]] sur le blog de la CSA


!Mise à jour de CAIQ en version 3.1
<<<
[>img(200px,auto)[iCSA/J9HBC.png]]//Cloud Security Alliance (CSA) would like to present the next version of the [[Consensus Assessments Initiative Questionnaire (CAIQ)]] v3.1.

The CAIQ offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services, providing security control transparency. It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM). Therefore, it helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.

CAIQ v3.1 represents a minor update to the previous CAIQ v3.0.1. In addition to improving the clarity and accuracy, it also supports better auditability of the CCM controls. The new updated version aims to not only correct errors but also appropriately align and improve the semantics of unclear questions for corresponding CCM v3.0.1 controls. In total, 49 new questions were added, and 25 existing ones were revised.

For this new CAIQ version, CSA took into account the combined comprehensive feedback that was collected over the years from its partners, the industry and the [[CCM working group|https://cloudsecurityalliance.org/research/working-groups/cloud-controls-matrix/]].//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9hc/]] sur le blog de la CSA.
&rArr; [[Consensus Assessments Initiative Questionnaire (CAIQ) v3.1|https://CloudSecurityAlliance.fr/go/j9hq/]]
!"//Consensus Assessment Initiative Questionnaire (CAIQ) v3.1'//"
<<<
[>img(200px,auto)[iCSA/J9HBC.png]]//The Consensus Assessment Initiative Questionnaire (CAIQ) provides industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS offerings, providing security control transparency. It helps cloud customers gauge the security posture of prospective cloud service providers to determine if their cloud services are suitably secure.
The CAIQ v3.1 is an update to the existing CAIQ that fixes errors, non-alignment or unclear questions. To participate in this review, please review ONLY questions in Column E. Let us know if they continue to be unclear, incorrect or align poorly with the corresponding CCM control.
We are not accepting suggestions for completely new questions.//
<<<
&rArr; ''[[CloudSecurityAlliance.fr/go/j9hq/|https://CloudSecurityAlliance.fr/go/j9hq/]]
!//Best Practices in Implementing a Secure Microservices Architecture//[>img(100px,auto)[iCSA/CSAdoc.png]]
Un appel à commentaires dont la date de clôture est le ''16 octobre 2019'' : "''Best Practices in Implementing a Secure Microservices Architecture''".
<<<
//Application containers and a microservices architecture are being used to design, develop, and deploy applications leveraging agile software development approaches such as Development Operations. Security needs to be embedded into these software development approaches. This document serves to identify best practices in securing microservices in the engineering of trustworthy secure systems through the lens of the Developer, Operator, and Architect.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j9gb/|https://cloudsecurityalliance.fr/go/j9gb/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 9 au 15 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Demande de ''validation de la traduction en français'' de 3 documents documents CSA : ''Cloud Controls Matrix'' (''CCM'')+++*[»]> <<tiddler [[2019.09.09 - Actu : Traduction de la 'Cloud Controls Matrix' (CCM)]]>>===, ''Consensus Assessments Initiative Questionnaire'' (''CAIQ'')+++*[»]> <<tiddler [[2019.09.09 - Actu : Traduction du 'Consensus Assessments Initiative Questionnaire' (CAIQ)]]>>===, et ''Code of Conduct'' du ''Privacy Level Agreement'' (''PLA CoC'')+++*[»]> <<tiddler [[2019.09.09 - Actu : Traduction du 'Code of Conduct' du 'Privacy Level Agreement' (PLA CoC)]]>>=== 
* Blog : ''Egregious 11 Meta-Analysis Part 3: Weak Control Plane and DoS''+++*[»]> <<tiddler [[2019.09.12 - Blog : 'Egregious 11 Meta-Analysis Part 3: Weak Control Plane and DoS']]>>=== 
* Blog : article "''Open API Survey Report''"+++*[»]> <<tiddler [[2019.09.11 - Blog : 'Open API Survey Report']]>>=== 
* Publ : document "''Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud'''"+++*[»]> <<tiddler [[2019.09.05 - Publication : Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud']]>>=== 
* Publ : document "''Mapping of 'The Guidelines' Security Recommendations to CCM''"+++*[»]> <<tiddler [[2019.09.05 - Publication : Mapping of 'The Guidelines' Security Recommendations to CCM]]>>=== 
* Actu : Les formations lors du ''Congrès CSA EMEA'' en Novembre à Berlin+++*[»]> <<tiddler [[2019.09.12 - Actu : Les formations lors du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
* Actu : Le ''CCSK'' est une certification reconnue par le Ministère des Anciens Combattants américain+++*[»]> <<tiddler [[2019.09.10 - Actu : Le CCSK est une certification reconnue par le Ministère des Anciens Combattants américain]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.09.15 - Veille Hebdomadaire]] avec une quarantaine de liens :
* __''À lire'' :__ Thèse professionnelle du Mastere Spécialisé ISEP "Expert Cloud Computing"+++*[»]> <<tiddler [[Partenariats - ISEP-FC - Masteres Spécialisés]]>>=== sur la commercialisation des données dans le Cloud (//Nuageo//)+++*[»]> 
|2019.09.12|//Nuageo//|[[Vos données, leur valeur et le bon Cloud pour les vendre|https://www.nuageo.fr/2019/09/donnees-valeur-cloud-vendre/]]|Data Management|
|2019.09.12|ISEP| → Thèse [[Le Cloud Computing peut-il aider l'entreprise à commercialiser ses données ?|https://formation-continue.isep.fr/theses-professionnelles/]] dans le cadre du [[Mastere Spécialisé ISEP 'Expert Cloud Computing'|Partenariats - ISEP-FC - Masteres Spécialisés]]|Data Management|
=== 
* Pannes : ''Box''
* Rapports et sondages : Publication par l'''OWASP'' du draft "''API Security Top 10''"+++*[»]> 
|2019.09.13|OWASP|[[API Security Top 10 Release Candidate is Here!|https://www.owasp.org/index.php/OWASP_API_Security_Project]] ([[document PDF|https://www.owasp.org/images/5/59/API_Security_Top_10_RC.pdf]])|APIs|
|2019.09.12|Dark Reading| → [[APIs Get Their Own Top 10 Security List|https://www.darkreading.com/application-security/apis-get-their-own-top-10-security-list/d/d-id/1335786]]|APIs|
=== 
* Divers : Brexit+++*[»]> 
|2019.09.12|The Register|![[Cloud, internet biz will take a Yellowhammer to the head in 'worst case' no-deal Brexit|https://www.theregister.co.uk/2019/09/12/cloud_providers_yellowhammer_brexit/]] (rapport [[YellowHammer|https://regmedia.co.uk/2019/09/11/latest_yellowhammer_planning.pdf]])|Brexit|
===, bonnes pratiques de sécurisation Cloud (//CyberArk//+++*[»]> 
|2019.09.12|//CyberArk//|![[Best Practices for Securing Cloud-Based Applications and Infrastructure|https://www.cyberark.com/blog/best-practices-for-securing-cloud-based-applications-and-infrastructure/]]|Best_Practices|
===), réflexions sur la sécurité d'Office 365 (//Fox-IT//+++*[»]> 
|2019.09.11|//Fox IT//|![[Office 365: prone to security breaches?|https://blog.fox-it.com/2019/09/11/office-365-prone-to-security-breaches/]]|O365 Risks Detection|
===), CCAT (outil de sécurisation de containers+++*[»]> 
|2019.09.09|The Daily Swig|[[Open source tool helps test security of cloud containers|https://portswigger.net/daily-swig/open-source-tool-helps-test-security-of-cloud-containers]]|[[Tools|Outils-GitHub]] CCAT|

|[[Cloud Container Attack Tool (CCAT)|https://github.com/RhinoSecurityLabs/ccat]]|[[RhinoSecurity|https://rhinosecuritylabs.com/]]|Tool for testing security of container environment|
===)
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.14|
|2019.09.14|Global Security Mag[>img[iCSF/flag_fr.png]]|[[Club de la Presse Informatique B2B : Le Cloud plus sécurisé que le fait maison !|http://www.globalsecuritymag.fr/Club-de-la-Presse-Informatique-B2B,20190911,90599.html]]|Trends|
|>|>|>|!2019.09.13|
|2019.09.13|OWASP|[[API Security Top 10 Release Candidate is Here!|https://www.owasp.org/index.php/OWASP_API_Security_Project]] ([[document PDF|https://www.owasp.org/images/5/59/API_Security_Top_10_RC.pdf]])|APIs|
|2019.09.12|Dark Reading| → [[APIs Get Their Own Top 10 Security List|https://www.darkreading.com/application-security/apis-get-their-own-top-10-security-list/d/d-id/1335786]]|APIs|
|2019.09.13|HelpNet Security|[[The rise of modern applications, DevSecOps and the intelligence economy|https://www.helpnetsecurity.com/2019/09/13/multi-cloud-adoption-growth/]]|Report Sumo_Logic|
|2019.09.13|//CCSI//|[[Expert Opinion on Avoiding Common Cloud Protection Pitfalls|https://www.ccsinet.com/blog/avoiding-cloud-pitfalls/]]|Recommendations|
|2019.09.13|//MalwareBytes//|[[Hacking with AWS: incorporating leaky buckets into your OSINT workflow|https://blog.malwarebytes.com/researchers-corner/2019/09/hacking-with-aws-incorporating-leaky-buckets-osint-workflow/]]|OSINT AWS|
|2019.09.13|//VMblog//|[[Top 7 Cloud Computing Security Threats|https://vmblog.com/archive/2019/09/13/top-7-cloud-computing-security-threats.aspx]]|Threats|
|>|>|>|!2019.09.12|
|2019.09.12|The Register|![[Cloud, internet biz will take a Yellowhammer to the head in 'worst case' no-deal Brexit|https://www.theregister.co.uk/2019/09/12/cloud_providers_yellowhammer_brexit/]] (rapport [[YellowHammer|https://regmedia.co.uk/2019/09/11/latest_yellowhammer_planning.pdf]])|Brexit|
|2019.09.12|Network World|[[IBM z15 mainframe, amps-up cloud, security features|https://www.networkworld.com/article/3438542/ibm-z15-mainframe-amps-up-cloud-security-features.html]]|Mainframes|
|2019.09.12|//Nuageo//[>img[iCSF/flag_fr.png]]|[[Vos données, leur valeur et le bon Cloud pour les vendre|https://www.nuageo.fr/2019/09/donnees-valeur-cloud-vendre/]]|Data Management|
|~|ISEP|Thèse [[Le Cloud Computing peut-il aider l'entreprise à commercialiser ses données ?|https://formation-continue.isep.fr/theses-professionnelles/]] dans le cadre du [[Mastere Spécialisé ISEP 'Expert Cloud Computing'|Partenariats - ISEP-FC - Masteres Spécialisés]]|~|
|2019.09.12|//Managed Methods//|[[8 Business Challenges A CASB Solves|https://managedmethods.com/blog/casb-solves-business-challenges/]]|CASB|
|2019.09.12|//Google Cloud//|[[Catch web app vulnerabilities before they hit production with Cloud Web Security Scanner|https://cloud.google.com/blog/products/identity-security/catch-web-app-vulnerabilities-before-they-hit-production-with-cloud-web-security-scanner]] (2/6)|Tools|
|2019.09.11|//Google Cloud//| → [[How to use Cloud Security Scanner - Getting Started with Cloud Security Command Center (vidéo)|https://www.youtube.com/watch?v=goJ_G2ygdSA]]|Tools|
|2019.09.12|//Box//|[[Incident Report for Box|https://status.box.com/incidents/fhx3xs37vvgf?u=bdr8lqbn0f1q]]|Outage Box|
|2019.09.12|//CyberArk//|![[Best Practices for Securing Cloud-Based Applications and Infrastructure|https://www.cyberark.com/blog/best-practices-for-securing-cloud-based-applications-and-infrastructure/]]|Best_Practices|
|2019.09.12|//CloudCheckr//|[[Government Cloud Services vs. Agency Data Centers|https://cloudcheckr.com/uncategorized/government-cloud-services-vs-data-centers/]]|Government|
|2019.09.12|//Microsoft//|[[Cloud backup and recovery for the Microsoft Authenticator app on Android now available |https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Cloud-backup-and-recovery-for-the-Microsoft-Authenticator-app-on/ba-p/566369]]|Microsoft Authentication|
|2019.09.12|ZDnet| → [[Microsoft Authenticator on Android gets cloud backup and recovery|https://www.zdnet.com/article/microsoft-authenticator-on-android-gets-cloud-backup-and-recovery/]]|Microsoft Authentication|
|2019.09.12|//Imperva//|[[APIs Ease Customer Interaction - and External Attacks. Here's how to Protect Them|https://www.imperva.com/blog/apis-ease-customer-interaction-and-external-attacks-heres-how-to-protect-them/]]|APIs|
|2019.09.12|//AppSecCo//|[[Presenting a modern cloud based vulnerable Android app - VyAPI|https://blog.appsecco.com/vyapi-the-modern-cloud-based-vulnerable-hybrid-android-app-ee300a9d60ed]]|[[Tools|Outils-GitHub]]|
|2019.09.12|//AppSecCo//|[[The Story of how I made a vulnerable Android App VyAPI|https://blog.appsecco.com/vyapi-the-story-of-a-vulnerable-hybrid-android-app-aee44f6d1f2d]]|[[Tools|Outils-GitHub]]	|
|2019.09.12|//Rancher Labs//|[[Your Guide to Container Security|https://rancher.com/complete-guide-container-security/]]|Containers|
|2019.09.12|Nino Crudele|[[HACKAZURE – How To – Global scan of all public IP addresses on Azure|https://ninocrudele.com/hackazure-how-to-global-scan-of-all-public-ip-addresses-on-azure]]|Azure Scanning|
|2019.09.12|Nino Crudele|[[HACKAZURE – Azure Bastion – What you need to know|https://ninocrudele.com/hackazure-azure-bastion-what-you-need-to-know]]|Azure Bastion|
|>|>|>|!2019.09.11|
|2019.09.11|L'Informaticien[>img[iCSF/flag_fr.png]]|![[Le Cloud Made in France|https://www.linformaticien.com/dossiers/le-cloud-made-in-france.aspx]]|France|
|2019.09.11|Place de l'IT[>img[iCSF/flag_fr.png]]|[[Alain Bouillé, Cesin: "Le multi-cloud au cœur des préoccupations de cybersécurité"|https://placedelit.com/interview-alain-bouille-cesin-multi-cloud-cybersecurite/]]|Multi_Cloud|
|2019.09.11|VMblog|[[Benefits and Challenges of a Cloud Digital Asset Management Infrastructure|https://vmblog.com/archive/2019/09/11/benefits-and-challenges-of-a-cloud-digital-asset-management-infrastructure.aspx]]|Asset_Management|
|2019.09.09|Bleeping Computer|[[Microsoft to Improve Office 365 Phishing Email Notifications|https://www.bleepingcomputer.com/news/security/microsoft-to-improve-office-365-phishing-email-notifications/]]|O365 Phishing|
|2019.09.11|Cloud Native Computing Foundation|[[Kubernetes IoT Edge WG: Identifying Security Issues at the Edge|https://www.cncf.io/blog/2019/09/11/kubernetes-iot-edge-wg-identifying-security-issues-at-the-edge/]]|Kubernetes IoT|
|2019.09.11|CBR Online|[[Slack Rolls Out European Data Residency|https://www.cbronline.com/news/slack-european-data-residency]]|Slack GDPR|
|2019.09.11|//Fox IT//|![[Office 365: prone to security breaches?|https://blog.fox-it.com/2019/09/11/office-365-prone-to-security-breaches/]]|O365 Risks Detection|
|2019.09.11|//Park My Cloud//|[[How Much Do the Differences Between Cloud Providers Actually Matter?|https://www.parkmycloud.com/blog/cloud-providers/]]|Misc|
|2019.09.11|//Menlo Security//|[[Internet Isolation Cloud: Introducing a New Paradigm|https://www.menlosecurity.com/blog/internet-isolation-cloud-introducing-a-new-paradigm]]|Isolation|
|2019.09.11|//Tuffin//|[[Restoring the balance between agility and security in the cloud|https://www.itproportal.com/features/restoring-the-balance-between-agility-and-security-in-the-cloud/]]|Recommendations|
|2019.09.11|//Rancher Labs//|[[DevOps and Containers, On-Prem or in the Cloud|https://rancher.com/devops-containers-prem-cloud/]]|DevSecOps Containers|
|2019.09.11|//Rancher Labs//|![[Container Security Tools Breakdown|https://rancher.com/container-security-tools-breakdown/]] (mise à jour)|Containers Tools|
|2019.09.11|//Rancher Labs//|[[Introduction to Container Security|https://rancher.com/blog/2018/2018-09-12-introduction-to-container-security-1/]]|Containers|
|2019.09.11|//Rancher Labs//|[[Comparing 10 Docker Container Monitoring Solutions for Rancher|https://rancher.com/comparing-10-container-monitoring-solutions-rancher/]]|Containers Monitoring|
|2019.09.11|//Rancher Labs//|[[What is a CaaS? Containers as a Service, Defined|https://rancher.com/caas-containers-service-defined/]] (mise à jour)|Containers|
|2019.09.11|//Rancher Labs//|[[An Introduction to Containers|https://rancher.com/blog/2019/an-introduction-to-containers/]] (mise à jour)|Containers|
|2019.09.11|//Rancher Labs//|![[101 More Security Best Practices for Kubernetes|https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/]]|Kubernetes Best_Practices|
|2019.09.11|//Rancher Labs//|[[Kubernetes vs Docker Swarm: Comparison of Two Container Orchestration Tools|https://rancher.com/blog/2019/kuberntes-versus-docker-swarm/]] (mise à jour)|Container Orchestration Kubernetes Docker_Swarm|
|2019.09.11|//Rancher Labs//|[[Containers vs. Serverless Computing|https://rancher.com/containers-vs-serverless-computing/]] (mise à jour)|Containers Serveless|
|2019.09.11|//Rancher Labs//|[[The Similarities and Differences Between Windows and Linux Containers|https://rancher.com/the-similarities-and-differences-between-windows-and-linux-containers/]] (mise à jour)|Containers|
|2019.09.11|//Rancher Labs//|[[Playing Catch-up with Docker and Containers|https://rancher.com/playing-catch-docker-containers/]] (mise à jour)|Docker Containers|
|>|>|>|!2019.09.10|
|2019.09.10|DZone|[[Getting Started With AWS Networking Services - Part 1|https://dzone.com/articles/understanding-aws-networking]] (1/2)|AWS|
|2019.09.10|ZDnet|[[Microsoft: Office 365 gets automated response to phishing, nasty links, malware|https://www.zdnet.com/article/microsoft-office-365-gets-automated-response-to-phishing-nasty-links-malware/]]|O365 ATP|
|2019.09.10|Security Boulevard|[[How Security Can Lead in Cloud-Dependent Business Innovation|https://securityboulevard.com/2019/09/how-security-can-lead-in-cloud-dependent-business-innovation/]]|Misc|
|2019.09.10|Container Journal|[[Kubernetes in the Enterprise: A Primer|https://containerjournal.com/topics/container-ecosystems/kubernetes-in-the-enterprise-a-primer/]]|Kubernetes|
|2019.09.10|HelpNet Security|[[Office 365 security: Automated incident response based on playbooks|https://www.helpnetsecurity.com/2019/09/10/office-365-incident-response/]]|O365 Incident_Response|
|2019.09.10|NextGov|[[DISA is Merging Its Cyber Operations Into a Single Cloud-Based Platform|https://www.nextgov.com/cybersecurity/2019/09/disa-merging-its-cyber-operations-single-cloud-based-platform/159739/]]|Government|
|2019.09.10|SANS|[[How to Build a Threat Detection Strategy in Amazon Web Services (AWS)|https://www.sans.org/reading-room/whitepapers/analyst/build-threat-detection-strategy-amazon-web-services-aws-39155]]|AWS Detection|
|2019.09.10|//Microsoft//|[[Monitoring on Azure HDInsight part 4: Workload metrics and logs|https://azure.microsoft.com/en-us/blog/monitoring-on-azure-hdinsight-part-4-workload-metrics-and-logs/]] (4/4)|Azure Monitoring|
|2019.09.10|//Thales Security//|[[What will be your decisive moment to secure your cloud applications in a Zero Trust world?|https://blog.thalesesecurity.com/2019/09/10/what-will-be-your-decisive-moment-to-secure-your-cloud-applications-in-a-zero-trust-world/]]|Zero_Trust|
|2019.09.10|//CyberSecurity Help//|[[Command injection in Docker (CVE-2019-13139)|https://www.cybersecurity-help.cz/vdb/SB2019091002]]|CVE-2019-13139|
|2019.09.10|//Netwrix//|[[70% of educational orgs don't have an appropriate cloud security budget|https://www.helpnetsecurity.com/2019/09/10/education-cloud-security-budget/]]Report Netwrix|
|2019.09.10|//ManagedMethods//|[[5 Cloud Application Security Best Practices|https://managedmethods.com/blog/cloud-application-security-best-practices/]]|Best_Practices|
|2019.09.09|//BitDefender//|[[Top Inherent Risks with Cloud Security|https://businessinsights.bitdefender.com/top-risks-inherent-with-cloud-security]]|Risks|
|2019.09.10|//DivvyCloud//|[[Remediating Misconfigurations to Keep Your Cloud Out of the News|https://divvycloud.com/blog/remediating-misconfigurations-keeping-your-cloud-out-of-news/]]|Misconfigurations|
|2019.09.10|//Outpost24//|[[Cloud security: an inconvenient truth about IT transformation|https://outpost24.com/blog/Cloud-security-an-inconvenient-truth-about-IT-transformation]]|Misc|
|2019.09.10|//Security Intelligence//|[[Podcast: Cloud Security and the Road to Transformation|https://securityintelligence.com/media/podcast-cloud-security-and-the-road-to-transformation/]] ([[audio|https://soundcloud.com/securityintelligence/cloud-security-and-the-road-to-transformation]])|Misc|
|2019.09.10|//HiveMQ//|[[Role Based Access Control to Secure an MQTT Broker|https://www.hivemq.com/blog/rbac-for-the-control-center-with-ese/]]|MQTT|
|2019.09.10|//Insight France//[>img[iCSF/flag_fr.png]]|[[Le cloud est perçu comme un atout pour la sécurité|https://www.informatiquenews.fr/le-cloud-est-percu-comme-un-atout-pour-la-securitedaniel-gonzalez-insight-france-63273]]|Misc|
|2019.09.10|//Rubrik//|[[Backup as a platform busts a move in multicloud, ransomware and GDPR|https://siliconangle.com/2019/09/10/backup-as-a-platform-busts-multicloud-ransomware-gdpr-moves-vmworld-startupoftheweek/]]|Backup GDPR|
|2019.09.10|//McAfee//|[[Modernizing FedRAMP is Essential to Enhanced Cloud Security|https://securingtomorrow.mcafee.com/other-blogs/executive-perspectives/modernizing-fedramp-is-essential-to-enhanced-cloud-security/]]|Regulations FedRAMP|
|2019.09.10|//Shared Assessments//|[[What 'Virtual' Means When Conducting Assessments|https://sharedassessments.org/what-virtual-means-when-conducting-assessments/]]|Misc|
|2019.09.10|SANS|[[How to Build a Threat Detection Strategy in Amazon Web Services (AWS)|https://www.sans.org/reading-room/whitepapers/analyst/build-threat-detection-strategy-amazon-web-services-aws-39155]]|Analysis Misc.|
|>|>|>|!2019.09.09|
|2019.09.09|The Daily Swig|[[Open source tool helps test security of cloud containers|https://portswigger.net/daily-swig/open-source-tool-helps-test-security-of-cloud-containers]]|[[Tools|Outils-GitHub]] CCAT|
|2019.09.09|Insider Pro|[[Cloud security: Inside the shared responsibility model|https://www.idginsiderpro.com/article/3437042/cloud-security-inside-the-shared-responsibility-model.html]]|Shared_Responsibility CapitalOne|
|2019.09.09|Silicon Angle|[[Google Cloud gets rootkit-resistant Kubernetes nodes, better SAP support|https://siliconangle.com/2019/09/09/google-cloud-gets-rootkit-resistant-kubernetes-nodes-better-sap-support/]]|GCP Kubernetes|
|2019.09.09|Medium|[[Cyber Range v2–09.06.2019|https://medium.com/aws-cyber-range/cyber-range-v2-09-06-2019-1e128f48e2c5]]|Exercise Tools|
|2019.09.09|//Microsoft//|[[Automated incident response in Office 365 ATP now generally available|https://www.microsoft.com/security/blog/2019/09/09/automated-incident-response-office-365-atp-now-generally-available/]]|O365 Advanced_Threat_Protection|
|2019.09.09|Bleeping Computer| → [[Office 365 ATP Automated Incident Response Now Generally Available|https://www.bleepingcomputer.com/news/microsoft/office-365-atp-automated-incident-response-now-generally-available/]]|O365 Advanced_Threat_Protection|
|2019.09.09|Security Week| → [[Microsoft Makes Automated Incident Response in Office 365 ATP Generally Available|https://www.securityweek.com/microsoft-makes-automated-incident-response-office-365-atp-generally-available]]|O365 Advanced_Threat_Protection|
|2019.09.09|//Synopsys//|[[Ask the experts: What's the top security risk during cloud migration?|https://www.synopsys.com/blogs/software-security/top-cloud-security-risks/]]|Risks|
|2019.09.09|//Alibaba Cloud//|[[Kubernetes Eviction Policies for Handling Low RAM and Disk Space Situations - Part 1|https://medium.com/@Alibaba_Cloud/kubernetes-eviction-policies-for-handling-low-ram-and-disk-space-situations-part-1-1a2068d7e856]] (1/2)|Kubernetes|
|2019.09.09|//Alibaba Cloud//|[[Kubernetes Eviction Policies for Handling Low RAM and Disk Space Situations - Part 2|https://medium.com/@Alibaba_Cloud/kubernetes-eviction-policies-for-handling-low-ram-and-disk-space-situations-part-2-d63596aec9d2]] (2/2)|Kubernetes|
|2019.09.09|//Mobiquity//|[[The Call for Continuous Security|https://www.mobiquity.com/resources/the-call-for-continuous-security]]|Misc|
|2019.09.09|//D2SI//[>img[iCSF/flag_fr.png]]|[[Sécurité sur le Cloud : quelle politique de conformité et de remédiation ?|https://blog.d2si.io/2019/09/09/securite-cloud-conformite/]]|Compliance|
|2019.09.09|//Bitglass//|[[The Four Pillars of CASB: Threat Protection|https://www.bitglass.com/blog/four-pillars-casb-threat-protection]]|CASB|
|2019.09.09|//DivvyCloud//|[[Remediating Misconfigurations to Keep Your Cloud Out of the News|https://divvycloud.com/blog/remediating-misconfigurations-keeping-your-cloud-out-of-news/]]|Misconfigurations|
|2019.09.09|//Microsoft//|![[Manage emergency access accounts in Azure AD|https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-emergency-access]]|AzureAD Mitigation|
|2019.10.21|//Microsoft//|[[About Site Recovery|https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview]]|Azure DRP|
!"Cloud Security Alliance EMEA Congress 2019 to Host Career-Advancing Cloud Security and Privacy Training Opportunities"
<<<
[>img(auto,100px)[iCSA/J91GCLACT.png]][>img(auto,100px)[iCSA/J91GDPRTrain.png]][>img(auto,100px)[iCSA/J73CCSK.png]]//Attendees can take advantage of top-ranked courses on CCSK Foundation, GDPR Lead Auditor, and Cloud Governance and Compliance Training

Berlin, Germany – Sept. 12, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, is pleased to offer three exclusive training opportunities at CSA EMEA Congress (Berlin, Nov. 18-21, 2019). Attendees interested in furthering their cloud and information security careers by becoming a GDPR lead auditor, deepening their understanding of CSA's Cloud Control Matrix (CCM), or preparing to take the Certificate of Cloud Security Knowledge (CCSK) exam can take advantage of some of the industry's highest-rated training courses while attending the conference.

"It's imperative that cloud security practitioners stay current on the latest threats and accordingly, the most sophisticated ways in which to guard against them," said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance. "CSA's training courses are among the industry's best - in fact, CRN recently rated the CCSK as among the seven must-have cloud security certificates+++*[»]> https://www.crn.com/slide-shows/cloud/7-must-have-cloud-security-certifications-in-2019/3 ===. This year's CSA Congress EMEA affords those looking to advance their knowledge of cloud security with two excellent training opportunities, while those interested in qualifying to audit against the CSA PLA Code of Practice can take a deep dive."
* ''CCSK Foundation Training''+++*[»]> https://cloudsecurityalliance.org/education/ccsk/ === (Nov. 18) (€870)
** This class provides students a comprehensive 1-day review of cloud security fundamentals and prepares them to take the CCSK exam. Starting with a detailed description of cloud computing, the course covers all major domains in CSA's "Security Guidance for Critical Areas of Focus in Cloud Computing v4.0"+++*[»]> https://cloudsecurityalliance.org/guidance/ === and the recommendations from the European Network and Information Security Agency. This class is geared toward security professionals but is also useful for anyone looking to expand their knowledge of cloud security. The class fee includes the cost of the exam voucher, a €357.26 (US$395) value.
* ''Cloud Governance & Compliance Training''+++*[»]> https://knowledge.cloudsecurityalliance.org/cloud-governance-compliance=== (Nov. 19) (€785)
** The "Cloud Governance & Compliance" (CGC) training is a 1-day course on tools and mechanisms for governance and compliance and has a specific focus on the CSA Cloud Control Matrix, CSA's cloud security control framework. The CCM is specifically designed to provide fundamental security principles that guide cloud service vendors toward the most secure practices and to assist prospective cloud customers in assessing the overall security posture of cloud providers.
* ''GDPR Lead Auditor Training Course'' (Nov. 18-19) (€2,000).
** This training is specifically designed to instruct and certify internal and third-party auditors on how to audit against the requirements of the "CSA PLA Code of Practice"+++*[»]> https://gdpr.cloudsecurityalliance.org/resource/csa-code-of-conduct-for-gdpr-compliance/ ===, the CSA technical specification for GDPR compliance, and its related certification and code of conduct (CoC). Among the areas covered are:
*** __GDPR Fundamentals and CSA CoC:__ Objectives, Scope and Methodology
*** __CoC Controls 1-5:__ CSP declaration of compliance & accountability, CSP relevant contacts, ways in which data will be processed, recordkeeping and data transfer
*** __CoC Controls 6-10:__ data security, monitoring, personal data breach, data portability & migration, and restriction of processing
*** __CoC Controls 11-15:__ data retention/restitution/deletion, cooperation with the cloud customers, legally required disclosure, remedy for cloud customers and CSP insurance policy
*** __CoC Governance and Adherence Mechanisms__
//[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/j9cc/|https://CloudSecurityAlliance.fr/go/j9cc/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Egregious 11 Meta-Analysis Part 3: Weak Control Plane and DoS//"
[>img(200px,auto)[iCSA/J9SBE.jpg]]Deuxième article de la série, publié le 12 septembre 2019 — Rédigé par Victor Chin, Research Analyst, CSA
<<<
//This is the ''third'' blog post in the series where we analyze the security issues in the new iteration of the Top Threats to Cloud Computing report. Each blog post features a security issue that is being perceived as less relevant and one that is being perceived as more relevant.

In this report, we found that traditional cloud security issues stemming from concerns about having a third-party provider are being perceived as less relevant. While more nuanced issues specific to cloud environments are being perceived as more problematic. With this in mind, we will be examining Shared Technology Vulnerabilities and Limited Cloud Usage Visibility further.
Please note that the Top Threats to Cloud Computing reports are not meant to be the definitive list of security issues in the cloud. Rather, the studies measures what industry experts perceive the key security issues to be.

__''Weak Control Plane''__
Weak control plane featured at the 8th position in the latest iteration of the Top Threats to Cloud Computing report. A weak cloud control plane refers to when a cloud service does not provide adequate or sufficient security controls to meet the security requirements of the customer. One example of a weak control plane is the lack of two-factor authentication and the ability to enforce its usage. Like the other debuting security issues, a weak control plane is something that a customer might only realize after they have migrated to the cloud. 

__A key difference between traditional IT and Cloud__
A key difference between traditional IT and cloud service applications that might help explain why weak control planes are becoming a problem in cloud services. In traditional IT environments, customer-controlled applications and their security features were designed with the customer as the main user. The application is hosted on the customer's infrastructure and configured by the customer. The customer has full visibility and control over the application and is thus also responsible for its security. The main role of the IT provider would be to continually provide patches or updates to the application to ensure that bugs and vulnerabilities are fixed.
The situation for cloud services is different because the cloud service is never fully 'shipped off' to the customer. The cloud service will always be hosted by the cloud service provider. Hence, they not only have to design a suite of security controls in the cloud service that is useable by their customers. They also have to consider the security mechanism and features that protect the cloud service and the virtual infrastructure that hosts it. Furthermore, due to the nature of cloud services, customers generally cannot use their security tools or technologies to augment the cloud service (i.e. filtering incoming network traffic). Both sets of security controls must meet the security, regulatory and compliance requirements of their various customers. With increasingly more enterprises adopting a 'cloud-first' policy, cloud service providers are faced with the situation of satisfying various technical security requirements of their many customers. Hence, it is not surprising that some enterprises might find the current security controls inadequate for their business needs. 

__Fulfilling regulatory and security requirements__
To sidestep such issues, prospective customers have to do their due diligence when considering cloud migration. Customers have to ensure that the cloud services they wish to use can fulfill their regulatory and security requirements. Prospective cloud customers can use the Cloud Security Alliance's Consensus Assessment Initiative Questionnaire (CAIQ)[2] to that end. The CAIQ is aligned with the Cloud Controls Matrix (CCM) and helps document what security controls exist in IaaS, PaaS and SaaS offerings, providing security control transparency. Furthermore, after cloud migration, customers should continue to monitor their regulatory and compliance landscape and communicate any changes to the cloud service providers. Having an open communication channel helps ensure that cloud service providers can make timely changes to the cloud service to align with changing customer security, compliance, and regulatory requirements.

__''Denial of Service''__
Denial of Service was rated 8th and then 11th in the last two iterations of the Top Threats report. In the latest Egregious 11 report, Denial of Service has dropped off the list. Denial of Service can take many forms. It can refer to a network attack such as a Distributed Denial of Service (DDoS) attack or system failure caused by a system administrator. 

Denial of Service (like many other security issues that have dropped off the list), is a security concern stemming from the fact that cloud services are a form of third-party in nature. In the early days of cloud computing, it was natural that enterprises were concerned about service availability when considering cloud migration. These enterprises had valid concerns about the cloud service providers' network bandwidth as well as their compute and storage capacities. However, over the years, cloud service providers have significantly invested in their infrastructure and now have almost unrivaled bandwidth and processing capabilities. At the same time, cloud service providers have built sophisticated DDoS protection for their customers. For example, Amazon Web Services (AWS) has AWS Shield[3], Microsoft Azure as Azure DDoS Protection[4] and Google Cloud Platform (GCP) has Google Cloud Armor[5].

In spite of all the infrastructure investment and the tools available to help customers mitigate DDoS attacks, other forms of denial of service can still happen. These denial of service incidents are often not malicious but rather occur due to mistakes by the cloud service provider. For example, in May 2019, Microsoft Azure and Office 365 experienced a three-hour outage due to a DNS configuration blunder[6]. Unfortunately, no amount of infrastructure investment or tools can prevent such incidents from happening. Customers have to realize that by migrating to the cloud, they are relishing full control of certain aspects of their IT. They have to trust that the cloud service provider has put in place the necessary precautions to reduce, as much as possible, the occurrence of such incidents.//
[...]
[1] https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-egregious-eleven
[2] https://cloudsecurityalliance.org/artifacts/consensus-assessments-initiative-questionnaire-v3-0-1/
[3] https://aws.amazon.com/shield/
[4] https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview
[5] https://cloud.google.com/armor/
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9ce/]] sur le blog de la CSA.
!"//Open API Survey Report//"
[>img(200px,auto)[iCSA/J9BBO.jpg]]Publié le 11 septembre 2019 — Rédigé par l'__Open API CSA Working Group__
<<<
//Cloud Security Alliance completed its first-ever Open API Survey Report, in an effort to see exactly where the industry stood on the knowledge surrounding Open APIs as well as how business professionals and consumers were utilizing them day to day. The key traits taken from the survey will be noted within this blog post to give the reader an idea of our current state of Open API knowledge and function. Moving forward, source code for security and open platforms has become increasingly shareable. As source code becomes more shareable between companies, it is giving way to new and robust manners which can be leveraged to improve upon what we already know. 
The survey was meant to be used as a means to see:
* What the outlook and future of Open API's are
* The gaps we can notice from people actually using them
* How they can become more useful for better security posture and development 
* How Open APIs can be used for emerging technologies. 

Interoperability is key within this survey. Businesses like the idea of using Open-API's because of their ability to work with systems already in place, and the ability to edit them to specific needs of a business. However, with this comes a lack of common education on where to go for implementing them, or how their security functions work internally from the original source. 

[<img(400px,auto)[iCSA/J9BB1.png]]Unfolding within this survey, however, was one thing that stood out the most among all of the questions and answers. Was anyone aware of best practices guide concerning Open APIs? The number was quite staggering, with 84% saying no. This immediately raises a red flag. The one thing we are using the most within development lifecycles and to build new products, doesn't have a well-known guidance supporting its usage and implementation into business models. 

As we move towards a future of open banking and other items that will be played at the hand of Open APIs, it is noticed that 44.74% of respondents to this survey have already implemented some form of an Open API. 

[>img(400px,auto)[iCSA/J9BB2.png]]The Open API platforms businesses are currently using or planning to use in the future were Key management/organization with 28%, and Open API Universal banking (PSD2) coming in a very close second. With the growth of online banking, however, this number for Universal Banking is more than likely going to grow the most in the coming years compared to other areas of specific interest. 

Building off of this question, we next asked if SaaS apps have proper security guarding them. 57% of the responses answered No. Of those 57% who answered No, 40% answered that they already have implemented Open API within their own workspace. Being already familiar with the existence of an Open API, we can confidently assume that security posture with SaaS apps are lacking security features. Because of the free availability of these programs, this can be looked at as no single guideline for secure functions being implemented through each use of a specific API. Lack of guideline and security input from development teams is a vital part of this missing function. 

[<img(400px,auto)[iCSA/J9BB3.png]]A staggering 94% responded "Yes" that security vendors should, in fact, be maintaining the Open-API's for SaaS vendors in an effort to push real-time updates. Half of that group is within the category of also already having a strong implementation of currently used open- API's, which also has suggested that the biggest benefit to their organization is interoperability. 

Something to note from this data set specifically, is that of all of the "yes" answers above are presently split down the middle that the future of Open API's in speaking to security will lie more dominantly in the IoT devices and B2C/AI categories. 

According to the study:
* 71% – Lack of knowledge on how to get started with Open API framework
* 89% – Not enough information on securing Open API's
* 73% – Not enough information on how to implement Open API's or where to look for a checklist for security posture. 

These all flow together to form a larger picture –> "How do we do this and where do we go?" A lack of guidance and policy surrounding these items is creating confusion beyond just implementing different open API's. 

[>img(400px,auto)[iCSA/J9BB4.png]]We had our respondents rate the best to the worst for organizations to implement security across SaaS vendors which included forward and reverse proxies, webhook integration, and other. As you can see from the image above, forward and reverse proxy scored 22% within the category as being the worst choice (1). Looking at the rows from 1 to 5, webhooks framework yielded the highest positive average ratio for the best choice for implementing security across SaaS vendors. 

It is important to note that webhook integration was the strongest choice for security posture and integration into a business environment. Though there were only 13% saying that they strongly agree, 52% were able to agree that a webhook integration is critical to the expansion of an existing framework. Of that group of 52%, more than 60% of their organizations either are working with universal banking initiatives or key management. 

There is much left to be developed within the realm of securing Open APIs and giving the reigns to who should actually be responsible for such a job. With Universal Banking becoming dominant internationally and moving into North America, the focus needs to shift to the idea of an interoperable and flexible framework that can give enterprises a knowledge base for building their programming architecture outwards.//
<<<
&rArr; Lire [[l'original|https://CloudSecurityAlliance.fr/go/j9bo/]] sur le blog de la CSA.
!"CSA's Certificate of Cloud Security Knowledge Exam Is Now Covered Under the U.S. Dept. of Veterans Affairs GI Bill™"
<<<
[>img(auto,100px)[iCSA/J73CCSK.png]]//Eligible U.S. Veterans can now take advantage of opportunity to deepen their cloud security knowledge as part of GI Bill's educational benefits

SEATTLE – September 10, 2019 – The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment, today announced that the cost of the Certificate of Cloud Security Knowledge (CCSK) exam is now covered under the U.S. Department of Veterans Affairs GI Bill®, meaning that eligible U.S. Veterans and qualifying family members will be reimbursed for the full cost of the exam.

Called the "mother of all cloud computing certifications" by CIO.com, the vendor-neutral CCSK tests for a broad foundation of cloud security knowledge, covering such topics as architecture, governance, compliance, operations, encryption, and virtualization and serves as the foundation for those seeking to demonstrate a deep-seated knowledge and competency with cyber, information, software and cloud computing infrastructure security.

"As enterprises and consumers move greater amounts of sensitive information to the cloud, employers are struggling to find information security leaders who have the necessary breadth and depth of knowledge to establish cloud security programs that protect sensitive information," said Jim Reavis, Co-founder and CEO, Cloud Security Alliance. "We are extremely proud to be able to offer U.S. Veterans the opportunity to further, or even launch, their careers in an exciting and growing field with high demand for qualified professionals."

"There is a tremendous skills gap when it comes to cloud-savvy, information security professionals," said Ryan Bergsma, Training Program Director, CSA. "The CCSK certificate is widely recognized as the standard of cloud security expertise and is the natural next step for those who are looking to learn how to best secure data in the cloud."

Demonstrated expert knowledge of cloud computing and associated security issues is very valuable both to the expert and to our nation. The U.S. military and the organizations who serve its mission have a strong need for these skills. Increasingly, cloud computing and cloud security are vital to national security. Individuals who have this expertise can expect to have a direct impact to our national security and to have additional career opportunities.

Since it was launched in 2010, thousands of IT and security professionals have upgraded their skillsets and enhanced their careers by obtaining the CCSK.Among the benefits of earning the CCSK are:

* Proven competency in key cloud security issues through an organization that specializes in cloud research
* Increased employment opportunities by filling the skills-gap for cloud-certified professionals
* Demonstrated technical knowledge, skills, and abilities to effectively use controls tailored to the cloud
* Ability to establish a baseline of security best practices when dealing with a broad array of responsibilities, from cloud governance to configuring technical security controls
* Serves as a complement to other credentials

The CCSK exam body of knowledge is the CSA Security Guidance v4, the CSA Cloud Control Matrix and the ENISA Cloud Computing Risk Assessment report. Those interested in taking the exam can take advantage of a variety of training programs available through CSA, from free self-study prep courses and self-paced online courses to in-person training sessions and instructor-led online classes.

Since 1944, the GI Bill has helped qualifying Veterans and their family members pay for all or some of the costs associated with college, graduate school and professional training. Now eligible Veterans can receive reimbursement of up to $2,000 per test (but not more than the VA-approved cost of the test) and receive benefits if they need to retake it. Those seeking reimbursement will need to provide the name of the exam (CCSK), the date the test was taken, the exam fee ($395), a copy of their test results (visit https://ccsk.cloudsecurityalliance.org/en/attempts and click on the given test result), and CSA's address (1151 Ellis Street, Bellingham, WA 98225), along with personal information listed here.

GI Bill® is a registered trademark of the U.S. Department of Veterans Affairs (VA). More information about education benefits offered by VA is available at the official U.S. government Web site at https://www.benefits.va.gov/gibill.//
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/j9ak/|https://CloudSecurityAlliance.fr/go/j9ak/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CCM.png]]Un appel à commentaires a été lancé pour la relecture de la traduction de la ''CCM'' réalisée par le CSA.
La date de cloture est le 2 octobre 2019.
<<<
//Cloud Security Alliance (CSA) would like to invite you to review and comment on the translated version of the Cloud Control Matrix (CCM) v3.0.1. CSA in the context of an agreement with OneTrust has proceeded towards the translation of the CCM in 10 languages in order to facilitate its easier adoption by organizations at the corresponding countries.
Provided translations are in the following languages:
* Spanish (ES), German (DE), ''French (FR)'', Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO), Swedish (SV).
To provide your comments (right click on cell + add comment). The objective of the review is to make sure that the terminology and semantics of controls' specifications within the aforementioned tools are maintained per each provided translation set of languages.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j99c/|https://cloudsecurityalliance.fr/go/j99c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(100px,auto)[iCSA/CAIQ301.png]]Un appel à commentaires a été lancé pour la relecture de la traduction de la ''CAIQ'' réalisée par le CSA.
La date de cloture est le 2 octobre 2019.
<<<
//Cloud Security Alliance (CSA) would like to invite you to review and comment on the translated version of the Consensus Assessments Initiative Questionnaire (CAIQ) v3.0.1. CSA in the context of an agreement with OneTrust has proceeded towards the translation of the aforementioned tools in 10 languages in order to facilitate their easier adoption by organizations at the corresponding countries.
Provided translations are in the following languages:
* Spanish (ES), German (DE), ''French (FR)'', Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO), Swedish (SV).
To provide your comments (right click on cell + add comment). The objective of the review is to make sure that the terminology and semantics of controls' specifications within the aforementioned tools are maintained per each provided translation set of languages.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j99q/|https://cloudsecurityalliance.fr/go/j99q/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
[>img(300px,auto)[iCSA/CSAGDPRCoC.jpg]]Un appel à commentaires a été lancé pour la relecture de la traduction de la ''CAIQ'' réalisée par le CSA.
La date de cloture est le 2 octobre 2019.
<<<
//Cloud Security Alliance (CSA) would like to invite you to review and comment on the translated version of the Privacy Level Agreement Code of Conduct (PLA CoC) v3.1. CSA in the context of an agreement with OneTrust has proceeded towards the translation of the aforementioned tools in 10 languages in order to facilitate their easier adoption by organizations at the corresponding countries.
Provided translations are in the following languages:
* Spanish (ES), German (DE), ''French (FR)'', Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO), Swedish (SV).
To provide your comments (right click on cell + add comment). The objective of the review is to make sure that the terminology and semantics of controls' specifications within the aforementioned tools are maintained per each provided translation set of languages.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j99p/|https://cloudsecurityalliance.fr/go/j99p/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 1^^er^^ au 8 septembre 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu : Annonce du programme du ''Congrès CSA EMEA'' du 11 au 21 Novembre à Berlin+++*[»]> <<tiddler [[2019.09.04 - Actu : Annonce du programme du Congrès CSA EMEA en Novembre à Berlin]]>>=== 
* Blog : ''How to Share the Security Responsibility Between the CSP and Customer''+++*[»]> <<tiddler [[2019.09.05 - Blog : How to Share the Security Responsibility Between the CSP and Customer]]>>=== 
* Publication : ''STAR Level and Scheme Requirements''+++*[»]> <<tiddler [[2019.09.04 - Publication : STAR Level and Scheme Requirements]]>>=== 
* Actu: Appel à commentaires, document ''Software-Defined Perimeter as a DDoS Prevention Mechanism''+++*[»]> <<tiddler [[2019.08.19 - Actu : Appel à commentaires, document 'Software-Defined Perimeter as a DDoS Prevention Mechanism']]>>=== (dernière semaine)
!2 - Veille Web
La [[Veille Web|2019.09.08 - Veille Hebdomadaire]] avec plus de 60 liens :
* __''À lire'' :__ rapport CyberCube & Guy Carpenter "''Looking Beyond the Clouds: A US Cyber Insurance Industry Catastrophe Loss Study''"+++*[»]>
|2019.09.05|//CyberCube//|![[Guy Carpenter and CyberCube Report Reveals Potential Impact of Cyber Catastrophe Scenarios on U.S. Cyber Insurance Industry|https://www.cybcube.com/2019/09/guy-carpenter-licenses-first-of-its-kind-cyber-risk-modeling-platform-from-cybercube-following-strategic-alliance-2/]]|Report Major_Outage|
|2019.09.05|//CyberCube//|Rapport "[[Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study|https://go.guycarp.com/lookingbeyondtheclouds]]|Report Major_Outage|
|2019.09.06|InfoSecurity Mag| → [[Catastrophic Incident at OS Provider Could Cost US Insurers $24bn|https://www.infosecurity-magazine.com/news/catastrophic-incident-os-cost-us/]]|Report Major_Outage|
=== 
* Pannes : ''AWS''+++*[»]>
|2019.09.04|The Register|[[AWS celebrates Labor Day weekend by roasting customer data in US-East-1 BBQ|https://www.theregister.co.uk/2019/09/04/aws_power_outage_data_loss/]]|Outage AWS|
|2019.09.04|Bleeping Computer| → [[Amazon AWS Outage Shows Data in the Cloud is Not Always Safe|https://www.bleepingcomputer.com/news/technology/amazon-aws-outage-shows-data-in-the-cloud-is-not-always-safe/]]|Outage AWS|
=== 
* Rapports et sondages : ''CyberCube''+++*[»]>
|2019.09.05|//CyberCube//|![[Guy Carpenter and CyberCube Report Reveals Potential Impact of Cyber Catastrophe Scenarios on U.S. Cyber Insurance Industry|https://www.cybcube.com/2019/09/guy-carpenter-licenses-first-of-its-kind-cyber-risk-modeling-platform-from-cybercube-following-strategic-alliance-2/]]|Report Major_Outage|
|2019.09.05|//CyberCube//|Rapport "[[Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study|https://go.guycarp.com/lookingbeyondtheclouds]]|Report Major_Outage|
|2019.09.06|InfoSecurity Mag| → [[Catastrophic Incident at OS Provider Could Cost US Insurers $24bn|https://www.infosecurity-magazine.com/news/catastrophic-incident-os-cost-us/]]|Report Major_Outage|
===, ''McKinsey''+++*[»]>
|2019.09.06|//McKinsey//|![[Securing software as a service|https://www.mckinsey.com/business-functions/risk/our-insights/Securing-software-as-a-service]]|Survey McKinsey SaaS|
===, ''Netwrix''+++*[»]>
|2019.09.05|//Netwrix//|[[2019 Netwrix Cloud Data Security Report|https://www.netwrix.com/2019cloudsecurityreport.html]]|Report Netwrix|
|2019.09.02|//Netwrix//| → [[Netwrix Survey: 98% of Educational Institutions Are Not Hiring Dedicated Staff to Improve Cloud Security|https://vmblog.com/archive/2019/09/05/netwrix-survey-98-of-educational-institutions-are-not-hiring-dedicated-staff-to-improve-cloud-security.aspx]]|Report Netwrix|
|2019.09.02|//Netwrix//[>img[iCSF/flag_fr.png]]| → [[Enquête Netwrix : 98 % des établissements d'enseignement n'engagent pas de personnel spécialisé pour améliorer la sécurité du cloud|http://www.globalsecuritymag.fr/Enquete-Netwrix-98-des,20190905,90448.html]]|Report Netwrix|
===, ''Nominet''+++*[»]>
|2019.09.04|//Nominet//|Sondage [[Cyber-Security and the Cloud|https://nominetcyber.com/cyber-security-and-the-cloud/]] ([[pdf|http://media.ntxcyber.com/wp-content/uploads/2019/08/Cloud-security-report_2019.pdf]])|Survey Nominet|
|2019.09.04|VMblog| → [[CISOs now think cloud is safer than on-premise, but security fears remain|https://vmblog.com/archive/2019/09/03/cisos-now-think-cloud-is-safer-than-on-premise-but-security-fears-remain.aspx]]|Survey Nominet|
|2019.09.04|Dark Reading| → [[Multicloud Businesses Face Higher Breach Risk|https://www.darkreading.com/cloud/multicloud-businesses-face-higher-breach-risk/d/d-id/1335719]] ([[rapport|]])|Survey Nominet|
===, ''Spanning''+++*[»]>
|2019.09.05|//Spanning//|[[2019 Cloud and Disaster Recovery Survey: 3 Key Takeaways|https://spanning.com/blog/2019-cloud-disaster-recovery-survey-3-key-takeaways/]] ([[rapport PDF|https://spanning.com/downloads/Spanning-Report-Unitrends-Survey-2019-Growing-Usage-SaaS-Data-Protection.pdf]])|Report Spanning DRP|
=== 
* Piratages et fuites de données : fuite de données de Monster+++*[»]>
|2019.09.05|TechCrunch|[[Monster.com says a third party exposed user data but didn't tell anyone|https://techcrunch.com/2019/09/05/monster-exposed-user-data-years/]]|DataLeak Monster|
|2019.09.05|Silicon Angle| → [[Monster.com user resumes exposed on misconfigured cloud server|https://siliconangle.com/2019/09/05/monster-com-user-resumes-exposed-misconfigured-third-party-server/]]|DataLeak Monster|
===, utilisation de Cloudflare Workers par le malware Astaroth+++*[»]>
|2019.09.01|Medium|[[Threat Actor behind Astaroth is now using Cloudflare Workers to bypass your Security Solutions|https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c]]|Cloudflare Malicious_Infrastructure|
|2019.09.01|Bleeping Computer| → [[Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software|https://www.bleepingcomputer.com/news/security/astaroth-trojan-uses-cloudflare-workers-to-bypass-av-software/]]|Cloudflare Malicious_Infrastructure|
=== 
* Divers : AWS et segmentation réseau, réflexions sur les challenges du Cloud Security Posture Management, décommissionnement dans le Cloud
|!Septembre|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.09.06|
|2019.09.06|NTP Pool|[[NTP Pool servers on Kubernetes on Packet|https://news.ntppool.org/2019/09/ntp-pool-servers-on-kubernetes-on-packet/]]|Kubernetes NTP|
|2019.09.06|GovLoop|[[1st Federal CISO: I'm 'very uncomfortable' with DoD's JEDI Cloud|https://www.govloop.com/1st-federal-ciso-im-very-uncomfortable-with-dods-jedi-cloud/]]|Government JEDI|
|2019.09.06|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Face au cloud, les RSSI gardent leurs distances|https://www.lemondeinformatique.fr/actualites/lire-face-au-cloud-les-rssi-gardent-leurs-distances-76344.html]]|Governance|
|2019.09.06|//AppDynamics//|[[Slowdown is the New Outage (SINTO)|https://www.appdynamics.com/blog/aiops/slowdown-new-outage-sinto/]]|Outage|
|2019.09.06|//Blissfully//|![[SaaS App Deprovisioning Checklist to Keep Your Company Secure|https://www.blissfully.com/blog/saas-app-deprovisioning-checklist/]]|SaaS Deprovisioning|
|2019.09.06|//McKinsey//|![[Securing software as a service|https://www.mckinsey.com/business-functions/risk/our-insights/Securing-software-as-a-service]]|Survey McKinsey SaaS|
|>|>|>|!2019.09.05|
|2019.09.02|Sécurité & Défense Mag[>img[iCSF/flag_fr.png]]|[[Les enjeux stratégiques du Cloud de confiance|https://sd-magazine.com/securite-numerique-cybersecurite/les-enjeux-strategiques-du-cloud-souverain]]|Sovereign_Cloud|
|2019.09.05|TechCrunch|[[Monster.com says a third party exposed user data but didn't tell anyone|https://techcrunch.com/2019/09/05/monster-exposed-user-data-years/]]|DataLeak Monster|
|2019.09.05|Silicon Angle| → [[Monster.com user resumes exposed on misconfigured cloud server|https://siliconangle.com/2019/09/05/monster-com-user-resumes-exposed-misconfigured-third-party-server/]]|DataLeak Monster|
|2019.09.05|NHS|[[NHS SBS launches cloud procurement framework|https://www.ukauthority.com/articles/nhs-sbs-launches-cloud-procurement-framework/]]|Procurement|
|2019.09.05|NHS| → [[Cloud Solutions framework|https://www.sbs.nhs.uk/fas-cloud-solutions]]|Procurement|
|2019.09.05|JDSupra|[[The Systemic Importance of Cloud-Based Service Providers to Banks|https://www.jdsupra.com/legalnews/the-systemic-importance-of-cloud-based-96893/]]|Storage|
|2019.09.05|//CyberCube//|![[Guy Carpenter and CyberCube Report Reveals Potential Impact of Cyber Catastrophe Scenarios on U.S. Cyber Insurance Industry|https://www.cybcube.com/2019/09/guy-carpenter-licenses-first-of-its-kind-cyber-risk-modeling-platform-from-cybercube-following-strategic-alliance-2/]]|Report Major_Outage|
|2019.09.05|//CyberCube//|Rapport "[[Looking Beyond the Clouds: A U.S. Cyber Insurance Industry Catastrophe Loss Study|https://go.guycarp.com/lookingbeyondtheclouds]]|Report Major_Outage|
|2019.09.06|InfoSecurity Mag| → [[Catastrophic Incident at OS Provider Could Cost US Insurers $24bn|https://www.infosecurity-magazine.com/news/catastrophic-incident-os-cost-us/]]|Report Major_Outage|
|2019.09.05|//Netwrix//|[[2019 Netwrix Cloud Data Security Report|https://www.netwrix.com/2019cloudsecurityreport.html]]|Report Netwrix|
|2019.09.02|//Netwrix//| → [[Netwrix Survey: 98% of Educational Institutions Are Not Hiring Dedicated Staff to Improve Cloud Security|https://vmblog.com/archive/2019/09/05/netwrix-survey-98-of-educational-institutions-are-not-hiring-dedicated-staff-to-improve-cloud-security.aspx]]|Report Netwrix|
|2019.09.02|//Netwrix//[>img[iCSF/flag_fr.png]]| → [[Enquête Netwrix : 98 % des établissements d'enseignement n'engagent pas de personnel spécialisé pour améliorer la sécurité du cloud|http://www.globalsecuritymag.fr/Enquete-Netwrix-98-des,20190905,90448.html]]|Report Netwrix|
|2019.09.05|//Alibaba Cloud//|[[Kubernetes Pod Disruption Budgets (PDB)|https://medium.com/@Alibaba_Cloud/kubernetes-pod-disruption-budgets-pdb-1aeaf2a97f05]]|Kubernetes|
|2019.09.05|//CyberArk//|[[Attacking the Cluster Remotely|https://www.cyberark.com/threat-research-blog/kubernetes-pentest-methodology-part-2/]] (2/3)|Kubernetes PenTest|
|2019.09.05|//Spanning//|[[2019 Cloud and Disaster Recovery Survey: 3 Key Takeaways|https://spanning.com/blog/2019-cloud-disaster-recovery-survey-3-key-takeaways/]] ([[rapport PDF|https://spanning.com/downloads/Spanning-Report-Unitrends-Survey-2019-Growing-Usage-SaaS-Data-Protection.pdf]])|Report Spanning DRP|
|2019.09.05|//Motley Fool//|[[FireEye's Significant Challenges Despite its Growing Cloud Business|https://www.fool.com/investing/2019/09/05/fireeyes-significant-challenges-despite-its-growin.aspx]]|Trends|
|2019.09.05|//Arcserve//|[[Hybrid or Multi-cloud? Picking the Right Cloud Strategy for an Organization's IT Needs|https://cloudtweaks.com/2019/09/hybrid-or-multi-cloud-strategy/]]|Hybrid_Cloud Multi_Cloud|
|2019.09.05|//PaloAlto Networks//|[[The Zero Trust Approach for the Cloud|https://blog.paloaltonetworks.com/2019/09/cloud-zero-trust-approach/]]|Zero_Trust|
|2019.09.02|//Google Cloud//[>img[iCSF/flag_fr.png]]|[[Gouvernance des données dans le cloud : comment l'aborder|http://www.globalsecuritymag.fr/Gouvernance-des-donnees-dans-le,20190905,90461.html]]|Governance Data|
|>|>|>|!2019.09.04|
|2019.09.04|//Nominet//|Sondage [[Cyber-Security and the Cloud|https://nominetcyber.com/cyber-security-and-the-cloud/]]|Survey Nominet|
|2019.09.04|VMblog| → [[CISOs now think cloud is safer than on-premise, but security fears remain|https://vmblog.com/archive/2019/09/03/cisos-now-think-cloud-is-safer-than-on-premise-but-security-fears-remain.aspx]]|Survey Nominet|
|2019.09.04|Dark Reading| → [[Multicloud Businesses Face Higher Breach Risk|https://www.darkreading.com/cloud/multicloud-businesses-face-higher-breach-risk/d/d-id/1335719]] ([[rapport|]])|Survey Nominet|
|2019.09.04|Continuity Central| → [[Cloud is safer than on-premise say that majority of security leaders|https://www.continuitycentral.com/index.php/news/technology/4384-cloud-is-safer-than-on-premise-say-that-majority-of-security-leaders]]|Survey Nominet|
|2019.09.04|CloudTech| → [[Cloud security woes strike again - and it's double trouble for multi-cloud users, research finds|https://www.cloudcomputing-news.net/news/2019/sep/04/cloud-security-woes-strike-again-and-its-double-trouble-multi-cloud-users-research-finds/]]|Survey Nominet|
|2019.09.04|Redmond|[[Microsoft Azure and Office 365 Services Go Down in Texas Service Area|https://redmondmag.com/articles/2018/09/04/azure-office-365-down-in-texas.aspx]]|Outage Azure O365|
|2019.09.04|The Register|[[AWS celebrates Labor Day weekend by roasting customer data in US-East-1 BBQ|https://www.theregister.co.uk/2019/09/04/aws_power_outage_data_loss/]]|Outage AWS|
|2019.09.04|Bleeping Computer| → [[Amazon AWS Outage Shows Data in the Cloud is Not Always Safe|https://www.bleepingcomputer.com/news/technology/amazon-aws-outage-shows-data-in-the-cloud-is-not-always-safe/]]|Outage AWS|
|2019.09.04|//StorageCraft//[>img[iCSF/flag_fr.png]]|[[Les entreprises rapatrient désormais leurs données depuis le cloud : mais où les stocker ?|https://www.journaldunet.com/solutions/expert/71655/les-entreprises-rapatrient-desormais-leurs-donnees-depuis-le-cloud---mais-ou-les-stocker.shtml]]|Storage|
|2019.09.04|//Vectra//|[[Security pros need more and better visibility into their cloud networks|https://www.helpnetsecurity.com/2019/09/04/cloud-networks-visibility/]]|Misc|
|2019.09.04|//Security Intelligence//|[[Making the Case for Network Segmentation in AWS|https://securityintelligence.com/posts/making-the-case-for-network-segmentation-in-aws/]]|AWS Segmentation|
|2019.09.04|//McAfee//|[[Securing Sensitive Data In the Cloud|https://www.skyhighnetworks.com/cloud-security-blog/securing-sensitive-data-in-the-cloud/]]|Insider_Threats|
|2019.09.04|//Optiv//|[[Service Providers and PCI Compliance, Part 1 – Cloud Services and Your Obligations|https://www.optiv.com/blog/service-providers-and-pci-compliance-part-1-cloud-services-and-your-obligations]] (1/3)|Compliance PCI_DSS|
|2019.09.04|//Smallstep//|[[Embarrassingly easy private certificate management for VMs on AWS, GCP, and Azure|https://smallstep.com/blog/embarrassingly-easy-certificates-on-aws-azure-gcp/]]|Certificates AWS Azure GCP|
|2019.09.04|//Microsoft//|[[Automated investigation and response (AIR) in Office 365|https://docs.microsoft.com/en-us/office365/securitycompliance/automated-investigation-response-office]]|O365 Investigations|
|2019.09.04|//StackRox//|[[5 Kubernetes RBAC Mistakes You Must Avoid|https://www.stackrox.com/post/2019/09/5-kubernetes-rbac-mistakes-you-must-avoid/]]|Kubernetes|
|>|>|>|!2019.09.03|
|2019.09.03|Christophe Parisel|[[Aftermath of the Capital One incident on AWS|https://www.linkedin.com/pulse/aftermath-capital-one-incident-aws-christophe-parisel/]]|CapitalOne Incident Lessons_Learnt|
|2019.09.03|Randy Westergren|[[A Closer Look at Recent HTTP/2 Vulnerabilities Affecting K8s and Other Implementations|https://randywestergren.com/a-closer-look-at-recent-http-2-vulnerabilities-affecting-k8s-and-other-implementations/]]|Kubernetes CVE-2019-9511→9518|
|2019.09.03|DevOps.com|[[From DevOps to DevSecOps: Owning Cloud Security|https://devops.com/from-devops-to-devsecops-owning-cloud-security/]]|DevSecOps|
|2019.09.03|CSO Online|[[ICS as a cloud service is coming: Will the benefits outweigh the risks?|https://www.csoonline.com/article/3434532/ics-as-a-service-icsaas-is-coming-will-the-benefits-outweigh-the-risks.html]]|ICS|
|2019.09.03|Solutions Review|[[The 12 Best Managed Cloud Security Services Providers|https://solutionsreview.com/cloud-platforms/the-12-best-managed-cloud-security-services-providers/]]|MSSP|
|2019.09.03|Infosec Institute|[[Should you take the CCSP/SSCP before the CISSP?|https://resources.infosecinstitute.com/should-you-take-the-ccsp-sscp-before-the-cissp/]]|Certification|
|2019.09.03|//Azure//|[[Reduce disaster recovery time with Azure Site Recovery|https://azure.microsoft.com/en-us/blog/reduce-disaster-recovery-time-with-azure-site-recovery/]]|DRP|
|2019.09.03|//ParkMyCloud//|[[How Much Should Enterprises Worry About Vendor Lock-in in Public Cloud?|https://www.parkmycloud.com/blog/vendor-lock-in/]]|Reversibility|
|2019.09.03|//Fugue//|![[Cloud Security Posture Management Challenge: Baselining vs. Scripts and Bots|https://www.fugue.co/blog/cloud-security-posture-management-challenge-baselining-vs.-scripts-and-bots]]|Security_Posture|
|2019.09.03|//Idaptive//|![[How to Prevent Office 365 Account Lockouts|https://www.idaptive.com/blog/Prevent-Office-365-Account-Lockouts/]]|O365|
|>|>|>|!2019.09.02|
|2019.09.02|MISC[>img[iCSF/flag_fr.png]]|[[L'édito de MISC n°105|https://www.miscmag.com/ledito-de-misc-n105/|]]|Governance|
|2019.09.02|CBR Online|[[Why the UK Government's Re-Evaluation of its Cloud First Policy is a Sign of the Times|https://www.cbronline.com/opinion/cloud-first-uk-govt]]|Government Strategy|
|2019.09.02|Bleeping Computer|[[Windows 10 Gets a Cloud Reset Feature, Here's How it Works|https://www.bleepingcomputer.com/news/microsoft/windows-10-gets-a-cloud-reset-feature-here-s-how-it-works/]]|Windows_10|
|2019.09.02|Silicon Angle|[[UK travel company exposes customer calls on misconfigured cloud storage|https://siliconangle.com/2019/09/02/uk-travel-company-exposes-customer-calls-misconfigured-cloud-storage/]]|AWS Data_Leak|
|2019.09.02|InfoQ|[[How to Use Chaos Engineering to Break Things Productively|https://www.infoq.com/articles/chaos-engineering-security-networking/]]|Chaos_Engineering|
|2019.09.02|Rick's Cloud|[[IoT and its impact on the business world - Part I|https://rickscloud.com/iot-and-its-impact-on-the-business-world-part-i/]]|IoT|
|2019.09.02|SilverLining|!Silver Lining podcast [[Chapter 7: Creating Trust in Cloud|https://silverlining.media/chapter-7-creating-trust-in-cloud/]]|Podcast|
|2019.09.02|//Compliant Cloud//|[[Where's my data gone?|https://compliantcloud.com/wheres-my-data-gone-data-integrity/]]|Integrity|
|2019.09.02|//Verizon//|![[Verizon White Paper: CISO's Guide to Cloud Security|http://rafeeqrehman.com/2019/09/02/verizon-white-paper-cisos-guide-to-cloud-security/]]|CISO|
|2019.09.02|//Compare The Cloud//|[[Why companies are ditching the cloud for hybrid|https://www.comparethecloud.net/articles/why-companies-are-ditching-the-cloud-for-hybrid/]]|Hybrid_Cloud|
|2019.09.02|//Fugue//|[[Why "Cloud Security 101" Isn't So Simple After All|https://www.cyberdefensemagazine.com/why-cloud-security-101/]]|Misc|
|2019.09.02|//Cloudbric//|[[My cloud WAF service provider suffered a data breach…how can I protect myself?|https://www.cloudbric.com/blog/2019/09/cloud-waf-service-provider-suffered-data-breach-protection/]]|DataBreach Imperva|
|>|>|>|!2019.09.01|
|2019.09.01|Medium|[[Threat Actor behind Astaroth is now using Cloudflare Workers to bypass your Security Solutions|https://medium.com/@marcelx/threat-actor-behind-astaroth-is-now-using-cloudflare-workers-to-bypass-your-security-solutions-2c658d08f4c]]|Cloudflare Malicious_Infrastructure|
|2019.09.01|Bleeping Computer| → [[Astaroth Trojan Uses Cloudflare Workers to Bypass AV Software|https://www.bleepingcomputer.com/news/security/astaroth-trojan-uses-cloudflare-workers-to-bypass-av-software/]]|Cloudflare Malicious_Infrastructure|
|2019.09.01|//Ctera//[>img[iCSF/flag_fr.png]]|[[Comment faire face à l'évolution constante des menaces de sécurité dans le Cloud (Ctera)|https://www.eurocloud.fr/faire-face-a-levolution-constante-menaces-de-securite-cloud-ctera/]]|Threats|
!"//How to Share the Security Responsibility Between the CSP and Customer//"
[>img(200px,auto)[iCSA/J82BC.jpg]]Publié le 5 septembre 2019 — Rédigé par Dr. Kai Chen, Chief Security Technology Officer, Consumer BG, Huawei Technologies Co. Ltd
<<<
//The behemoths of cloud service providers (CSPs) have released shared security responsibility related papers and articles, explaining their roles and responsibilities in cloud provisioning. Although they share similar concepts, in reality, there are different interpretations and implementations among CSPs.

While there are many cloud security standards to help guide CSPs in fulfilling their security responsibilities, the cloud customers still find it challenging to design, deploy, and operate a secure cloud service. "''Guideline on Effectively Managing Security Service in the Cloud''"+++*[»]> <<tiddler [[2019.01.04 - Publication : Guideline on Effectively Managing Security Service in the Cloud]]>>=== (referred to as the 'Guideline') developed by CSA's ''Cloud Security Services Management (CSSM) Working Group'' provides an easy-to-understand guidance for cloud customers. It covers how to design, deploy, and operate a secure cloud service for different cloud service models, namely IaaS, PaaS, and SaaS. Cloud customers can use it to help ensure the secure running of service systems.

In the Guideline, the shared security responsibility figure was developed with reference to Gartner's shared security responsibility model
{{floatC{
[img(600px,auto)[iCSA/J95B1.png]].
Staying Secure in the Cloud Is a Shared Responsibility, Gartner
→ https://www.gartner.com/doc/3277620/staying-secure-cloud-shared-responsibility
Security responsibility division between CSPs and cloud customers in different cloud service models.
}}}
It illustrates the security handoff points for IaaS, PaaS, and SaaS cloud models. The handoff point moves up the stack across the models.

While there are differences in the security responsibility across the models, some responsibilities are common to all cloud service models:

''CSPs' Common Security Responsibilities''
* Physical security of the infrastructure, including but not limited to: equipment room location selection; power supply assurance; cooling facilities; protection against fire, water, shock, and theft; and surveillance (for details about the security requirements, see related standards)
* Security of computing, storage, and network hardware
* Security of basic networks, such as anti-distributed denial of service and firewalls
* Cloud storage security, such as backup and recovery
* Security of cloud infrastructure virtualization, such as tenant resource isolation and virtualization resource management
* Tenant identity management and access control
* Secure access to cloud resources by tenant
* Security management, operating monitoring, and emergency response of infrastructure
* Formulating and rehearsing service continuity assurance plans and disaster recovery plans for infrastructure

''Cloud Customers' Common Security Responsibilities''
* User identity management and access control of service systems
* Data security (in the European General Data Protection Regulation (GDPR) mode, cloud customers control the data and should be responsible for data security while CSPs only process the data and should take security responsibilities granted by data controllers.)
* Security management and control of terminals that access cloud services, including hardware, software, application systems, and device rights
Besides that, the Guideline contains chapters that describe the technical requirements for the security assurance of cloud service systems and provides an implementation guide based on the existing security technologies, products, and services. It also illustrates security assurance technologies, products, and services that CSPs and customers should provide in different cloud service models as mentioned previously.
{{floatC{
[img(600px,auto)[iCSA/J95B2.png]]
Security responsibilities between CSPs and cloud customers
}}}
''Mapping of the Guideline with CCM''

To help provide an overview to end users about the similarities and differences between the security recommendations listed in the Guideline and the ''Cloud Controls Matrix'' (CCM) controls, the CSSM working group conducted a mapping of CCM version 3.0.1 to the Guideline.

The ''Mapping of "Guideline on Effectively Managing Security Service in the Cloud" Security Recommendations to CCM'' was a one-way mapping, using the CCM as base, done in accordance with the ''Methodology for the Mapping of the Cloud Controls Matrix''.

The mapping document is supplemented with a detailed ''gap analysis report'' that breaks down the gaps in each CCM domain and provides recommendations to readers.

"This mapping work brings users of the Guideline a step closer to being CCM compliant, beneficial to organizations looking to extrapolate existing security controls to match another framework, standard or best practice," said Dr. Chen Kai, Chief Security Technology Officer, Consumer BG, Huawei Technologies Co. Ltd., and chair of the CSSM Working Group.

Users of the Guideline will be able to bridge lacking areas with ease based on the gap analysis. By understanding what it takes to go from the Guideline to CCM, the mapping work complements the Guideline to help users achieve holistic security controls.

Download the gap analysis report on mapping to the CSA's Cloud Controls Matrix(CCM) now.

Learn more about the Cloud Services Management Working Group here.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/09/05/how-to-share-the-security-responsibility-between-the-csp-and-customer/]] sur le blog de la CSA.
!"//Gap Analysis Report on Mapping CSA's Cloud Controls Matrix to 'Guideline on Effectively Managing Security Service in the Cloud'//"
[>img(200px,auto)[iCSA/J95PG.png]]Document publié le 5 septembre 2019.
<<<
//The report summarizes the mapping of CCM v3.0.1 to 'Guideline on Effectively Managing Security Services in the Cloud' and provides gap analysis on the results.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j95g/|https://CloudSecurityAlliance.fr/go/j95g/]]''
!"//Mapping of 'The Guidelines' Security Recommendations to CCM//"
Document publié le 5 septembre 2019.[>img(100px,auto)[iCSA/CSAdoc.png]]
<<<
//This document contains the additional controls that serves to bridge the gap between CCM V3.0.1 and the controls within 'Guideline on Effectively Managing Security Services in the Cloud' published by Cloud Security Services Working Group.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j95m/|https://CloudSecurityAlliance.fr/go/j95m/]]''
!"//STAR Level and Scheme Requirements//"
Document publié le 4 septembre 2019.
__Extrait :__
<<<
//CSA Security Trust, Assurance and Risk ([[STAR]]™) is the industry's most powerful program for security assurance in the cloud. STAR™ encompasses key principles of transparency, rigorous auditing, and harmonization of standards. The STAR™ program provides multiple benefits, including indications of best practices and validation of security posture of cloud offerings. STAR™ is based on the following foundation tools:
* The CSA Cloud Controls Matrix ([[CCM]])+++*[»]> <<tiddler [[CCM]]>>=== 
* The Consensus Assessments Initiative Questionnaire ([[CAIQ]])+++*[»]> <<tiddler [[CAIQ]]>>=== 
* The CSA Code of Conduct for GDPR Compliance+++*[»]> <<tiddler [[RGPD]]>>=== 
//[...]//
One of most essential features of the STAR™ program is its registry that documents the security and privacy controls provided by popular cloud computing offerings. This publicly accessible registry is designed for users of cloud services to assess their cloud providers, security providers and advisory and assessment services firms in order to make the best procurement decisions.//
<<<
__Table des matières__[>img(500px,auto)[iCSA/OCF-1.png]]
<<<
# STAR Introduction
# STAR Levels Overview
# Level 1
** STAR Self-Assessment
** GDPR CoC Self-Assessment (Privacy)
# Level 2
** CSA STAR Attestation
** CSA STAR Certification
** CSA C-STAR Assessment
** GDPR CoC Certification (Privacy)
# Level 3
** CSA STAR-Continuous
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j94s/|https://CloudSecurityAlliance.fr/go/j94s/]]''
[>img(300px,auto)[iCSA/JBICE.jpg]]La [[Cloud Security Alliance]] a annoncé le programme du prochain [[Congrès CSA EMEA|2019.11.20 - CSA Congress EMEA 2019 - Berlin]] qui se déroulera du 18 au 21 novembre 2019 à Berlin : "Cloud Security Alliance to Address Convergence of Privacy and Security at 2019 EMEA Congress".
<<<
//''__Andreas Könen__, __Udo Helmbrecht__, and __Pearse O'Donohue__ join thought leaders from BSI, European Privacy Association, Adobe, and Google Cloud as speakers''

Berlin, Germany - Sept. 4, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today announced the speaker line-up and session highlights for its upcoming CSA EMEA Congress (Berlin, Nov. 18-21, 2019). Headlining the event will be two of the most prominent cloud and Internet of Things (IoT) policy makers - __Andreas Könen__, Director General CI, Cyber and Information Security, German Federal Ministry of the Interior, Building and Community (BMI), and __Pearse O'Donohue__, Director, Future Networks Directorate, European Commission - DG CONNECT. __Udo Helmbrecht__. Executive Director, ENISA, will also be on hand and will speak to how cybersecurity certification can foster the EU cybersecurity market.

In his address - ''Cyber Security Act and IT-Security Law 2.0'' - Könen will discuss how developments in security labelling, emerging technologies and the expected rapid growth of the IoT have forced enterprises and governments to rethink security requirements and how to implement them and provide insights into the Cyber Security Act and the German IT Security Law 2.0.

This year's event will focus on two tracks - ''Cloud Privacy, Governance'', and ''Compliance and Best Practices in Cybersecurity'' - and offer attendees the chance to earn CPE credits. Over the course of two days, attendees will learn, among other things, how to:
* go beyond classic vendor risk-assessment practices and take advantage of continuous data-driven security intelligence methods
* real-world, practical advice on automating third-party privacy and security risk programs
* cut through the complexity of today's compliance with a multi-party recognition framework for cloud security

"This year's CSA EMEA Congress examines the convergence of security and privacy a little more than a year after the implementation of the General Data Protection Regulation. The event promises to offer attendees an in-depth examination of what we as cloud professionals have learned over the past 16 months as well as what technologies are shaping our industry's future," said __Daniele Catteddu__, Chief Technology Officer, Cloud Security Alliance.

Attendees will benefit from panels and presentations featuring companies leading the development of cutting-edge advancements in cloud security and data privacy, including:

# ''Cloud Computing Security in the NIS Directive''.
** Presenter: __Dr. Marnix Dekker__, Cybersecurity Expert, European Union Agency for Network and Information Security (ENISA)
# ''From Spreadsheets to Streamlined: Automating the Third-Party Vendor Risk Lifecycle''.
** Presenter: __Ian Evans__, Managing Director, OneTrust
# ''CSA Security Trust Assurance and Risk (STAR)''.
** Presenter: __Daniele Catteddu__, Chief Technology Officer, CSA
# ''How Cybersecurity Certification Can Foster the EU Cybersecurity Market''.
** Presenter: __Dr. Udo Helmbrecht__. Executive Director, ENISA
# ''The Community Draft of the Revised C5''.
** Presenter: __Dr. Patrick Grete__, Cloud Security Expert, Federal Office for Information Security (BSI)
# ''Trust in Cloud by Certification''.
** Presenter: __Damir Savanovic__, Senior Innovation Analyst, CSA
# ''Taking Control of IoT: An Enterprise Perspective''.
** Presenter: __Hillary Baron__, Research Analyst and Program Manager, CSA
# ''Track: Cloud Privacy, Governance and Compliance''
** ''Cloud Security Alliance Code of Conduct for GDPR Compliance''.
*** Presenter: __Paolo Balboni__, Founding Partner, ICT Legal Consulting, and President, European Privacy Association
** ''What's Up with Data Breaches Notifications Under the GDPR''.
*** Presenter: __Dorotea Alessandra De Marco__, Senior Official, Italian Data Protection Authority
** ''Trust but Verify''.
*** Presenter: __Gillian Hamilton__, Strategic Trust Lead, Google Cloud
** ''Bolster Your Incident Response Plan Across Privacy & Security Teams''.
*** Presenter: __Ian Evans__, Managing Director, OneTrust
** ''The GDPR and the NIS Directive One Year On: Security Obligations on Cloud Service Providers''.
*** Presenter: __Jenny Gershkovich__, Information Security Lead Vendor Security Services, ABN AMRO Bank N.V.
*** Presenter: __Isabella Oldani__, Research Coordinator, "Legal and Privacy in the Cloud" Cloud Security Alliance-Italian Chapter
*** Presenter: __Marco Tullio Giordano__, Attorney-at-law, Data Protection Officer and ISO27001 Lead Auditor
*** Presenter: __Massimo Simbula__, founder, Studio Legale Simbula Law Firm
# ''Track: Best Practices in Cybersecurity''
** ''Leveraging Osquery for DFIR at Scale''.
*** Presenter: __Sohini Mukherjee__, Security Researcher, Adobe
** ''Works Councils, Your Best Friends (Really!)''.
*** Presenter: __Mark Wijnhoven__, Global Legal and Privacy Lead, Phillips Group Security
** ''Using Cloud Services Securely - A Practical Viewpoint''.
*** Presenter: __Benoit Heynderickx__, Research Analyst, Information Security Forum
** ''How to Scale Vendor Security Management''.
*** Presenter: __Jenny Gershkovich__, Information Security Lead Vendor Security Services, ABN AMRO Bank N.V.
** ''Secure Cloud Adoption by Spanish Organizations''.
*** Presenter: __Mariano Benito__, CISO, GMV Soluciones Globales Internet Secure
** ''Digital Transformation Requires Security Transformation''.
*** Presenter: __Neil Thacker__, CISO EMEA, Netskope
** ''Cloud Octagon Model for SaaS Risk Assessments''.
*** Presenter: __Jim de Haas__, Cloud Security Wizard, ABN AMRO Bank
** ''Vendor Risk Assessment - A Discussion with Cloud Leaders'' (Panel).
*** Moderator: __Chris Niggel__, Director of Security and Compliance, Okta Vendor Risk Assessment
//
<<<
__Inscription :__
* Lien → https://www.eventbrite.co.uk/e/csa-emea-congress-2019-tickets-55612125364
* Inscription standard : 350 € jusqu'au 1^^er^^ novembre, frais de 20,24€
* Inscription tardive : 500 € du 2 au 21 novembre, frais de 28,49 €
* Etudiants et fonctionnaires : 50 €, frais de 3,75 €
* Formation "CCSK Foundation" : 870 €, frais de 48,84 €
* Formation "CGC" : 785 €, frais de 44,17 €
* Formation GDPR : 2.000 €, frais de 110,99 €
[img(25%,1px)[iCSF/BluePixel.gif]]
* Lien → ''[[CloudSecurityAlliance.fr/go/j94c/|https://cloudsecurityalliance.fr/go/j94c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//Announcing the Security@ San Francisco 2019 Agenda//"
[>img(100px,auto)[iCSA/J9PBA.jpg]]^^Publiée le 25 septembre 2019, l'annonce du programme de la conférence "Security@ San Francisco" du 15 octobre 2019
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9pb/]] sur le blog de la Cloud Security Alliance^^

!"//Glass Class: Three Essential Requirements for Securing IaaS//"
[>img(100px,auto)[iCSA/J94BS.jpg]]^^Bien que publié le 23 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 5 semaines, le 14 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9nz/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j9nx/]]^^

!"//The Four Pillars of CASB: Data Protection//"
[>img(100px,auto)[iCSA/J9GBT.jpg]]^^Bien que publié le 16 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 3 semaines, le 26 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9gz/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j9gx/]]^^

!"//Cloud Security Roadmap for 2019 & Beyond//"
[>img(100px,auto)[iCSA/J9ABC.jpg]]^^Bien que publié le 10 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a une semaine, le 3 septembre 2019 sur le site de la société ExtraHop.
Il ne s'agit que d'une incitation à télécharger, après inscription, un rapport d'IDC intitulé ""//Cloud SecurityRoadMap: Identifying Limitations to the Shared Responsibility Model as well as Requirements and Best Practices//" et publié le 26 août 2019.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j9az/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j9ax/]]^^

!"//What Executives Should Know About the Capital One Breach//"
[>img(100px,auto)[iCSA/J99BW.jpg]]^^Bien que publié le 9 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 3 semaines, le 14 août 2019 sur le site de la société Fugue.
Il faisait partie des articles déjà mentionnés dans notre veille datée du 18 août 2019
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j99z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j99x/]]^^

!"//Security Spotlight: iPhones Susceptible to a Hack via Text//"
[>img(100px,auto)[iCSA/J94BS.jpg]]^^Bien que publié le 4 septembre 2019 sur le blog de la CSA, cet article l'a déjà été il y a 2 semaines, le 21 août 2019 sur le site de la société Bitglass.
&rArr; Lire [[l'article|https://CloudSecurityAlliance.fr/go/j94z/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://CloudSecurityAlliance.fr/go/j94x/]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201908>>
<<tiddler fAll2Tabs10 with: VeilleM","_201908>>
<<tiddler fAll2LiTabs with: NewsL","201908>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Août 2019]]>>
|!Août|!Sources|!Titres et Liens|!Keywords|
|2019.08.13|Netflix|[[NFLX-2019-002: HTTP/2 Denial of Service Advisory|https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md]]|Kubernetes CVE-2019-9511→9518|
|2019.08.13|CERT/CC|[[VU#605641: HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion|https://www.kb.cert.org/vuls/id/605641/]]|Kubernetes CVE-2019-9511→9518|
||Mitre|Data Dribble→ [[CVE-2019-9511|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9511]]|Kubernetes|
||Mitre|Ping Flood → [[CVE-2019-9512|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512]]|Kubernetes|
||Mitre|Resource Loop → [[CVE-2019-9513|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9513]]|Kubernetes|
||Mitre|Reset Flood → [[CVE-2019-9514|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 ]]|Kubernetes|
||Mitre|Settings Flood → [[CVE-2019-9515|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515 ]]|Kubernetes|
||Mitre|0-Length Headers Leak (Nginx variant) → [[CVE-2019-9516|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9516]]|Kubernetes|
||Mitre|Internal Data Buffering → [[CVE-2019-9517|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9517]]|Kubernetes|
||Mitre|Empty Frames Flood → [[CVE-2019-9518|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9518]]|Kubernetes|
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Août 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Août 2019]]>><<tiddler fAll2LiTabs with: Actu","201908>>
<<tiddler fAll2LiTabs with: Blog","201908>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Août 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201908>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Août 2019]]>>
!1 - Les nouveautés CSA de la semaine du 26 au 31 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Egregious 11 Meta-Analysis Part 2: Virtualizing Visibility''+++*[»]> <<tiddler [[2019.08.28 - Blog :' Egregious 11 Meta-Analysis Part 2: Virtualizing Visibility']]>>=== 
* Blog : '''On-Chain vs Off-Chain governance. What are the rules to Calvinball?'''+++*[»]> <<tiddler [[2019.08.26 - Blog : 'On-Chain vs Off-Chain governance. What are the rules to Calvinball?']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.31 - Veille Hebdomadaire]] avec plus de 60 liens :
* __''À lire'' :__ "''Kubernetes #Fails''"+++*[»]>
|2019.08.27|DZone|![[Kubernetes #Fails|https://dzone.com/articles/kubernetes-fails]]|Kubernetes|
===, "''Scalable infrastructure for investigations and incident response''"+++*[»]>
|2019.08.30|//Microsoft//|![[Scalable infrastructure for investigations and incident response|https://msrc-blog.microsoft.com/2019/08/30/scalable-infrastructure-for-investigations-and-incident-response/]]|Incident_Handling Infrastructure|
=== et ''futur de la sécurité réseau dans le Cloud avec le SASE (//Secure Access Service Edge//) du Gartner''"+++*[»]>
|2019.08.30|//Gartner//|[[G00441737: The Future of Network Security Is in the Cloud|https://www.gartner.com/doc/reprints?id=1-6QW0Z4A&ct=190528]]|Gartner Network SASE G00441737|
=== 
* Piratages et fuites de données : fuite de données ''Imperva'' pour certains clients du "''Cloud WAF''" (ex ''Incapsula'')+++*[»]>
|2019.08.27|//Imperva//|[[Imperva Security Update|https://www.imperva.com/blog/ceoblog/]]|DataBreach Imperva|
|2019.08.27|Krebs on Security| → [[Cybersecurity Firm Imperva Discloses Breach|https://krebsonsecurity.com/2019/08/cybersecurity-firm-imperva-discloses-breach/]]|DataBreach Imperva|
=== 
* Pannes : Reddit suite à une panne AWS
* Vulnérabilités : ''Kubernetes'' avec un retour sur la CVE-2019-11245+++*[»]>
|2019.08.28|//Twistlock//|[[Non-root containers, Kubernetes CVE-2019-11245 and why you should care|https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/]]|Kubernetes CVE-2019-11245|
=== et un PoC de Spoofing DNS+++*[»]>
|2019.08.29|//Aqua//|![[DNS Spoofing on Kubernetes Clusters|https://blog.aquasec.com/dns-spoofing-kubernetes-clusters]]|Kubernetes DNS_Spoofing|
=== 
* Formation : promotion temporaire pour une offre commerciale de formation Azure tierce et __non certifiante__+++*[»]>
|>|>|>|!@@color:#f00;font-size:125%;<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html> — Ce lien vers une offre COMMERCIALE et PROMOTIONNELLE est fourni à titre INFORMATIF et n'est pas sponsorisé. 
<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html> — La formation NON CERTIFIANTE, N'a PAS été suivie, et n'est NI conseillée, NI recommandée, NI validée par les auteurs de cet article.
<html><i class="fa fa-exclamation-triangle" aria-hidden="true"></i></html> — Ces derniers se DÉGAGENT de TOUTE RESPONSABILITÉ quant à VOTRE décision de suivre le lien et à ses conséquences.@@| |2019.08.29|//TheNextWeb//|[[This Microsoft Azure training will take your from zero to in-demand data hero|https://thenextweb.com/offers/2019/08/29/this-microsoft-azure-training-will-take-your-from-zero-to-in-demand-data-hero/]]|Training Azure| === * Divers : impact(s) potentiel(s) lié(s) au (potentiel) ''Brexit''+++*[»]> |2019.08.30|BetaNews|[[GDPR and Brexit - Is your cloud provider ready for the UK 'being treated like a third country'?|https://betanews.com/2019/08/30/gdpr-and-brexit/]]|GDPR Brexit| ===
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.31|
|2019.08.31|Bleeping Computer|[[Reddit Experiencing Outage Due to Amazon AWS Issue|https://www.bleepingcomputer.com/news/technology/reddit-experiencing-outage-due-to-amazon-aws-issue/]]|Outage AWS Reddit|
|>|>|>|!2019.08.30|
|2019.08.30|MISC[>img[iCSF/flag_fr.png]]|[[Gros plan sur la sécurité des environnements cloud Amazon Web Services|https://www.miscmag.com/gros-plan-sur-la-securite-des-environnements-cloud-amazon-web-services/]]|AWS|
|2019.08.30|BetaNews|[[GDPR and Brexit - Is your cloud provider ready for the UK 'being treated like a third country'?|https://betanews.com/2019/08/30/gdpr-and-brexit/]]|GDPR Brexit|
|2019.08.30|DZone|[[Survey Reveals Rapid Growth in Kubernetes Usage, Security Still a Concern|https://dzone.com/articles/survey-reveals-rapid-growth-in-kubernetes-usage-se]]|Kubernetes Report|
|2019.08.30|Infosec Island|[[Three Strategies to Avoid Becoming the Next Capital One|http://www.infosecisland.com/blogview/25219-Three-Strategies-to-Avoid-Becoming-the-Next-Capital-One.html]]|Incident CapitalOne Lessons_Learnt|
|2019.08.30|TechRepublic|[[How the Cloud Security Alliance helps businesses identify and mitigate cybersecurity risks|https://www.techrepublic.com/article/how-the-cloud-security-alliance-helps-businesses-identify-and-mitigate-cybersecurity-risks/]]|CSA|
|2019.08.30|The Register|[[Microsoft's cloudy Windows Virtual Desktop: It fills a gap, but there are plenty of annoyances|https://www.theregister.co.uk/2019/08/30/microsofts_cloudy_windows_virtual_desktop_fills_a_gap_but_with_plenty_of_annoyances/]]|Virtual_Desktop|
|2019.08.30|Solutions Review|[[5 Cloud Security Mistakes That Could Ruin Your Business|https://solutionsreview.com/cloud-platforms/5-cloud-security-mistakes-that-could-ruin-your-business/]]|Mistakes|
|2019.08.30|Krebs on Security|[[Phishers are Angling for Your Cloud Providers|https://krebsonsecurity.com/2019/08/phishers-are-angling-for-your-cloud-providers/]]|Third_Party Phishing CSP|
|2019.08.30|Verdict|[[Teletext Holidays data breach exposes 212,000 customer call recordings|https://www.verdict.co.uk/teletext-holidays-data-breach-customer-call/]]|AWS Data_Leak|
|2019.09.02|The Register| → [[Teletext Holidays a) exists and b) left 200k customer call recordings exposed in S3 bucket|https://www.theregister.co.uk/2019/09/02/teletext_holidays_200k_call_recordings_s3_bucket/]]|AWS Data_Leak|
|2019.08.30|Silicon.fr[>img[iCSF/flag_fr.png]]|[[Institutions financières : le moment est-il venu de confier la conformité au cloud ?|https://www.silicon.fr/avis-expert/institutions-financieres-le-moment-est-il-venu-confier-la-conformite-au-cloud]]|Compliance|
|2019.08.30|//Microsoft//|![[Scalable infrastructure for investigations and incident response|https://msrc-blog.microsoft.com/2019/08/30/scalable-infrastructure-for-investigations-and-incident-response/]]|Incident_Handling Infrastructure|
|2019.08.30|//Microsoft//| → [[Powershell Scripts to automatically deploy an image of a prebuilt VM to every region you require|https://github.com/microsoft/Scalable-Infrastructure-for-Investigation-and-Incident-Response]]|Incident_Handling Infrastructure|
|2019.08.30|//Google Cloud//|[[Kubernetes security audit: What GKE and Anthos users need to know|https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-security-audit-what-gke-and-anthos-users-need-to-know]]|Kubernetes Audit|
|2019.08.30|//Lacework//|[[Avoid Gaps in Native Cloud Security Tools With a Comprehensive Security Approach, Part 2|https://www.lacework.com/integrate-cloud-security-tools/]] (2/2)|Strategy|
|2019.08.30|//Gartner//|![[G00441737: The Future of Network Security Is in the Cloud|https://www.gartner.com/doc/reprints?id=1-6QW0Z4A&ct=190528]]|Gartner Network SASE G00441737|
|>|>|>|!2019.08.29|
|2019.08.29|GSA|[[GSA and DOD Award Defense Enterprise Office Solutions Cloud Contract|https://www.gsa.gov/about-us/newsroom/news-releases/gsa-and-dod-award-defense-enterprise-office-solutions-cloud-contract]]|DoD O365|
|2019.08.29|Silicon Angle| → [[DOD awards $7.6B Microsoft Office 365 cloud contract to General Dynamics and partners|https://siliconangle.com/2019/08/29/dod-awards-7-6b-office-365-contract-general-dynamics-partners/]]|DoD O365|
|2019.08.30|Breaking Defense| → [[DoD 'Office' Functions Move To Cloud In Multi-Billion-Dollar Contract|https://breakingdefense.com/2019/08/dod-office-functions-move-to-cloud-in-multi-billion-dollar-contract/]]|Misc|
|2019.08.29|Bleeping Computer|[[Starbucks Abandons Azure Site, Exposed Subdomain to Hijacking|https://www.bleepingcomputer.com/news/security/starbucks-abandons-azure-site-exposed-subdomain-to-hijacking/]]|Azure DNS Incident|
|2019.08.29|DZone|[[Kubernetes Evolution|https://dzone.com/articles/kubernetes-evolution]]|Kubernetes|
|2019.08.29|//AppSecCo//|[[Getting shell and data access in AWS by chaining vulnerabilities|https://blog.appsecco.com/getting-shell-and-data-access-in-aws-by-chaining-vulnerabilities-7630fa57c7ed]]|AWS Vulnerabilities|
|2019.08.29|//Idaptative//|[[Next-Gen Access and Zero Trust are the PB&J of Security|https://www.idaptive.com/blog/Next-Gen-Access-Zero-Trust-PBJ-Security/]]|Zero_Trust|
|2019.08.29|//Google Cloud//|[[Now in beta: Managed Service for Microsoft Active Directory (AD)|https://cloud.google.com/blog/products/identity-security/now-in-beta-managed-service-for-microsoft-active-directory-ad]]|GCP Active_Directory|
|2019.08.29|Dark Reading| → [[Google Cloud Releases Beta of Managed Service to Microsoft AD|https://www.darkreading.com/cloud/google-cloud-releases-beta-of-managed-service-to-microsoft-ad/d/d-id/1335687]]|GCP Active_Directory|
|2019.08.29|Compare The Cloud|[[Don't let the FUD cloud the cloud|https://www.comparethecloud.net/articles/dont-let-the-fud-cloud-the-cloud/]]|Misc|
|2019.08.29|//JumpCloud//|[[How to Create a Secure Cloud Identity|https://jumpcloud.com/blog/create-secure-cloud-identity/]]|IAM|
|2019.08.29|//TheNextWeb//|[[This Microsoft Azure training will take your from zero to in-demand data hero|https://thenextweb.com/offers/2019/08/29/this-microsoft-azure-training-will-take-your-from-zero-to-in-demand-data-hero/]]|Training Azure|
|2019.08.29|//Aqua//|![[DNS Spoofing on Kubernetes Clusters|https://blog.aquasec.com/dns-spoofing-kubernetes-clusters]]|Kubernetes DNS_Spoofing|
|2019.08.29|//Synetis//[>img[iCSF/flag_fr.png]]|![[SecNumCloud et ISO / IEC 27001 : Quelle norme pour la sécurité du Cloud ?|https://www.synetis.com/secnumcloud-et-iso-iec-27001-quelle-norme-pour-la-securite-du-cloud/]]|Standards SecNumCloud ISO27001|
|>|>|>|!2019.08.28|
|2019.08.28|//DivvyCloud//|[[Financial Services Organizations Don't Need To Fear The Cloud|https://www.forbes.com/sites/forbestechcouncil/2019/08/28/financial-services-organizations-dont-need-to-fear-the-cloud/]]|Misc|
|2019.08.28|DZone|[[Kubernetes Concerns|https://dzone.com/articles/kubernetes-concerns]]|Kubernetes|
|2019.08.28|DZone|[[The Top Ten Cloud Tools From AWS|https://dzone.com/articles/top-10-aws-services]]|AWS|
|2019.08.28|DataCenter Mag|[[Transformation digitale : le SD-WAN peut-il aider à renforcer la sécurité des applications cloud-firs|https://datacenter-magazine.fr/transformation-digitale-le-sd-wan-peut-il-aider-a-renforcer-la-securite-des-applications-cloud-firs/]]|SDWAN|
|2019.08.28|Bloomberg|[[Cloud Security Boom Creates New Crop of Tech Darlings|https://www.bloomberg.com/news/articles/2019-08-28/young-guns-of-cybersecurity-emerge-as-winners-in-shift-to-cloud]]|Misc|
|2019.08.28|TechRepublic|[[How to use Harbor to scan Docker images for vulnerabilities|https://www.techrepublic.com/article/how-to-use-harbor-to-scan-docker-images-for-vulnerabilities/]]|Docker Prevention|
|2019.08.28|Security Boulevard|[[Hybrid vs. Cloud-Based Web Security: Anatomy of a Breach|https://securityboulevard.com/2019/08/hybrid-vs-cloud-based-web-security-anatomy-of-a-breach/]]|Breach|
|2019.08.28|//SecurityIntelligence//|[[Considering Container Security? 6 Ways to Make a Case for Containerization|https://securityintelligence.com/articles/considering-container-security-6-ways-to-make-a-case-for-containerization/]]|Containers|
|2019.08.28|//JumpCloud//|[[Can I Move Active Directory to the Cloud?|https://jumpcloud.com/blog/ad-to-the-cloud/]]|Active_Directory|
|2019.08.28|//Zscaler//|[[To flip the security model, start with "yes"|https://www.zscaler.com/blogs/corporate/flip-security-model-start-yes]]|Misc|
|2019.08.28|//Twistlock//|[[Non-root containers, Kubernetes CVE-2019-11245 and why you should care|https://www.twistlock.com/labs-blog/non-root-containers-kubernetes-cve-2019-11245-care/]]|Kubernetes CVE-2019-11245|
|2019.08.28|//AWS//|[[Summary of the Amazon EC2 and Amazon EBS Service Event in the Tokyo (AP-NORTHEAST-1) Region|https://aws.amazon.com/message/56489/]]|Outage AWS|
|>|>|>|!2019.08.27|
|2019.08.27|Wall Street Jounal|[[Human Error Often the Culprit in Cloud Data Breaches|https://www.wsj.com/articles/human-error-often-the-culprit-in-cloud-data-breaches-11566898203]]|Risks|
|2019.08.27|DZone|[[The IAM Conundrum |https://dzone.com/articles/the-iam-conundrum-1]]|IAM AWS|
|2019.08.27|DZone|![[Kubernetes #Fails|https://dzone.com/articles/kubernetes-fails]]|Kubernetes|
|2019.08.27|Times of Israël[>img[iCSF/flag_fr.png]]|[[Israël lance un appel d'offre pour un énorme centre de données en cloud|https://fr.timesofisrael.com/israel-lance-un-appel-doffre-pour-un-enorme-centre-de-donnees-en-cloud/]]|Sovereign_Cloud|
|2019.08.27|//FireEye//|[[Automated Threat Remediation for Office 365 Is Now a Few Clicks Away (Part Two)|https://www.fireeye.com/blog/products-and-services/2019/08/automated-threat-remediation-for-office-365-is-now-a-few-clicks-away-part-two.html]] (2/2)|O365 Remediation|
|2019.08.27|Solutions Review|[[6 Devastating Cloud Migration Mistakes You Need to Avoid|https://solutionsreview.com/cloud-platforms/6-devastating-cloud-migration-mistakes-you-need-to-avoid/]]|Migration|
|2019.08.27|JDSupra|[[Alert: Treasury Department Issues Proposed Rules on Cloud Transactions, Other Digital Content|https://www.jdsupra.com/legalnews/alert-treasury-department-issues-76043/]]|Regulations|
|2019.08.27|//eXemplify//|[[Data in the Cloud: How a Valuable Tool Can Also Be a Risk|http://www.exemplifygroup.com/data-in-the-cloud-how-a-valuable-tool-can-also-be-a-risk/]]|Risks|
|2019.08.27|//Tripwire//|[[Who Is Responsible for Your Cloud Security?|https://www.tripwire.com/state-of-security/security-data-protection/cloud/responsible-cloud-security/]]|Responsibility|
|2019.08.27|Forbes|[[The Cloud Is Now For Mission-Critical Enterprise Systems|https://www.forbes.com/sites/forbestechcouncil/2019/08/27/the-cloud-is-now-for-mission-critical-enterprise-systems/]]|Reliability|
|2019.08.27|//Imperva//|[[Imperva Security Update|https://www.imperva.com/blog/ceoblog/]]|DataBreach Imperva|
|2019.08.27|Krebs on Security| → [[Cybersecurity Firm Imperva Discloses Breach|https://krebsonsecurity.com/2019/08/cybersecurity-firm-imperva-discloses-breach/]]|DataBreach Imperva|
|2019.08.27|Silicon Angle| → [[Imperva 'security incident' exposes customer data|https://siliconangle.com/2019/08/27/imperva-security-incident-exposes-cloud-waf-customer-data/]]|DataBreach Imperva|
|2019.08.27|Security Week| → [[Imperva Notifies Cloud WAF Customers of Security Incident|https://www.securityweek.com/imperva-notifies-cloud-waf-customers-security-incident]]|DataBreach Imperva|
|2019.08.27|//Threatpost//| → [[Imperva Firewall Breach Exposes Customer API Keys, SSL Certificates|https://threatpost.com/imperva-firewall-breach-api-keys-ssl-certificates/147743/]]|DataBreach Imperva|
|2019.08.27|CBR Online| → [[Imperva Hacked: Customer API Keys, SSL Certificates Stolen|https://www.cbronline.com/news/imperva-hacked]]|DataBreach Imperva|
|2019.08.27|//Lacework//|[[Avoid Gaps in Native Cloud Security Tools With a Comprehensive Security Approach, Part 1|https://www.lacework.com/native-cloud-security-gaps/]] (1/2)|Strategy|
|2019.08.27|//Azure//|[[Latency is the new currency of the Cloud: Announcing 31 new Azure edge sites|https://azure.microsoft.com/en-us/blog/latency-is-the-new-currency-of-the-cloud-announcing-31-new-azure-edge-sites/]]|Latency|
|2019.08.27|//Fortinet//|[[Securing Your Dynamic Cloud Strategy|https://www.fortinet.com/blog/industry-trends/secure-your-dynamic-cloud-strategy.html]]|Misc|
|2019.08.27|NextCloud|[[Amid escalating trade disputes, EU governments choose independence from US cloud providers|https://nextcloud.com/press/pr20190827/]]|NextCloud|
|2019.08.29|ZDnet[>img[iCSF/flag_fr.png]]| → [[Nextcloud : le ministère de l'Intérieur opte pour une solution libre|https://www.zdnet.fr/actualites/nextcloud-le-ministere-de-l-interieur-opte-pour-une-solution-libre-39889691.htm]]|NextCloud|
|>|>|>|!2019.08.26|
|2019.08.26|Journal du Net[>img[iCSF/flag_fr.png]]|[[Gouvernance des données dans le cloud : comment l'aborder|https://www.journaldunet.com/solutions/expert/71621/gouvernance-des-donnees-dans-le-cloud---comment-l-aborder.shtml]]|Governance|
|2019.08.26|CIO Dive|![[Gartner: A 10-step cookbook for building a cloud strategy|https://www.ciodive.com/news/gartner-a-10-step-cookbook-for-building-a-cloud-strategy/561315/]]|Strategy|
|2019.08.26|BetaNews|[[How cloud-based training can help address the cybersecurity skills gap [Q&A]|https://betanews.com/2019/08/26/cloud-training-security-qa/]]|Training|
|2019.08.26|DZone|[[How to Implement Kubernetes|https://dzone.com/articles/keys-to-implementing-kubernetes]]|Kubernetes|
|2019.08.26|Compliant Cloud|![[Periodic Review for outsourced cloud-based computerised systems, applications and infrastructure|https://compliantcloud.com/periodic-review-for-outsourced-cloud-based-computerised-systems-applications-and-infrastructure/]]|Compliance|
|2019.08.26|//Alibaba Cloud//|[[Container Security: A Look at Rootless Containers|https://medium.com/datadriveninvestor/container-security-a-look-at-rootless-containers-7c2ea6f6842]]|Containers|
|2019.08.26|//Google Cloud//|[[5 steps to improve your cloud security posture with Cloud Security Command Center|https://cloud.google.com/blog/products/identity-security/5-steps-to-improve-your-cloud-security-posture-with-cloud-security-command-center]] (1/6)|Security_Posture|
|2019.08.26|//Bitglass//|[[The Four Pillars of CASB: Data Protection|https://www.bitglass.com/blog/four-pillars-casb-data-protection]] (1/4)|CASB|
|2019.08.26|//Deloitte//|[[Data modernization and the cloud|https://www2.deloitte.com/us/en/insights/topics/analytics/data-modernization-and-cloud-migration-initiatives.html]]|Report Deloitte|
|2019.08.31|ZDnet| → [[Cloud needs a modern data foundation, modern data needs a cloud foundation|https://www.zdnet.com/article/cloud-needs-a-modern-data-foundation-modern-data-needs-a-cloud-foundation/]]|Report Deloitte|
|2019.09.03|ZDnet[>img[iCSF/flag_fr.png]]| → [[Analyse : le cloud a besoin d'une base de données moderne, et les données modernes ont besoin du cloud|https://www.zdnet.fr/actualites/analyse-le-cloud-a-besoin-d-une-base-de-donnees-moderne-et-les-donnees-modernes-ont-besoin-du-cloud-39889899.htm]]|Report Deloitte|
!"//Egregious 11 Meta-Analysis Part 2: Virtualizing Visibility//"
[>img(200px,auto)[iCSA/J9SBE.jpg]]Deuxième article de la série, publié le 28 août 2019 — Rédigé par Victor Chin, Research Analyst, CSA
<<<
//This is the second blog post in the series where we analyze the security issues in the new iteration of the Top Threats to Cloud Computing report. Each blog post features a security issue that is being perceived as less relevant and one that is being perceived as more relevant.

In this report, we found that traditional cloud security issues stemming from concerns about having a third-party provider are being perceived as less relevant. While more nuanced issues specific to cloud environments are being perceived as more problematic. With this in mind, we will be examining Shared Technology Vulnerabilities and Limited Cloud Usage Visibility further.
Please note that the Top Threats to Cloud Computing reports are not meant to be the definitive list of security issues in the cloud. Rather, the studies measures what industry experts perceive the key security issues to be.

__Shared Technology Vulnerabilities__
Shared Technology Vulnerabilities generally refers to vulnerabilities in the virtual infrastructure where resources are shared amongst tenants. Over the years, there have been several vulnerabilities of that nature with the most prominent being the VENOM (CVE-2015-3456)~~[1]~~ vulnerability that was disclosed in 2015. Shared Technology Vulnerabilities used to be high up on the list of problematic issues. For example, in the first two iterations of the report, Shared Technology Vulnerabilities were rated at 9th and 12th. In the latest iteration of the report, it has dropped off entirely and is no longer perceived by as relevant. It had a score of 6.27 (our cutoff was 7 and above) and ranked 16 out of the 20 security issues surveyed.

Virtualization itself is not a new cloud technology, and its benefits are well known. Organizations have been using virtualization technology for many years as it helps to increase organizational IT agility, flexibility, and scalability while generating cost savings. For example, organizations would only have to procure and maintain one physical asset. That physical IT asset is then virtualized so that its resources are shared across the organization. As the organization owns and manages the entire IT stack, it also has visibility and control over the virtualization technology.

In cloud environments, the situation is markedly different. Virtualization technology (like hypervisors) is generally considered underlying technology that is owned and managed by the cloud service provider. Consequently, the cloud customer has limited access or visibility into the virtualization layer.

[>img(400px,auto)[iCSA/J9SBE.png]]For example, the figure on the right is an architectural representation of the three cloud service models. Underlying technology in an Infrastructure-as-a-Service (IaaS) service model refers to APIs (blue) and anything else below it. Those components are under the control and management of the CSP. At the same time, anything above the APIs (blue) is under the control and management of the cloud customer. For Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS), underlying technology refers to anything underneath Integration & Middleware and Presentation Modality and Presentation Platform, respectively.

Naturally, in the early days of cloud computing, such vulnerabilities were a significant concern for customers. Not only did they have limited access and visibility into the virtualization layer, but the cloud services were also all multi-tenant systems which contained the data and services of other customers of the CSPs.

Over time, it seems like the industry has grown to trust the cloud service providers when it comes to Shared Technology Vulnerabilities. Cloud adoption is at its highest with many organizations adopting a 'Cloud First' policy. However, there is still no industry standard or existing framework that formalizes vulnerability notifications for CSPs, even when a vulnerability is found in the underlying cloud infrastructure. For example, when there is a vulnerability disclosure for a particular hypervisor, (e.g. XEN) an affected CSP does not have to provide any information to its customers. For more information on this issue, please read my other blogpost on cloud vulnerabilities.

That said, it is of note that many recent cloud breaches are the result of misconfigurations by cloud customers. For example, in 2017, Accenture left at least four Amazon S3 buckets set to public and exposed mission-critical infrastructure data. As cloud services developed, the major CSPs have, for the most part, provided sufficient security controls to enable cloud customers to properly configure their environments.

Nevertheless, virtualization technology is a critical component to any cloud service, and vulnerabilities in the virtualization layer can have severe consequences. Cloud customers must remain vigilant when it comes to Shared Technology Vulnerabilities.

__Limited Cloud Usage Visibility__
In the latest Top Threats to Cloud Computing report, Limited Cloud Usage Visibility made its debut in the 10th position.

Limited Cloud Usage Visibility refers to when organizations experience a significant reduction in visibility over their information technology stack. This is due to two main factors. Firstly, unlike in traditional IT environments, the enterprise does not own or manage the underlying cloud IT infrastructure. Consequently, they are not able to fully implement security controls or monitoring tools with as much depth and autonomy as they did with a traditional IT stack. Instead, cloud customers often have to rely on logs provided to them by the cloud providers. Sometimes, these logs are not as detailed as the customer would like it to be.

Secondly, cloud services are highly accessible. They can generally be accessed from the public internet and do not have to go through a company VPN or gateway. Hence, the effectiveness of some traditional enterprise security tools is reduced. For instance, network traffic monitoring and perimeter firewalls are not as effective as they cannot capture network traffic to cloud services that originate outside the organization. For many organizations, such monitoring capabilities are becoming more critical as they begin to host business-critical data and services in the cloud.

To alleviate the issue, enterprises can start using more cloud-aware technology or services to provide more visibility and control of the cloud environment. However, most of the time, the level of control and granularity cannot match that of a traditional IT environment. This lack of visibility and control is something that enterprises moving to the cloud have to get used to. There will be some level of risk associated to it, and it is a risk that they have to accept or work around. Organizations that are not prepared for this lack of visibility in the cloud might end up not applying the proper mitigations. That or they will find themselves unable to fully realize the cost savings of a cloud migration.
[...]
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456 //
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/13/egregious-11-meta-analysis-part-1-insufficient-due-diligence-and-cloud-security-architecture-and-strategy/]] sur le blog de la CSA.
!"//On-Chain vs Off-Chain governance. What are the rules to Calvinball?//"
[>img(150px,auto)[iCSA/J8QBO.png]]Article de blog publié le 26 août 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//If you don't know what Calvin and Hobbes is you can skip the next bit, but it is amusing.

Calvinball is a game invented by Calvin and Hobbes. Calvinball has no rules; the players make up their own rules as they go along, making it so that no Calvinball game is like another.Rules cannot be used twice (except for the rule that rules cannot be used twice), and any plays made in one game may not be made again in any future games. The game may involve wickets, mallets, volleyballs, and additional sports-related equipment.

If you are familiar with Blockchain governance then the rules to Calvinball may sound eerily similar.

Anytime we build a complex system it will need to be governed by rules. This is especially true for any complex system that involves humans and may need to be modified in the future. In effect, you will not only need rules to govern the system, but rules to govern the rules governing the system. Do you require a 51% majority vote to make a change? How many voters have to participate for a decision to be valid? What defines a voter? What defines a vote? How long are votes held for, how are they announced, who is allowed to initiate a vote?

This was the part where I started discussing on-chain vs. off-chain governance models and various technical aspects of them. But I realized it doesn't matter that much, ultimately what it boils down to is a few core questions:
* Where are the rules defined?
* How are the rules changed?
* Who enforces the current rules?
* How do you create consensus?
* How do you handle disagreements?
* How do you build the incentives to support the above?

Whether or not this happens on chain or off chain we have one ultimate question: How do you build the incentives to support the above? Do you give the miners power? The holders of the tokens? The governance board for the Blockchain?

In general when it comes to building consensus and handling disagreements the least worst solution we have found is democracy, people vote, feel heard, and hopefully both the winners and the losers accept the results and continue on with their lives. When people refuse to accept the results we have problems, for example a Blockchain with a significant and passionate group that is opposed to a change may hard fork, effectively taking their ball and going elsewhere with it. Alternatively I have seen Blockchains attempt to create safety valves, for example allowing people who disagree with a change to close out their position and exit the market in an orderly manner, minimizing the chances of a hard fork.

Because ultimately Blockchain and any complex system that relies upon network effects to create value must foster and encourage consensus between the participants or else it risks pushing people away, and it's not like there aren't hundreds of other Blockchain projects people can //
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/26/on-chain-vs-off-chain-governance-what-are-the-rules-to-calvinball/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 19 au 25 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Actu: Appel à commentaires, document ''Software-Defined Perimeter as a DDoS Prevention Mechanism''+++*[»]> <<tiddler [[2019.08.19 - Actu : Appel à commentaires, document 'Software-Defined Perimeter as a DDoS Prevention Mechanism']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.25 - Veille Hebdomadaire]] avec plus de 90 liens :
* Alertes: plusieurs vulnérabilités Kubernetes+++*[»]> <<tiddler [[2019.08.31.Alert]]>>=== 
* Piratages et fuites de données : encore plusieurs commentaires suites de l'attaques contre Capital One dont la Banque Centrale Européenne (''BCE'')et Patrice Bernard
* Rapports et sondages : ''(ISC)^^2^^'', ''Kaspersky'', ''Outpost24'', ''Report Ocean'', ''Tripwire'', ''Vade Secure''
* Attaques : encore du phishing utilisant des ressources dans le Cloud
* Panne : Claranet (UK), GitHub, Google
* Divers : création de la communauté ''Confidential Computing Consortium'' par la Linux Foundation
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!Vulnérabilités Kubernetes|
|2019.08.13|Netflix|[[NFLX-2019-002: HTTP/2 Denial of Service Advisory|https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md]]|Kubernetes CVE-2019-9511→9518|
|2019.08.23|Security Week| → [[Kubernetes Patches Recent HTTP/2 Vulnerabilities|https://www.securityweek.com/kubernetes-patches-recent-http2-vulnerabilities]]|Kubernetes Vulnerabilities|
|2019.08.23|Packt pub| → [[A security issue in the net/http library of the Go language affects all versions and all components of Kubernetes|https://hub.packtpub.com/a-security-issue-in-the-net-http-library-of-the-go-language-affects-all-versions-and-all-components-of-kubernetes/]]|Kubernetes Vulnerabilities|
|2019.08.22|//PaloAlto Networks//| → [[Kubernetes - Vulnerable to Denial-of-Service Attacks|https://blog.paloaltonetworks.com/2019/08/cloud-kubernetes-vulnerable-denial-service-attacks/]]|Kubernetes Vulnerabilities|
|2019.08.20|Bleeping Computer| → [[Severe Flaws in Kubernetes Expose All Servers to DoS Attacks|https://www.bleepingcomputer.com/news/security/severe-flaws-in-kubernetes-expose-all-servers-to-dos-attacks/]]|Kubernetes Vulnerabilities|
|>|>|>|!Incident CapitalOne|
|2019.08.24|Fortune| → [[Even After Capital One's Breach, Don't Doubt the Cloud - Cyber Saturday|https://fortune.com/2019/08/24/even-after-capital-ones-breach-dont-doubt-the-cloud-cyber-saturday/]]|Risks|
|2019.08.23|Dark Reading|! → [[Capital One Breach: What Security Teams Can Do Now|https://www.darkreading.com/endpoint/capital-one-breach-what-security-teams-can-do-now/a/d-id/1335475]]|Incident CapitalOne AWS MITRE_ATT&CK Lessons_Learnt|
|2019.08.19|//CloudPassage//| → [[Preventing a Capital One Cloud Data Breach|https://blog.cloudpassage.com/2019/08/21/preventing-a-capital-one-cloud-data-breach/]]|Incident CapitalOne Lessons_Learnt|
|2019.08.20|CIO Dive| → [[Onus for cloud security falls on customers, but AWS could do more, CISO says|https://www.ciodive.com/news/onus-for-cloud-security-falls-on-customers-but-aws-could-do-more-ciso-say/561269/]]|Incident CapitalOne AWS|
|2019.08.19|Banque Centrale Européenne|![[ECB Says the Next European Bank Hack Is Just a Matter of Time|https://www.bloomberg.com/news/articles/2019-08-19/ecb-says-the-next-european-bank-hack-is-just-a-matter-of-time]]|Threats CapitalOne|
|2019.08.19|Patrice Bernard|! → [[Et le cloud devint bouc émissaire|http://cestpasmonidee.blogspot.com/2019/08/et-le-cloud-devint-bouc-emissaire.html]]|CapitalOne Lessons_Learnt|
|2019.08.19|Security Week| → [[AWS: No Significant Issues at Other Alleged Targets of Capital One Hacker|https://www.securityweek.com/aws-no-significant-issues-other-alleged-targets-capital-one-hacker]]|Incident CapitalOne AWS|
|2019.08.19|//Duo Security//| → [[AWS Promises to Scan for Misconfigured Servers|https://duo.com/decipher/aws-promises-to-scan-for-misconfigured-servers]]|Incident CapitalOne AWS|
|>|>|>|!2019.08.25|
|2019.08.25|//Infoblox//|[[Cloud and IPv6|https://community.infoblox.com/t5/IPv6-CoE-Blog/Cloud-and-IPv6/ba-p/3510]]|IPv6|
|>|>|>|!2019.08.24|
|2019.08.24|Secure Reading|[[Securing Cloud Data: Role of Encryption in the Cloud|https://securereading.com/securing-cloud-data-role-of-encryption-in-the-cloud/]]|Encryption|
|>|>|>|!2019.08.23|
|2019.08.23|Le Big Data[>img[iCSF/flag_fr.png]]|[[Cloud : quelles sont les principales menaces et comment s'en protéger|https://www.lebigdata.fr/cloud-menaces]]|CSA Threats|
|2019.08.23|Computer Weekly|[[Majority of organisations struggling with cloud security|https://www.computerweekly.com/news/252469101/Majority-of-organisations-struggling-with-cloud-security]]|Misc|
|2019.08.23|VMblog|[[Who Guards Cloud: Major Cloud Computing Risks and How to Protect It|https://vmblog.com/archive/2019/08/23/who-guards-cloud-major-cloud-computing-risks-and-how-to-protect-it.aspx]]|Risks|
|2019.08.23|The Next Web|[[AWS issues are causing erratic cryptocurrency market data in Asia|https://thenextweb.com/hardfork/2019/08/23/aws-issues-are-causing-erratic-cryptocurrency-market-data-in-asia/]]|Outage AWS Impacts|
|2019.08.23|//Lacework//|[[Lacework Resolves the Container Security Gap|https://www.lacework.com/lacework-container-security/]]|Containers|
|2019.08.23|//Microsoft//|[[Azure AD Mailbag: Tips for Azure AD reporting and monitoring your day-to-day activities |https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Azure-AD-Mailbag-Tips-for-Azure-AD-reporting-and-monitoring-your/ba-p/566498]]|AzureAD Monitoring|
|2019.08.23|//IBM//|[[Quantum Security|https://www.ibm.com/thought-leadership/institute-business-value/report/quantumsecurity]]|Quantum_Computing|
|2019.08.23|Gigabit| → [[Will quantum computing revolutionise cybersecurity? IBM thinks so |https://www.gigabitmagazine.com/cloud-computing/will-quantum-computing-revolutionise-cybersecurity-ibm-thinks-so]]|Quantum_Computing|
|2019.08.23|Dark Reading| → [[IBM Announces Quantum Safe Encryption|https://www.darkreading.com/application-security/ibm-announces-quantum-safe-encryption/d/d-id/1335632]]|Quantum_Computing|
|2019.08.23|//OCD-Tech//|[[Vulnerabilities in the Cloud: Whose Responsibility is it Anyways?|https://ocd-tech.com/2018/08/23/vulnerabilities-in-the-cloud-whose-responsibility-is-it-anyways/]]|Vulnerabilities Responsibility|
|2019.08.23|//Cloudonaut//|[[Complete AWS IAM Reference|https://iam.cloudonaut.io/]]|AWS IAM|
|>|>|>|!2019.08.22|
|2019.08.22|Infosec Institute|[[AWS Security Monitoring Checklist|https://resources.infosecinstitute.com/aws-security-monitoring-checklist/]]|AWS Monitoring|
|2019.08.22|Bleeping Computer|[[GitHub Experienced Widespread Major Services Outage|https://www.bleepingcomputer.com/news/technology/github-experienced-widespread-major-services-outage/]]|Outage GitHub|
|2019.08.22|Computer Weekly|[[Cyber attackers exploiting poor cloud security|https://www.computerweekly.com/news/252469000/Cyber-attackers-exploiting-poor-cloud-security]]|Threats|
|2019.08.22|Container Journal|[[Do VPNs Have a Place in Container Security?|https://containerjournal.com/topics/container-security/do-vpns-have-a-place-in-container-security/]]|Containers VPN|
|2019.08.22|Healthcare IT News|[[CISO security tips for managing hybrid cloud deployments|https://www.healthcareitnews.com/news/ciso-security-tips-managing-hybrid-cloud-deployments]]|Hybrid_Cloud|
|2019.08.22|infoRisk Today|[[Cloud Security: Mess It Up and It's on You|https://www.inforisktoday.com/cloud-security-mess-up-its-on-you-a-12942]]|Governance|
|2019.08.22|DZone|[[Serverless on GCP: A Comprehensive Guide|https://dzone.com/articles/serverless-on-gcp]]|GCP Serverless|
|2019.08.22|Techtarget|[[Use modern cloud security best practices|https://searchcloudcomputing.techtarget.com/tip/Use-modern-cloud-security-best-practices]]|Best_Practices|
|2019.08.22|//Aqua//[>img[iCSF/flag_fr.png]]|[[la sécurité doit être intégrée dès la phase de conception des architectures|http://www.globalsecuritymag.fr/Rani-Osnat-Aquasec-la-securite,20190823,89916.html]]|Containers|
|2019.08.22|//Vade Secure//[>img[iCSF/flag_fr.png]]|[[Le phishing visant Facebook monte en flèche au 2e trimestre 2019, tandis que Microsoft demeure la marque la plus ciblée|http://www.globalsecuritymag.fr/Le-phishing-visant-Facebook-monte,20190822,90087.html]]|Report Vade_Secure|
|2019.08.22|//Tripwire//|![[Survey: 84% of Security Pros Said Their Organizations Struggled to Maintain Security Configurations in the Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/survey-84-of-security-pros-said-their-organizations-struggled-to-maintain-security-configurations-in-the-cloud/]]|Report SANS|
|2019.08.22|//Outpost24//|[[37% Of Organisations Have Suffered A Cyberattack On Cloud Environments Due To The Lack Of Basic Cloud Security Hygiene|https://www.informationsecuritybuzz.com/study-research/37-of-organisations-have-suffered-a-cyberattack-on-cloud-environments-due-to-the-lack-of-basic-cloud-security-hygiene/]]|Report Outpost24|
|2019.08.22|//Sonatype//|[[Building Microservice Architecture on Kubernetes|https://blog.sonatype.com/microservice-architecture-on-kubernetes]]|Kubernetes MicroServices|
|2019.08.22|//Akamai//|[[How to Provide Secure Access to AWS Workloads|https://blogs.akamai.com/2019/08/how-to-provide-secure-access-to-aws-workloads.html]]|Access_Controls|
|2019.08.22|//McAfee//|[[19 Cloud Security Best Practices for 2019|https://securingtomorrow.mcafee.com/business/cloud-security/top-19-cloud-security-best-practices/]]|Best_Practices|
|2019.08.22|//Google Cloud//|[[Got microservices? Service mesh management might not be enough|https://cloud.google.com/blog/products/api-management/got-microservices-service-mesh-management-might-not-be-enough]]|APIs|
|2019.08.22|//Caylent//|[[Securing Your Kubernetes Pipeline|https://caylent.com/securing-your-kubernetes-pipeline/]]|Kubernetes|
|2019.08.22|//eXemplify//|[[Infographic: The Cloud and IoT Working Together|http://www.exemplifygroup.com/cloud-iot-infographic/]]|IoT|
|>|>|>|!2019.08.21|
|2019.08.21|(ISC)2|![[2019 Cloud Security Report|https://www.isc2.org/resource-center/reports/cloud-security-report]]|Report ISC2|
|2019.08.21|Confidential Computing Consortium|![[New Cross-Industry Effort to Advance Computational Trust and Security for Next-Generation Cloud and Edge Computing|https://confidentialcomputing.io/2019/08/21/new-cross-industry-effort-to-advance-computational-trust-and-security-for-next-generation-cloud-and-edge-computing/]]|Trust_Initiative|
|2019.08.21|GeekWire| → [[Microsoft, Google, Red Hat and others join forces for cloud security in 'confidential computing' group|https://www.geekwire.com/2019/microsoft-google-red-hat-others-join-forces-cloud-security-confidential-computing-group/]]|Trust_Initiative|
|2019.08.21|Computer Weekly| → [[Tech firms join forces to boost cloud security|https://www.computerweekly.com/news/252469010/Tech-firms-join-forces-to-boost-cloud-security]]|Trust_Initiative|
|2019.08.23|HelpNet Security| → [[New cross-industry consortium aims to accelerate confidential computing adoption|https://www.helpnetsecurity.com/2019/08/23/accelerate-confidential-computing-adoption/]]|Trust_Initiative|
|2019.08.21|CIO Review|[[Knowing your Provider's Capabilities is Critical to Cloud Security|https://sdn.cioreview.com/cxoinsight/knowing-your-provider-s-capabilities-is-critical-to-cloud-security-nid-24427-cid-147.html]]|CSP|
|2019.08.21|The Register|[[Welcome to Hollywood, Claranet-style: You've (not) got mail, or hosted sites for that matter|https://www.theregister.co.uk/2019/08/21/claranet_celebrates_wednesday_with_a_good_old_fashioned_outage/]]|Outage Claranet|
|2019.08.21|MeriTalk|[[Special Report: Zero Trust Necessary for Cloud Security|https://www.meritalk.com/articles/special-report-zero-trust-necessary-for-cloud-security/]]|Zero_Trust|
|2019.08.21|MSSP Alert|[[AWS Cloud Security: Web Application Firewall Statement|https://www.msspalert.com/cybersecurity-breaches-and-attacks/aws-wap-statement/]]|AWS Prevention|
|2019.08.21|//HiveMQ//|[[IoT Security in the cloud - How to integrate IoT Device Authentication and Authorization with HiveMQ and AWS|https://www.hivemq.com/blog/iot-security-hivemq-ese-aurora/|]]|IoT AWS|
|2019.08.21|//Box//|[[Introducing intelligent, frictionless content security with Box Shield|https://blog.box.com/box-shield-intelligent-frictionless-content-security]]|Detection Box|
|2019.08.21|SiliconAngle| → [[Box adds stricter access controls and threat detection capabilities|https://siliconangle.com/2019/08/21/box-adds-stricter-access-controls-threat-detection-capabilities/]]|Detection Box|
|2019.08.21|Dark Reading| → [['Box Shield' Brings New Security Controls|https://www.darkreading.com/cloud/box-shield-brings-new-security-controls-/d/d-id/1335593]]|Detection Box|
|2019.08.21|//Radware//|[[How to Choose a Cloud DDoS Scrubbing Service|https://blog.radware.com/security/ddos/2019/08/how-to-choose-a-cloud-ddos-scrubbing-service/]]|DDoS|
|2019.08.21|//Lacework//|[[Developing a Security-First Model for Cloud Compliance|https://www.lacework.com/security-first-cloud-compliance/]]|Compliance|
|2019.08.21|//Keysight//[>img[iCSF/flag_fr.png]]|[[Quatre priorités pour sécuriser le cloud|https://www.informatiquenews.fr/quatre-priorites-pour-securiser-le-cloud-lora-ohaver-keysight-technologies-62987]]|Misc|
|2019.08.21|//Fugue//|[[Why You Need Automated Remediation for AWS Security Groups and VPCs|https://www.fugue.co/blog/why-you-need-automated-remediation-for-aws-security-groups-and-vpcs]]|Remediation AWS|
|2019.08.21|//JumpCloud//|[[Google Cloud Identity vs Active Directory|https://jumpcloud.com/blog/google-cloud-identity-vs-active-directory/]]|GCP Active_Directory|
|2019.08.21|//Black Hills//|![[Securing the Cloud: A Story of Research, Discovery, and Disclosure|https://www.blackhillsinfosec.com/securing-the-cloud-a-story-of-research-discovery-and-disclosure/]]|AWS EMR|
|>|>|>|!2019.08.20|
|2019.08.20|NCSC UK|[[Cloud security made easier with Serverless|https://www.ncsc.gov.uk/blog-post/cloud-security-made-easier-with-serverless]]|Serverless|
|2019.08.20|Solutions Review|[[6 Questions to Ask Before Choosing a Cloud Managed Service Provider|https://solutionsreview.com/cloud-platforms/6-questions-to-ask-before-choosing-a-cloud-managed-service-provider/]]|Cloud_Managed_Service_Provider|
|2019.08.20|DZone|[[Cloud-Native Best Business Practices (Part 4): Automatic Backup and Disaster Recovery|https://dzone.com/articles/cloud-native-best-business-practices-part-4-automa]] (4/7)|Best_Practices|
|2019.08.20|DevOps|[[Autonomous Security in Containers|https://devops.com/autonomous-security-in-containers/]]|Containers|
|2019.08.20|//HiveMQ//|[[MQTT Topics & Best Practices - MQTT Essentials: Part 5|https://www.hivemq.com/blog/mqtt-essentials-part-5-mqtt-topics-best-practices/]] (5/5)|MQTT|
|2019.08.20|//Threatpost//|[[How to Prepare for Misconfigurations Clouding the Corporate Skies|https://threatpost.com/how-to-prepare-for-misconfigurations-that-cloud-the-corporate-skies/147538/]]|Misconfigurations|
|2019.08.20|//Managed Methods//|[[Use this 7 step data loss prevention checklist to help plan and tackle your DLP strategy|https://managedmethods.com/blog/data-loss-prevention-checklist/]]|DLP|
|2019.08.20|//Aryaka//|[[Building and Maintaining an SD-WAN is Complex and Time Consuming - Aryaka's Third Annual Global State of the WAN Report Reveals New Insights|https://vmblog.com/archive/2019/08/20/building-and-maintaining-an-sd-wan-is-complex-and-time-consuming-aryaka-s-third-annual-global-state-of-the-wan-report-reveals-new-insights.aspx]] ([[rapport|https://info.aryaka.com/state-of-the-wan-report-2019.html]]|Report Aryaka|
|2019.08.20|//Zscaler//|[[Four security hurdles with SD-WAN (and how to avoid them)|https://www.zscaler.com/blogs/corporate/four-security-hurdles-sd-wan-and-how-avoid-them]]|SD-WAN|
|2019.08.20|//Immuniweb//[>img[iCSF/flag_fr.png]]|[[Étude : L'état de la sécurité des applications parmi les 100 premières start-up mondiales fintech|http://www.globalsecuritymag.fr/Etude-L-etat-de-la-securite-des,20190820,89999.html]]|Report Immuniweb|
|2019.08.20|//Tripwire//|[[Forensics in the Cloud: What You Need to Know|https://www.tripwire.com/state-of-security/security-data-protection/cloud/forensics-cloud-need-to-know/]]|Forensics|
|2019.08.20|//Naked Security by Sophos//|[[Serious Security: Phishing in the cloud - the freemium way|https://nakedsecurity.sophos.com/2019/08/20/serious-security-phishing-in-the-cloud-the-freemium-way/]]|Phishing|
|2019.08.20|//Azure//|[[Azure Security Center single click remediation and Azure Firewall JIT support|https://azure.microsoft.com/en-us/blog/azure-security-center-single-click-remediation-and-azure-firewall-jit-support/]]|Azure|
|2019.08.20|//Microsoft //|[[One simple action you can take to prevent 99.9 percent of attacks on your accounts|https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/]]|Authentication MFA|
|2019.08.20|//Qualys//|[[If You Don't Have Visibility, You Don't Have Security|https://www.infosecisland.com/blogview/25217-If-You-Dont-Have-Visibility-You-Dont-Have-Security.html]]|Asset Management|
|2019.08.20|//CyberArk//[>img[iCSF/flag_fr.png]]|[[La chaine logistique, nouvelle cible des hackers|http://www.globalsecuritymag.fr/La-chaine-logistique-nouvelle,20190820,90013.html]]|Supply_Chain|
|2019.08.20|//Rapid7//|[[How Attackers Can Harvest Users' Microsoft 365 Credentials with New Phishing Campaign|https://blog.rapid7.com/2019/08/20/how-attackers-can-harvest-users-microsoft-365-credentials-with-new-phishing-campaign/]]|Phishing O365|
|2019.08.21|Bleeping Computer| → [[[Phishing Attacks Scrape Branded Microsoft 365 Login Pages|https://www.bleepingcomputer.com/news/security/phishing-attacks-scrape-branded-microsoft-365-login-pages/]]|Phishing O365|
|2019.08.20|//BlackBlaze//|[[What's the Diff: Private Cloud vs Public Cloud|https://www.backblaze.com/blog/private-cloud-vs-public-cloud/]]|Misc|
|2019.08.20|//CyberArk//|[[Four Things Security Can Do to Keep Up with DevOps CI/CD|https://www.cyberark.com/blog/four-things-security-can-do-to-keep-up-with-devops-ci-cd/]] (4/5)|SecDevOps|
|2019.08.20|//Thales//|[[The rise of hybrid cloud poses new security challenges - are you prepared?|https://blog.thalesesecurity.com/2019/08/20/the-rise-of-hybrid-cloud-poses-new-security-challenges-are-you-prepared/]]|Hybrid_Cloud|
|2019.08.20|//CCSI//|[[Secure SD-WAN Needs to Support Your Cloud On-Ramp Strategy|https://www.ccsinet.com/blog/secure-sdwan-cloud-strategy/]]|SD-WAN|
|2019.08.20|//FireEye//|[[Automated Threat Remediation for Office 365 Is Now a Few Clicks Away (Part One)|https://www.fireeye.com/blog/products-and-services/2019/08/automated-threat-remediation-for-office-365-a-few-clicks-away-part-one.html]] (1/2)|O365 Remediation|
|2019.08.20|//Veeam//[>img[iCSF/flag_fr.png]]|[[La sauvegarde fait plus que jamais partie intégrante de l'équation de la sécurité dans une ère de risques exceptionnels pour les entreprises|http://www.globalsecuritymag.fr/La-sauvegarde-fait-plus-que-jamais,20190819,89964.html]]|Backups|
|2019.08.20|//Veeam//[>img[iCSF/flag_fr.png]]|[[Les 6 principales raisons d'utiliser un service de sauvegarde dans le cloud (BaaS)|https://www.informatiquenews.fr/les-6-principales-raisons-dutiliser-un-service-de-sauvegarde-dans-le-cloud-baas-62962]]|Backups|
|2019.08.20|//Cyber Security Cloud//|[[Cyber Security Cloud Developed "Cyneural", A New Cyber Attack Detecting AI Engine Using Deep Learning|https://www.benzinga.com/pressreleases/19/08/n14303266/cyber-security-cloud-developed-cyneural-a-new-cyber-attack-detecting-ai-engine-using-deep-learning]]|Detection Deep_Learning|
|2019.08.20|//Clouonaut//|[[EC2 Instance Connect is an insecure default!|https://cloudonaut.io/ec2-instance-connect-is-an-insecure-default/]]|AWS Authentication|
|2019.08.20|SANS|[[JumpStart Guide for SIEM in AWS|https://www.sans.org/reading-room/whitepapers/analyst/jumpstart-guide-siem-aws-39110]]|Analysis Misc.|
|2019.08.20|//Google Cloud//|[[How Google adopted BeyondCorp: Part 2|https://security.googleblog.com/2019/08/how-google-adopted-beyondcorp-part-2.html]] (2/4)|Misc|
|>|>|>|!2019.08.19|
|2019.08.19|Google|[[Google Cloud Console Incident #19008|https://status.cloud.google.com/incident/developers-console/19008]]|Outage Google|
|2019.08.19|Bleeping Computer| → [[Gmail Is Down, Displays "Something Went Wrong" Errors|https://www.bleepingcomputer.com/news/google/gmail-is-down-displays-something-went-wrong-errors/]]|Outage Google|
|2019.08.19|DZone|[[Kubernetes RBAC, Monitoring, Logging, Storage: What You Need to Know for Enterprise Use|https://dzone.com/articles/kubernetes-rbac-monitoring-logging-storage-what-yo]]|Kubernetes|
|2019.08.19|Compare The Cloud|[[Cloud Hosting vs Shared Hosting - The Pros and Cons|https://www.comparethecloud.net/articles/cloud-hosting-vs-shared-hosting-the-pros-and-cons/]]|Hosting|
|2019.08.19|JDSupra|[[Proposed Regulations on Cross-Border Cloud Transactions and other Digital Content Transactions|https://www.jdsupra.com/legalnews/proposed-regulations-on-cross-border-56056/]]|Regulations|
|2019.08.19|Dark Reading|[[Global Cyber Alliance Launches Cybersecurity Development Platform for Internet of Things (IoT) Devices|https://www.darkreading.com/risk/global-cyber-alliance-launches-cybersecurity-development-platform-for-internet-of-things-%28iot%29-devices/d/d-id/1335568]]|IoT|
|2019.08.19|isBuzz news|[[How To Overcome 3 Key Challenges Of Shared Responsibility In The Cloud|https://www.informationsecuritybuzz.com/articles/how-to-overcome-3-key-challenges-of-shared-responsibility-in-the-cloud-2/]]|Shared_Responsibility|
|2019.08.19|//HiveMQ//|[[Top 10 Criteria for Selecting a MQTT Broker|https://www.hivemq.com/blog/top-10-mqtt-broker-criteria/]]|MQTT|
|2019.08.19|//Lacework//|[[5 Limitations of Network-Centric Security in the Cloud|http://www.infosecisland.com/blogview/25216-5-Limitations-of-Network-Centric-Security-in-the-Cloud.html]]|Network_Security|
|2019.08.19|//Kaspersky//|[[IT threat evolution Q2 2019. Statistics|https://securelist.com/it-threat-evolution-q2-2019-statistics/92053/]]|Trends|
|2019.08.19|//JumpCloud//|[[Cloud OpenLDAP|https://jumpcloud.com/blog/cloud-openldap/]]|Authentication LDAP|
|2019.08.19|//Report Ocean//|[[Global Cloud Access Security Brokers Market Development, History, Current Industry Analysis and Estimated Forecast|https://scoopjunction.com/global-cloud-access-security-brokers-market-development-history-current-industry-analysis-and-estimated-forecast/36712/]]|Report CASB|
|2019.08.19|//Rapid7//|[[Automating the Cloud: AWS Security Done Efficiently|https://blog.rapid7.com/2019/08/19/automating-the-cloud-aws-security-done-efficiently/]]|AWS Automation|
|2019.08.19|//Aqua//|[[Trivy Vulnerability Scanner Joins the Aqua Family|https://blog.aquasec.com/trivy-vulnerability-scanner-joins-aqua-family]]|Containers Tools|
|2019.08.19|FedScoop|[[Why government is slow to endorse frameworks for quantifying cybersecurity risk|https://www.fedscoop.com/cybersecurity-risk-management-doe-dot/]]|Risk_Management FAIR|
[>img(100px,auto)[iCSA/CSAdoc.png]]Un appel à commentaires dont la date de clôture est le ''16 septembre 2019'' : "''Software-Defined Perimeter as a DDoS Prevention Mechanism''".
<<<
//The primary goal of this document is to increase the awareness and understanding of SDP as a tool to prevent DDoS attacks by demonstrating its efficiency and effectiveness against several well known attacks, including HTTP Flood, TCP SYN, and UDP Reflection.//
<<<
* Lien → ''[[CloudSecurityAlliance.fr/go/j8jc/|https://cloudsecurityalliance.fr/go/j8jc/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!1 - Les nouveautés CSA de la semaine du 12 au 18 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Egregious 11 Meta-Analysis Part 1: (In)sufficient Due Diligence and Cloud Security Architecture and Strategy''+++*[»]> <<tiddler [[2019.08.13 - Blog : 'Egregious 11 Meta-Analysis Part 1: (In)sufficient Due Diligence and Cloud Security Architecture and Strategy']]>>=== 
* Publication : ''What is personal data under the GDPR?''+++*[»]> <<tiddler [[2019.08.14 - Publication : 'What is personal data under the GDPR?']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.18 - Veille Hebdomadaire]] avec plus de 60 liens :
* Piratages et fuites de données : toujours des commentaires sur l'incident chez ''Capital One''
* Rapports et sondages : ''CloudPassage'', ''Fortinet''
* Divers : recherche de composants mal configurés dans le Cloud, détection de dysfonctionnements, plan de réponse à un incident cloud ou lié à des containers, le programme ''Cloud Smart'' américain
!3 - Agenda
* Une première version du planning du congrès CSA de Berlin est disponible → [[CloudSecurityAlliance.fr/go/jBjE/|https://cloudsecurityalliance.fr/go/jBjE/]]
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.17|
|2019.08.17|Framboise314[>img[iCSF/flag_fr.png]]|[[Un cluster de Raspberry Pi avec Kubernetes|https://www.framboise314.fr/un-cluster-de-raspberry-pi-avec-kubernetes/]]|Kubernetes RaspberryPi|
|2019.08.17|ZDnet|[[Cloud security is too important to leave to cloud providers|https://www.zdnet.com/article/cloud-security-is-too-important-to-leave-to-cloud-providers/]]|CSA|
|>|>|>|!2019.08.16|
|2019.08.16|CBR Online|[[You Can Now Trigger a Kernel Panic on AWS EC2 Instances by API|https://www.cbronline.com/news/aws-kernel-panic-diagnostic-interrupt]]|AWS APIs Issue|
|2019.08.16|Security Boulevard|[[What Unique Cloud Document Indicators Can Reveal About Data Loss Risk|https://securityboulevard.com/2019/08/what-unique-cloud-document-indicators-can-reveal-about-data-loss-risk/]]|Data_Loss|
|2019.08.16|DISA|[[DISA streamlines approach to cloud authorizations|https://disa.mil/NewsandEvents/2019/cloud-authorizations]]|Authorization US|
|2019.08.16|NextGov| → [[It's Official: Defense Department Will Use Other Agencies' Cloud Security Assessments|https://www.nextgov.com/cybersecurity/2019/08/its-official-defense-department-will-use-other-agencies-cloud-security-assessments/159241/]]|Authorization US|
|2019.08.16|//Roger Halbheer//|[[How to leverage "Secure Access Workstations" for the Cloud|https://www.halbheer.ch/security/2019/08/16/how-to-leverage-secure-access-workstations-for-the-cloud/]]|Secure_Access|
|>|>|>|!2019.08.15|
|2019.08.15|CyberDefense Mag|[[What's the Matter with S3?|https://www.cyberdefensemagazine.com/whats-the-matter-with-s3/]]|S3|
|2019.08.15|NextGov|[[Accelerating Cloud Computing in Government Requires New Management Approach|https://www.nextgov.com/ideas/2019/08/accelerating-cloud-computing-government-requires-new-management-approach/159202/]]|Government|
|2019.08.15|Federal News Network|[[DHS letting its components, 'smart' strategy guide its own cloud journey|https://federalnewsnetwork.com/cloud-computing/2019/08/dhs-letting-its-components-smart-strategy-guide-its-own-cloud-journey/]]|CloudSmart|
|2019.08.15|NextGov|[[Cloud Smarter|https://www.nextgov.com/cio-briefing/2019/08/cloud-smarter/159163/]]|CloudSmart|
|2019.08.15|GovLoop|[[DoD's JEDI Cloud: How It Might Impact Your Agency|https://www.govloop.com/dods-jedi-cloud-how-it-might-impact-your-agency/]]|Government JEDI|
|2019.08.15|JD Supra|[[IRS Issues Proposed Regulations Classifying Cloud Transactions and Transfers of Digital Content for U.S. Federal Income Tax Purposes|https://www.jdsupra.com/legalnews/irs-issues-proposed-regulations-19290/]]|Regulations|
|2019.08.15|Dark Reading|[[7 Biggest Cloud Security Blind Spots|https://www.darkreading.com/cloud/7-biggest-cloud-security-blind-spots/d/d-id/1335493]]|Threats|
|2019.08.15|TechRepublic|[[How to SSH into an AWS instance|https://www.techrepublic.com/article/how-to-ssh-into-an-aws-instance/]]|AWS SSH|
|2019.08.15|//Security Intelligence//|[[3 Barriers to Identity and Access Management (IAM) Modernization|https://securityintelligence.com/posts/3-barriers-to-identity-and-access-management-iam-modernization/]]|IDaaS IAM|
|2019.08.15|//Azure//|[[Azure Ultra Disk Storage: Microsoft's service for your most I/O demanding workloads|https://azure.microsoft.com/en-us/blog/azure-ultra-disk-storage-microsoft-s-service-for-your-most-i-o-demanding-workloads/]]|Misc|
|2019.08.15|//Azure//|[[Announcing the general availability of Azure Ultra Disk Storage|https://azure.microsoft.com/en-us/blog/announcing-the-general-availability-of-azure-ultra-disk-storage/]]|Misc|
|2019.08.15|//Rapid7//|[[Responding to Cloud-Based Security Incidents with InsightConnect: AWS Security Hub|https://blog.rapid7.com/2019/08/15/responding-to-cloud-based-security-incidents-with-insightconnect-aws-security-hub/]] (3/3)|Incident_Handling AWS|
|2019.08.15|//Avanan//|[[MetaMorph HTML Obfuscation Phishing Attack|https://www.avanan.com/resources/metamorph-html-obfuscation-phishing-attack]]|Phishing O365|
|>|>|>|!2019.08.14|
|2019.08.14|GBHackers on Security|[[MaaS - Rent an Android Malware "Cerberus" From Underground Forums To Control Any Android Device Remotely|https://gbhackers.com/android-malware-cerberus/]]|MaaS|
|2019.08.14|Security Boulevard|[[The Cloud, Outages and You: Who's Responsible for What?|https://securityboulevard.com/2019/08/the-cloud-outages-and-you-whos-responsible-for-what/]]|Shared_Responsibility|
|2019.08.14|Solutions Review|[[How to Design a Flawless Cloud Security Strategy|https://solutionsreview.com/cloud-platforms/how-to-design-a-flawless-cloud-security-strategy/]]|Strategy|
|2019.08.14|CIO Dive|[[5 cloud dos and don'ts|https://www.ciodive.com/news/5-cloud-dos-and-donts/560878/]]|Strategy|
|2019.08.14|CSO|[[Securing Your Multi-Cloud Strategy|https://www.csoonline.com/article/3432121/securing-your-multi-cloud-strategy.html]]|Multi_Cloud|
|2019.08.14|Forbes|[[Shadow IT: You Can't Protect What You Can't See|https://www.forbes.com/sites/insights-ibmresiliency/2019/08/14/shadow-it-you-cant-protect-what-you-cant-see/]]|Shadow_IT|
|2019.08.14|DZone|[[End-to-End Tests: Managing Containers in Kubernetes|https://dzone.com/articles/end-to-end-tests-managing-containers-in-kubernetes]]|Kubernetes|
|2019.08.14|The Federal Register|[[Classification of Cloud Transactions and Transactions Involving Digital Content|https://www.federalregister.gov/documents/2019/08/14/2019-17425/classification-of-cloud-transactions-and-transactions-involving-digital-content]]|Legal|
|2019.08.14|GovLoop|[[DoD's JEDI Cloud: The Saga So Far|https://www.govloop.com/dods-jedi-cloud-the-saga-so-far/]]|Government JEDI|
|2019.08.14|Dark Reading|[[Microservices Flip App Security on Its Head|https://www.darkreading.com/cloud/microservices-flip-app-security-on-its-head/a/d-id/1335483]]|MicroServices|
|2019.08.14|//Predica.pl//|[[Cloud Governance (pdf)|https://predica.pl/wp-content/uploads/2019/08/Cloud-Governance-min.pdf]]|Governance|
|2019.08.14|//CloudPassage//|[[What the 2019 AWS Security Report Tells Us About Preventing a Cloud Data Breach|https://blog.cloudpassage.com/2019/08/14/2019-aws-security-report/]] ([[rapport|https://pages.cloudpassage.com/AWS-Cloud-Security-Report.html]])|Report AWS CloudPassage|
|2019.08.14|//Alibaba Cloud//|[[Why You Should Use Reverse Proxies on Alibaba Cloud|https://medium.com/@Alibaba_Cloud/why-you-should-use-reverse-proxies-on-alibaba-cloud-11eb6e5c5c42]]|Architecture|
|2019.08.14|//Alibaba Cloud//|[[How to Install and Configure VNC on an Alibaba Cloud ECS Instance|https://medium.com/@Alibaba_Cloud/how-to-install-and-configure-vnc-on-an-alibaba-cloud-ecs-instance-f8bb6cfbe76f]]|Remote_Access|
|2019.08.14|//Fugue//|[[What Executives Should Know About the Capital One Breach|https://www.fugue.co/blog/what-executives-should-know-about-the-capital-one-breach]]|Incident CapitalOne|
|2019.08.14|//PivotPoint Security//|[[Analysis of the Capital One Breach|https://www.pivotpointsecurity.com/blog/analysis-of-the-capital-one-breach/]]|Incident CapitalOne|
|2019.08.14|//VirSec//|[[Capital One Experiences Third Largest Financial Hack from AWS Insider|https://virsec.com/capital-one-experiences-third-largest-financial-hack-from-aws-insider/]]|Incident CapitalOne|
|2019.08.14|//Azure//|[[Geo Zone Redundant Storage in Azure now in preview|https://azure.microsoft.com/en-gb/blog/geo-zone-redundant-storage-in-azure-now-in-preview/]]|Azure Resilience|
|2019.08.15|//Azure//| → [[Geo-redundant storage (GRS): Cross-regional replication for Azure Storage|https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs]]|Azure Resilience|
|2019.08.15|CBR Online| → [[Azure Aims for Resilience in Face of Regional Catastrophe|https://www.cbronline.com/news/azure-redundancy-gzrs]]|Azure Resilience|
|>|>|>|!2019.08.13|
|2019.08.13|NCSC UK|![[Offline backups in an online world|https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world]]|Backups|
|2019.08.13|MSP Alliance|[[The MSP's Survival Guide to Cloud Nationalism|https://members.mspalliance.com/the-msps-survival-guide-to-cloud-nationalism/]] (incription requise)|MSP|
|2019.08.13|TechBeacon|[[Zero-trust in a cloud-native world: Best practices emerge|https://techbeacon.com/security/zero-trust-cloud-native-world-best-practices-emerge]]|Zero_Trust|
|2019.08.13|Federal News Network|[[Air Force cloud had 54 vulnerabilities before hackers found them|https://federalnewsnetwork.com/air-force/2019/08/air-force-cloud-had-54-vulnerabilities-before-hackers-found-them/]]|Bug_Bounty|
|2019.08.13|Defense One| → [[New Tool Reveals Big Vulnerabilities In Mobile Apps That Use Multiple Clouds|https://www.defenseone.com/technology/2019/08/new-tool-reveals-big-vulnerabilities-mobile-apps-use-multiple-clouds/159133/]]|Conference Mobile|
|2019.08.13|//AWS//|[[Amazon Letter to Sen Wyden RE Consumer Data|https://www.wyden.senate.gov/imo/media/doc/081319%20Amazon%20Letter%20to%20Sen%20Wyden%20RE%20Consumer%20Data.pdf]] (pdf)|Incident CapitalOne AWS|
|2019.08.16|Cyberscoop| → [[Amazon Web Services finds no 'significant issues' at other companies allegedly breached by Paige Thompson|https://www.cyberscoop.com/capital-one-aws-companies-wyden-letter/]]|Incident CapitalOne AWS|
|2019.08.13|//Security Intelligence//|[[Bypass the Cost of Ownership With Security-as-a-Service (SECaaS)|https://securityintelligence.com/posts/bypass-the-cost-of-ownership-with-security-as-a-service-secaas/]]|SECaaS|
|2019.08.13|//Rapid7//|[[Cloud Security Primer: The Basics You Need to Know|https://blog.rapid7.com/2019/08/13/cloud-security-primer-the-basics-you-need-to-know/]]|Misc|
|2019.08.13|//Rhino Security Labs//|[[Bypassing IP Based Blocking with AWS API Gateway|https://rhinosecuritylabs.com/aws/bypassing-ip-based-blocking-aws/]]|APIs|
|2019.08.13|//Lacework//|[[Cloud Anomaly Detection and Vulnerability Assessment Needs to Yield Actionable Alerts|https://www.lacework.com/cloud-anomaly-detection-alerts/]]|Detection|
|2019.08.13|//Clearswift//|[[Capital One Data Breach: A reminder to lock your back door|https://www.clearswift.com/blog/2019/08/13/capital-one-data-breach-reminder-lock-your-back-door]]|Incident CapitalOne|
|2019.08.13|//BitDefender//|[[Best Practices for Cloud Workload Protection - Redesigning Cybersecurity for Cloud-First Businesses|https://businessinsights.bitdefender.com/best-practices-for-cloud-workload-protection-redesigning-cybersecurity-for-cloud-first-businesses]]|CWPP Workload Protection|
|2019.08.13|//Cofense//|[[Phishing Campaigns Imitating CEOs Bypass Microsoft Gateway to Target Energy Sector|https://cofense.com/phishing-campaigns-imitating-ceos-bypass-microsoft-gateway-target-energy-sector/]]|Phishing|
|2019.08.13|//Fortinet//|[[The Bi-Directional Cloud Highway: Critical Insights into Today's Cloud Infrastructures|https://www.fortinet.com/blog/industry-trends/ihs-markit-fortinet-cloud-report-insights.html]]|Report Fortinet|
|2019.08.16|Solutions Review| → [[74% of Companies Move Apps To the Cloud, Then Back On-Premise|https://solutionsreview.com/cloud-platforms/74-of-companies-move-apps-to-the-cloud-then-back-on-premise/]]|Report Fortinet|
|>|>|>|!2019.08.12|
|2019.08.12|iNSYNQ|![[Company Update Concerning the Megacortex Ransomware Attack|https://blog.insynq.com/blog/company-update-concerning-the-megacortex-ransomware-attack]]|Attacks Ransomware iNSYNQ|
|2019.08.16|The Daily Swig| → [[Hosted accountancy software firm iNSYNQ offers ransomware post-mortem|https://portswigger.net/daily-swig/hosted-accountancy-software-firm-insynq-offers-ransomware-post-mortem]]|Attacks Ransomware iNSYNQ|
|2019.08.12|Alliancy[>img[iCSF/flag_fr.png]]|[[Le cloud fait sauter les verrous du partage de données|https://www.alliancy.fr/expertise/cloud/2019/08/12/le-cloud-fait-sauter-les-verrous-du-partage-de-donnees]]|Data_Sharing|
|2019.08.12|Breaking Defense|[[Big Data For Big Wars: JEDI vs. China & Russia|https://breakingdefense.com/2019/08/big-data-for-big-wars-jedi-vs-china-russia/]]|Government JEDI|
|2019.08.12|Silicon|[[Understanding hybrid cloud security across your enterprise|https://www.silicon.co.uk/cloud/understanding-hybrid-cloud-security-277901]]|Hybrid_Cloud|
|2019.08.12|CS Hub|[[Moving To The Cloud: Considerations Beyond The Bottom Line|https://www.cshub.com/cloud/articles/moving-to-the-cloud-considerations-beyond-the-bottom-line]]|Migration|
|2019.08.12|Hackernoon|![[Severe Truth About Serverless Security and Ways to Mitigate Major Risks|https://hackernoon.com/severe-truth-about-serverless-security-and-ways-to-mitigate-major-risks-cd3i3x6f]]|FaaS Serverless Risks|
|2019.08.12|Georgia Tech|[[Smartphone Apps May Connect to Vulnerable Backend Cloud Servers|https://www.news.gatech.edu/2019/08/12/smartphone-apps-may-connect-vulnerable-backend-cloud-servers]]|Conference Mobile|
|2019.08.13|USENIX Security Symposium| → The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based Mobile Backends ([[Présentation|https://www.usenix.org/sites/default/files/conference/protected-files/sec19_slides_alrawi.pdf]], [[rapport|https://admin.govexec.com/media/sec19-alrawi_0.pdf]])|Conference Mobile|
|2019.08.19|Diginomica| → [[Cloud-based app backends - a rat's nest of mobile phone security vulnerabilities|https://diginomica.com/cloud-based-app-backends-rats-nest-mobile-phone-security-vulnerabilities]]|Conference Mobile|
|2019.08.12|//PaloAlto Networks//|![[Hunting the Public Cloud for Exposed Hosts and Misconfigurations|https://unit42.paloaltonetworks.com/hunting-the-public-cloud-for-exposed-hosts-and-misconfigurations/]]|Report PaloAlto Misconfigurations|
|2019.08.15|The Register| → [[Fancy a career exposing cloud data leaks? Great news, companies are still largely clueless|https://www.theregister.co.uk/2019/08/16/cloud_security_sucks/]]|Report PaloAlto Misconfigurations|
|2019.08.12|//Lacework//|[[Developing a Cloud & Container Incident Response Plan|https://www.lacework.com/cloud-container-incident-response-plan/]]|Container Incident_Response|
|2019.08.12|//Lacework//|[[A Quick Guide to Container Orchestration Vulnerabilities|https://www.lacework.com/guide-container-orchestration-vulnerabilities/]]|Container Vulnerabilities|
|2019.08.12|//Chef//|[[Cloud Security Assessments in AWS|https://blog.chef.io/2019/08/12/cloud-security-assessments-in-aws/]]|AWS Assessment|
!"//What is personal data under the GDPR?//"[>img(100px,auto)[iCSA/CSAdoc.png]]
<<<
//A fundamental concept of the European General Data Protection Regulation (GDPR), which came into force May last year, is personal data.//
<<<
&rArr; https://gdpr.cloudsecurityalliance.org/resource-center/what-is-personal-data-under-the-gdpr
&rArr; http://www.csa-gdpr-build.s3-website-us-east-1.amazonaws.com/artifact/What-is-personal-data-under-the-GDPR.pdf 
!"//Egregious 11 Meta-Analysis Part 1: (In)sufficient Due Diligence and Cloud Security Architecture and Strategy//"
[>img(200px,auto)[iCSA/J8DBE.jpg]]Premier article d'une série, publié le 13 août 2019 — Rédigé par Victor Chin, Research Analyst, CSA
<<<
On August 6th, 2019, the CSA Top Threats working group released the third iteration of the Top Threats to Cloud Computing report.

This time the report highlights eleven egregious security issues based on the survey of 241 industry experts. The following security issues from the previous iteration ("The Treacherous Twelve") appeared again in the latest report.
* Data Breaches
* Account Hijacking
* Insider Threats
* Insecure Interfaces and APIs
* Abuse and Nefarious Use of Cloud Services

At the same time, five new security issues below made their debuts.
* Misconfiguration and Insufficient Change Control
* Lack of Cloud Security Architecture and Strategy
* Weak Control Plane
* Metastructure and Applistructure Failures
* Limited Cloud Usage Visibility made their debuts.
[...]
Before we go into the meta-analysis of The Egregious Eleven, it is important to note that the Top Threats to Cloud Computing reports focus on identifying prominent security issues in the industry based on perception. It is not meant to be the definitive list of security issues in the cloud - instead, the study measures what industry experts perceive the key security issues to be.

__The Overarching Trends__
Throughout the three iterations of the report, one particular trend has been increasingly more prominent. Traditional cloud security issues stemming from concerns about having a third-party provider are being perceived as less relevant. Some examples of such issues are Data Loss, Denial of Service, and Insufficient Due Diligence. While more nuanced issues pertaining specifically to cloud environments are increasingly being perceived as more problematic. These include Lack of Cloud Security Architecture and Strategy, Weak Control Plane and Metastructure and Applistructure Failures.

__Most and Least Relevant Security Issues__
Over the next few weeks, we will examine and try to account for the trend mentioned earlier. Each blog post will feature a security issue that is being perceived as less relevant and one that is being perceived as more relevant. In the first post, we will take a closer look at Insufficient Due Diligence and Lack of Cloud Security Architecture and Strategy.

__(In)sufficient Due Diligence__
Insufficient Due Diligence was rated 8th and 9th in the first and second iteration of the Top Threats to Cloud Computing report, respectively. In the current report, it has completely dropped off. Insufficient Due Diligence refers to prospective cloud customers conducting cloud service provider (CSP) evaluations to ensure that the CSPs meets the various business and regulatory requirements. Such concerns were especially pertinent during the early years of cloud computing, where there were not many resources available to help cloud customers make that evaluation.

__Frameworks to Improve Cloud Procurement__
Since then, many frameworks and projects have been developed to make cloud procurement a smooth journey. The Cloud Security Alliance (CSA), for example, has several tools to help enterprises on their journey of cloud procurement and migration.
* The Consensus Assessment Initiative Questionnaire ([[CAIQ]]) is a set of questions tailored to helped cloud customers evaluate the security posture of prospective cloud providers. It is based on CSA's Cloud Controls Matrix (CCM), which is a cloud security controls framework.
* The CAIQ and CCM are further supported by the Security, Trust and Assurance Registry ([[STAR]]) program, which is a multi-level assurance framework. The STAR program makes CSP information such as completed CAIQs (Level 1) and third-party audit certifications (Level 2) publicly accessible.

Around the world, we see many similar frameworks and guidances being developed. For example:
* The Federal Risk and Authorization Management Program (FedRAMP) in the US
* Multi-Tier Cloud Security (MTCS) Certification Scheme in Singapore
* The European Security Certification Framework (EU-SEC) in the European Union.

With so many governance, risk and compliance support programs being developed globally, it is understandable that Insufficient Due Diligence has fallen off the Top Threats to Cloud Computing list.

__Examining Lack of Cloud Security Architecture and Strategy__
Lack of Cloud Security Architecture and Strategy was rated third in The Egregious Elven. Large organizations migrating their information technology stack to the cloud without considering the nuances of IT operations in the cloud environment are creating a significant amount of business risk for themselves. Such organizations fail to plan for the shortcomings that they will experience operating their IT stack in the cloud. Moving workloads to the cloud will result in organizations having less visibility and control over their data and the underlying cloud infrastructure. Coupled with the self-provisioning and on-demand nature of cloud resources, it becomes very easy to scale up cloud resources - sometimes, in an insecure manner. For example, in 2019, Accenture left at least 4 cloud storage buckets unsecured and publicly downloadable. In highly complex and scalable cloud environments without proper cloud security architecture and processes, such misconfigurations can occur easily. For cloud migration and operations to go smoothly, such shortcomings must be accounted for. Organizations can engage a Cloud Security Access Broker (CASB) or use cloud-aware technology to provide some visibility into the cloud infrastructure. Being able to monitor your cloud environment for misconfigurations or exposures will be extremely critical when operating in the cloud.

On a different note, the fact that a Lack of Cloud Security Architecture and Strategy is high up in the Top Threats to Cloud Computing is evidence that organizations are actively migrating to the cloud. These nuanced cloud security issues only crop up post-migration and will be the next tranche of problems for which solutions must be found.
[...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/13/egregious-11-meta-analysis-part-1-insufficient-due-diligence-and-cloud-security-architecture-and-strategy/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 5 au 11 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Enjeux et bonnes pratiques dans la sécurisation des conteneneurs et des micro-services''+++*[»]> <<tiddler [[2019.08.08 - Blog : Enjeux et bonnes pratiques dans la sécurisation des conteneneurs et des micro-services]]>>=== 
* Blog : ''A la découverte des principales menaces du Cloud avec Jim Reavis''+++*[»]> <<tiddler [[2019.08.08 - Blog : A la découverte des principales menaces du Cloud avec Jim Reavis]]>>=== 
* Publication : ''Les 6 fondements du DevSecOps''+++*[»]> <<tiddler [[2019.08.07 - Publication : 'Six Pillars of DevSecOps']]>>=== 
* Blog : ''Cloud et cyber-harcèlement''+++*[»]> <<tiddler [[2019.08.07 - Blog : Cloud et cyber-harcèlement]]>>=== 
* Publication : ''Les 11 menaces les plus sérieuses affectant le Cloud''+++*[»]> <<tiddler [[2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']]>>=== 
* Blog : ''Projet Libra de Facebook''+++*[»]> <<tiddler [[2019.08.05 - Blog : Projet Libra de Facebook]]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.11 - Veille Hebdomadaire]] avec plus de 90 liens :
* Piratages et fuites de données : des précisions et des commentaires suite aux attaques contre ''Capital One'' et ''iNSYNQ'', risques de fuites dans AWS EBS
* Rapports et sondages : ''FileCloud'', ''Kubernetes'' (rapport d'audit), ''Vectra'', ''Wipro''
* Attaques : phishing
* Divers : les présentations données lors de la conférence ''BlackHat'', ''Azure Security Lab'', le jeu Cloud de l'été de ''Nuageo''
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.11|
|2019.08.11|DEF CON 27|[[I'm In Your Cloud... Pwning Your Azure Environement|https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Mollema]]|AWS AzureAD Exploit|
|2019.08.11|DEF CON 27|[[Owning The Cloud Through Server-Side Request Forgery|https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Sadeghipour]]|Exploit SSRF|
|2019.08.11|//CyStack//|[[Subdomain takeover - Chapter two: Azure Services|https://blog.cystack.net/subdomain-takeover-chapter-two-azure-services/]]|DNS AWS|
|>|>|>|!2019.08.10|
|2019.08.10|Defense One|[[Pentagon Officials Explain Why the Controversial JEDI Cloud Is Crucial for Future Ops|https://www.defenseone.com/technology/2019/08/pentagon-reveals-why-controversial-jedi-cloud-crucial-future-ops/159088/]]|Government JEDI|
|>|>|>|!2019.08.09|
|2019.08.09|Bleeping Computer|[[Microsoft 365 to Get Enhanced Suspicious Content Submission|https://www.bleepingcomputer.com/news/security/microsoft-365-to-get-enhanced-suspicious-content-submission/]]|O365|
|2019.08.09|Bleeping Computer|[[Microsoft Office Phishers Move to Enterprise AWS Landing Pages|https://www.bleepingcomputer.com/news/security/microsoft-office-phishers-move-to-enterprise-aws-landing-pages/]]|AWS Phishing|
|2019.08.09|Krebs On Security|![[iNSYNQ Ransom Attack Began With Phishing Email|https://krebsonsecurity.com/2019/08/insynq-ransom-attack-began-with-phishing-email/]]|Attacks Ransomware iNSYNQ|
|2019.08.09|CRN| → [[iNSYNQ Ransomware Attack Started With Phishing Email: Report|https://www.crn.com/news/cloud/insynq-ransomware-attack-started-with-phishing-email-report]]|Attacks Ransomware iNSYNQ|
|2019.08.09|CBR Online|[[Default Access for 'Everyone'? New AWS Data Lake Service's Settings Raise Red Flags for Security Experts|https://www.cbronline.com/news/default-access-for-everyone-new-aws-lake-formation-service-configurations-raise-eyebrows]]|AWS|
|2019.08.09|ZDnet|[[Microsoft is phasing out the Basic edition of Azure Active Directory|https://www.zdnet.com/article/microsoft-is-phasing-out-the-basic-edition-of-azure-active-directory/]]|AzureAD EndOfLife|
|2019.08.09|UKAuthority|[[Scotland gets cloud procurement framework|https://www.ukauthority.com/articles/scotland-gets-cloud-procurement-framework/]]|Government Scotland|
|2019.08.09|DEF CON 27|[[More Keys Than A Piano: Finding Secrets In Publicly Exposed Ebs Volumes|https://www.defcon.org/html/defcon-27/dc-27-speakers.html#Morris]]|AWS Data_Leak|
|2019.08.09|TechCrunch| → [[Hundreds of exposed Amazon cloud backups found leaking sensitive data|https://techcrunch.com/2019/08/09/aws-ebs-cloud-backups-leak/]]|AWS Data_Leak|
|2019.08.09|//SecurityIntelligence//|[[How Implementing Cloud Identity Can Improve Security and Data Privacy|https://securityintelligence.com/articles/how-implementing-cloud-identity-can-improve-security-and-data-privacy/]]|IAM|
|2019.08.09|//Rackspace//|[[A Fresh Look for Rackspace's Open Cloud Academy|https://blog.rackspace.com/fresh-look-rackspaces-open-cloud-academy-technical-training]]|Education Training|
|2019.08.09|//CyberDB//|[[Serverless Security: Best Practices to Secure your Serverless Infrastructure|https://www.cyberdb.co/serverless-security-best-practices/]]|Serverless Best_Practices|
|2019.08.09|//Microsoft Azure//|![[Overview of the CIS Microsoft Azure Foundations Benchmark blueprint sample|https://docs.microsoft.com/en-us/azure/governance/blueprints/samples/cis-azure-1.1.0/]]|Azure Benchmark|
|>|>|>|!2019.08.08|
|2019.08.08|AccountingToday|![[Inside the Insynq attack: 'We had to assume they were listening'|https://www.accountingtoday.com/news/inside-the-insynq-ransomware-attack-we-had-to-assume-they-were-listening]]|Attacks Ransomware iNSYNQ|
|2019.08.08|SecurityWeek|[[Vulnerability in Kubernetes Allows Access to Custom Resources|https://www.securityweek.com/vulnerability-kubernetes-allows-access-custom-resources]]|CVE-2019-11247 Kubernetes|
|2019.08.08|Container Journal| → [[CRD Vulnerability Cause for Kubernetes Concern|https://containerjournal.com/2019/08/09/crd-vulnerability-cause-for-kubernetes-concern/]]|CVE-2019-11247 Kubernetes|
|2019.08.08|NextGov|[[GSA Cyber Expert Offers Tips on Cloud Security|https://www.nextgov.com/cybersecurity/2019/08/gsa-cyber-expert-offers-tips-cloud-security/159046/]]|Best_Practices|
|2019.08.08|Brink|[[The Threat from the Cloud: How Cyber Intruders Exploit Third Parties|https://www.brinknews.com/the-threat-from-the-cloud-how-cyber-intruders-exploit-third-parties/]]|Third_Party|
|2019.08.08|Information Security Newspaper|[[Simple reasons why the Microsoft Azure cloud isn't secure|https://www.securitynewspaper.com/2019/08/08/simple-reasons-why-the-microsoft-azure-cloud-isnt-secure/]]|Azure RDP|
|2019.08.08|BlackHat|[[Securing Apps in the Open-By-Default Cloud|https://www.blackhat.com/us-19/briefings/schedule/#securing-apps-in-the-open-by-default-cloud-16428]] ([[slides|us-19-Howes-Securing-Apps-In-The-Open-By-Default-Cloud.pdf]])|Best_Practices BlackHat|
|2019.08.08|BlackHat|[[A Compendium of Container Escapes|https://www.blackhat.com/us-19/briefings/schedule/#preventing-authentication-bypass-a-tale-of-two-researchers-17041]] ([[slides|http://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes.pdf]])|Containers BlackHat|
|2019.08.08|BlackHat|[[DevSecOps : What, Why and How|https://www.blackhat.com/us-19/briefings/schedule/#devsecops--what-why-and-how-17058]] ([[slides|http://i.blackhat.com/USA-19/Thursday/us-19-Shrivastava-DevSecOps-What-Why-And-How.pdf]])|DevSecOps BlackHat|
|2019.08.08|//Nuageo//[>img[iCSF/flag_fr.png]]|[[On the road to the Cloud - Le jeu de l'été Nuageo|https://www.nuageo.fr/2019/08/le-jeu-de-lete-nuageo-2019/]]|Fun|
|2019.08.08|//FileCloud//|[[FileCloud Releases Inaugural Annual Enterprise Cloud & Data Security Report|https://vmblog.com/archive/2019/08/08/filecloud-releases-inaugural-annual-enterprise-cloud-data-security-report.aspx]] ([[rapport|https://www.getfilecloud.com/annual-enterprise-cloud-data-security-report/]])|Report FileCloud|
|2019.08.08|BetaNews| → [[Half of companies won't move mission critical workloads to the cloud|https://betanews.com/2019/08/08/mission-critical-workloads-not-cloud/]]|Report FileCloud|
|2019.08.08|//Google Cloud//|[[Awarding Google Cloud Vulnerability Research|https://security.googleblog.com/2019/08/awarding-google-cloud-vulnerability.html]]|Vulnerability_Reward|
|2019.08.08|//PaloAlto Networks//|[[From 'DevOps vs. SecOps' to DevSecOps|https://blog.paloaltonetworks.com/2019/08/devops-vs-secops-devsecops/]]|DevSecOps|
|2019.08.08|//Symantec//|[[How to Protect Yourself in the Cloud: Tips and Best Practices|https://www.symantec.com/blogs/expert-perspectives/how-protect-yourself-cloud-tips-and-best-practices]]|Report Kubernetes AuditBest_Practices|
|2019.08.08|//Proofpoint//|[[Phishing Actor Using XOR Obfuscation Graduates to Enterprise Cloud Storage on AWS|https://www.proofpoint.com/us/threat-insight/post/phishing-actor-using-xor-obfuscation-graduates-enterprise-cloud-storage-aws]]|Phishing AWS Azure|
|2019.08.08|BetaNews| → [[Russian phishing campaign using AWS to host landing pages designed to avoid detection|https://www.techrepublic.com/article/russian-phishing-campaign-using-aws-to-host-landing-pages-designed-to-avoid-detection/]]|Phishing AWS Azure|
|2019.08.08|TechRepublic| → [[Russian phishing campaign using AWS to host landing pages designed to avoid detection|https://www.techrepublic.com/article/russian-phishing-campaign-using-aws-to-host-landing-pages-designed-to-avoid-detection/]]|Phishing AWS Azure|
|2019.08.08|//ThreatPost//| → [[Phishing Attacks Enlist Amazon AWS, Microsoft Azure in Ploys|https://threatpost.com/phishing-amazon-aws-s3-cloud-buckets/147111/]]|Phishing AWS Azure|
|2019.08.08|//Tripwire//|[[Best Practices for IT Security Teams in the Age of Cloud|https://www.tripwire.com/state-of-security/security-data-protection/cloud/best-practices-security-teams-cloud/]]|Best_Practices|
|2019.08.08|//Managed Methods//|[[Top Data Loss Prevention Methods For Cloud Applications|https://managedmethods.com/blog/data-loss-prevention-methods-for-cloud-apps/]]|DLP|
|2019.08.08|//G2//|[[Securely Migrating to the Cloud|https://learn.g2.com/cloud-migration]]|Migration|
|2019.08.08|//Sensu//|[[How Kubernetes works|https://blog.sensu.io/how-kubernetes-works]]|Kubernetes|
|2019.08.08|//CyberArk//|[[Kubernetes Pentest Methodology Part 1|https://www.cyberark.com/threat-research-blog/kubernetes-pentest-methodology-part-1/]] (1/3)|Kubernetes PenTest|
|2019.08.08|//WeScale//[>img[iCSF/flag_fr.png]]|[[Observabilité, résilience et expérience au secours des systèmes chaotiques|https://blog.wescale.fr/2019/08/08/observabilite-resilience-et-experience-au-secours-des-systemes-chaotiques/]]|Chaos_Engineering|
|2019.08.08|//Cloudonaut//|[[Review: AWS Backup - A centralized place for managing backups?|https://cloudonaut.io/review-aws-backup/]]|AWS Backups|
|>|>|>|!2019.08.07|
|2019.08.07|!CSA|[[CSA Releases "The Six Pillars of DevSecOps" Report|https://cloudsecurityalliance.org/articles/csa-releases-the-six-pillars-of-devsecops-report/]]|CSA DevSecOps|
|2019.08.07|CBR Online| → [[DevSecOps: The Six Pillars of Secure Code Deployment|https://www.cbronline.com/list/devsecops-guide-six-pillars]]|CSA DevSecOps|
|2019.08.07|BlackHat|![[Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)|https://www.blackhat.com/us-19/briefings/schedule/#attacking-and-defending-the-microsoft-cloud-office---azure-ad-14553]] (slides [[ici|https://adsecurity.org/?p=4179]] et [[là|http://i.blackhat.com/USA-19/Wednesday/us-19-Metcalf-Attacking-And-Defending-The-Microsoft-Cloud.pdf]])|Azure Attacks BlackHat|
|2019.08.07|BlackHat|[[Internet-Scale Analysis of AWS Cognito Security|https://www.blackhat.com/us-19/briefings/schedule/#internet-scale-analysis-of-aws-cognito-security-15829]]|AWS BlackHat|
|2019.08.07|BlackHat|[[Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine|https://www.blackhat.com/us-19/briefings/schedule/#exploiting-the-hyper-v-ide-emulator-to-escape-the-virtual-machine-15862]]|Azure Hyper-V BlackHat|
|2019.08.07|BlackHat|[[The Path Less Traveled: Abusing Kubernetes Defaults|https://www.blackhat.com/us-19/briefings/schedule/#the-path-less-traveled-abusing-kubernetes-defaults-17049]]|Kubernetes BlackHat|
|2019.08.07|BlackHat|[[Controlled Chaos: The Inevitable Marriage of DevOps & Security|https://www.blackhat.com/us-19/briefings/schedule/#controlled-chaos-the-inevitable-marriage-of-devops--security-15273]] ([[slides|http://i.blackhat.com/USA-19/Wednesday/us-19-Shortridge-Controlled-Chaos-The-Inevitable-Marriage-Of-DevOps-And-Security.pdf]])|DevSecOps Chaos_Engineering BlackHat|
|2019.08.07|ComputerWeekly|[[The $10bn question: Why is the US government's JEDI cloud contract taking so long to award?|https://www.computerweekly.com/news/252468011/The-10bn-question-Why-is-the-US-governments-decade-long-cloud-contract-taking-so-long-to-award]]|Government JEDI|
|2019.08.07|TechRepublic|[[How the Air Force used a bug bounty program to hack its own cloud server|https://www.techrepublic.com/article/how-the-air-force-used-a-bug-bounty-program-to-hack-its-own-cloud-server/]]|Bug_Bounty|
|2019.08.07|GovLoop|[[There Are No Such Things as 'Average' Cloud Users|https://www.govloop.com/theres-no-such-thing-as-average-cloud-users/]]|Misc|
|2019.08.07|//Vectra//|![[Vectra research reveals that the most significant ransomware threat is the malicious encryption of shared network files in cloud service providers|https://www.vectra.ai/news/spotlight-ransomware]] ([[rapport|http://www.vectra.ai/spotlight-ransomware]] et [[infographie|http://www.vectra.ai/spotlight-ransomware]])|Report Vectra|
|2019.08.07|BetaNews| → [[Biggest ransomware threat is encryption of shared cloud files|https://betanews.com/2019/08/07/biggest-ransomware-threat-is-encryption-of-shared-cloud-files/]]|Report Vectra|
|2019.08.07|Dark Reading| → [[Enterprises Must Be Wary of Ransomware Targeting Network File Shares & Cloud Assets|https://www.darkreading.com/attacks-breaches/enterprises-must-be-wary-of-ransomware-targeting-network-file-shares-andcloud-assets/d/d-id/1335466]]|Report Vectra|
|2019.08.07|ComputerWeekly| → [[Shared files in the cloud are a top ransomware target|https://www.computerweekly.com/news/252468021/Shared-files-in-the-cloud-are-a-top-ransomware-target]]|Report Vectra|
|2019.08.07|//Akamai//|[[Top 10 Best Practices for Securing Cloud Workflows|https://blogs.akamai.com/2019/08/top-10-best-practices-for-securing-cloud-workflows.html]]|Best_Practices|
|2019.08.07|//Azure//|[[Better security with enhanced access control experience in Azure Files|https://azure.microsoft.com/en-us/blog/better-security-with-enhanced-access-control-experience-in-azure-files/]]|Azure Access_Controls|
|2019.08.07|//Azure//|[[Disaster recovery of Azure disk encryption (V2) enabled virtual machines|https://azure.microsoft.com/en-us/blog/disaster-recovery-of-azure-disk-encryption-v2-enabled-virtual-machines/]]|Azure Encryption|
|2019.08.07|//Google Cloud//|[[How secure are your APIs? Apigee API security reporting can help|https://cloud.google.com/blog/products/apigee/how-secure-are-your-apis-apigee-api-security-reporting-can-help]]|API|
|2019.08.07|//Google Cloud//|[[Cloud IAP enables context-aware access to VMs via SSH and RDP without bastion hosts|https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts]]|Access_Controls|
|2019.08.07|Bleeping Computer| → [[Google's Cloud IAP Now Generally Available for Cloud VM Clients|https://www.bleepingcomputer.com/news/security/googles-cloud-iap-now-generally-available-for-cloud-vm-clients/]]|Access_Controls|
|2019.08.07|//AssuranceSoftware//|[[Don't Underestimate the Need for Tight Cloud Security|https://www.assurancesoftware.com/product-blog/dont-underestimate-the-need-for-tight-cloud-security]]|Best_Practices|
|2019.08.07|//Lacework//|[[Enhancing Native Kubernetes Security|https://www.lacework.com/enhancing-native-kubernetes-security/]]|Kubernetes Risks Protection|
|2019.08.07|//Azure//|![[A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response|https://www.microsoft.com/security/blog/2019/08/07/a-case-study-in-industry-collaboration-poisoned-rdp-vulnerability-disclosure-and-response/]]|Azure Hyper-V CVE-2019-0887|
|2019.08.07|//Threatpost//| → [[Black Hat 2019: Microsoft Protocol Flaw Leaves Azure Users Open to Attack|https://threatpost.com/black-hat-2019-microsoft-protocol-flaw-leaves-azure-users-open-to-attack/147045/]]|Azure Hyper-V CVE-2019-0887|
|2019.08.07|//Checkpoint & Microsoft//|! → [["He Said, She Said - Poisoned RDP Offense and Defense"|https://www.blackhat.com/us-19/briefings/schedule/#he-said-she-said--poisoned-rdp-offense-and-defense-15602]] ([[présentation|http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense.pdf]] et [[rapport|http://i.blackhat.com/USA-19/Wednesday/us-19-Baril-He-Said-She-Said-Poisoned-RDP-Offense-And-Defense-wp.pdf]])|Azure Hyper-V CVE-2019-0887 BlackHat|
|2019.08.07|//Spanning//|[[Forming a Backup Strategy: 4 Steps to Follow|https://spanning.com/blog/backup-strategy-4-steps-to-follow/]]|Backups|
|2019.08.07|//Active Directory Security//|[[Slides Posted for Black Hat USA 2019 Talk: Attacking & Defending the Microsoft Cloud|https://adsecurity.org/?p=4179]] ([[présentation .pdf|https://adsecurity.org/wp-content/uploads/2019/08/2019-BlackHat-US-Metcalf-Morowczynski-AttackingAndDefendingTheMicrosoftCloud.pdf]])|
|>|>|>|!2019.08.06|
|2019.08.06|!CSA|[[CSA Releases New Research - Top Threats to Cloud Computing: Egregious Eleven|https://cloudsecurityalliance.org/articles/csa-releases-new-research-top-threats-to-cloud-computing-egregious-eleven/]]|CSA Threats|
|2019.08.06|SecurityWeek| → [[Cloud Providers Improving Security, But Users Need to Up Their Game|https://www.securityweek.com/cloud-providers-improving-security-users-need-their-game]]|CSA Threats|
|2019.08.06|TechRepublic| → [[How to prevent the top 11 threats in cloud computing|https://www.techrepublic.com/article/how-to-prevent-the-top-11-threats-in-cloud-computing/]]|CSA Threats|
|2019.08.06|The Register| → [[Cloud computing's no PICNIC*: Yep, biggest security risks down to customer, not provider|https://www.theregister.co.uk/2019/08/06/the_biggest_security_risks_in_cloud_computing_are_in_the_enterprise_not_in_the_cloud/]]|CSA Threats|
|2019.08.06|Cloud Native Computing Foundation|![[Open Sourcing the Kubernetes Security Audit|https://www.cncf.io/blog/2019/08/06/open-sourcing-the-kubernetes-security-audit/]] ([[Rapport|https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf]] et 2 [[livres|https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/AtredisPartners_Attacking_Kubernetes-v1.0.pdf]] [[blancs|https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20White%20Paper.pdf]])|Report Kubernetes Audit|
|2019.08.06|Kubernetes|! → [[Kubernetes 3rd Party Security Audit Findings #81146|https://github.com/kubernetes/kubernetes/issues/81146]]|Report Kubernetes Audit|
|2019.08.06|Kubernetes|! → [[Security audit WG disclosure process #3982|https://github.com/kubernetes/community/issues/3982]]|Report Kubernetes Audit|
|2019.08.06|SiliconAngle| → [[Security audit reveals 34 vulnerabilities in Kubernetes code|https://siliconangle.com/2019/08/06/34-vulnerabilities-uncovered-security-audit-kubernetes-code/]]|Kubernetes Audit|
|2019.08.06|//PaloAlto Networks//| → [[Kubernetes Penetration Test Report: Insights and Twistlock Response|https://blog.paloaltonetworks.com/2019/08/kubernetes-penetration-test/]]|Kubernetes Audit|
|2019.08.07|Container Journal| → [[CNCF Completes Kubernetes Cybersecurity Audit|https://containerjournal.com/2019/08/07/cncf-completes-kubernetes-cybersecurity-audit/]]|Kubernetes Audit|
|2019.08.07|SDX Central| → [[Kubernetes Looks Inside and Finds Security Holes|https://www.sdxcentral.com/articles/news/kubernetes-looks-inside-and-finds-security-holes/2019/08/]]|Kubernetes Audit|
|2019.08.08|//Snyk//|[[Kubernetes open sourced their security audit. What can we learn?|https://snyk.io/blog/kubernetes-open-sourced-their-security-audit-what-can-we-learn/]]|Kubernetes Audit|
|2019.08.06|(ISC)2|[[Why Certified Cloud Security Professionals are in Higher Demand Than Ever|https://blog.isc2.org/isc2_blog/2019/08/why-certified-cloud-security-professionals-are-in-higher-demand-than-ever.html]]|Education Certification|
|2019.08.06|TechBeacon|[[The state of container security: Tools, policy trail the technology|https://techbeacon.com/security/state-container-security-tools-policy-trail-technology]]|Containers|
|2019.08.06|DZone|[[A Glance at Cloud Monitoring: Strategy, Types and Benefits|https://dzone.com/articles/a-glance-at-cloud-monitoring-strategy-types-and-be]]|Monitoring|
|2019.08.06|//Pure Storage//[>img[iCSF/flag_fr.png]]|[[Flash-to-Flash-to-Cloud : le nouveau modèle de protection des données|https://cyberexperts.tech/flash-to-flash-to-cloud-le-nouveau-modele-de-protection-des-donnees/]]|Protection|
|2019.08.06|//Wipro//|[[Wipro's Third Annual State of Cybersecurity Report Finds Organizations Focusing on IoT and Cloud While Developing Cyber Defense Systems|https://www.businesswire.com/news/home/20190806005558/en/Wipro%E2%80%99s-Annual-State-Cybersecurity-Report-Finds-Organizations]] ([[rapport|https://www.wipro.com/applications/form/the-state-of-cybersecurity-report-2019/]])|Report Wipro|
|2019.08.06|//Qualys//|[[Embracing the cloud and meeting its security demands|https://www.helpnetsecurity.com/2019/08/06/embracing-the-cloud/]]|Misc|
|2019.08.06|//CCSI//|[[BYOD, the Cloud, and CASB, the best combination since PB&J|https://www.ccsinet.com/blog/byod-casb-combination/]]|CASB|
|2019.08.06|//Alibaba Cloud//|[[Best Practices of Log Analysis and Monitoring by Using Kubernetes Ingress|https://medium.com/@Alibaba_Cloud/best-practices-of-log-analysis-and-monitoring-by-using-kubernetes-ingress-2650b9181bff]]|Kubernetes Logging|
|2019.08.06|//Alcide//|[[Secret-Hunting in Kubernetes|https://blog.alcide.io/secret-hunting-in-kubernetes]]|Kubernetes|
|>|>|>|!2019.08.05|
|2019.08.05|Les Echos[>img[iCSF/flag_fr.png]]|[[Le cloud du ministère de l'Intérieur, un accélérateur de la transformation numérique|https://www.lesechos.fr/thema/transformation-services-publics/le-cloud-du-ministere-de-linterieur-un-accelerateur-de-la-transformation-numerique-1122281]]|Misc|
|2019.08.05|//Microsoft//|![[Azure Security Lab: a new space for Azure research and collaboration|https://msrc-blog.microsoft.com/2019/08/05/azure-security-lab-a-new-space-for-azure-research-and-collaboration/]]|Azure Bug_Bounty|
|2019.08.05|Bleeping Computer| → [[Microsoft Invites Researchers to Hack Their Azure Security Lab|https://www.bleepingcomputer.com/news/security/microsoft-invites-researchers-to-hack-their-azure-security-lab/]]|Azure Bug_Bounty|
|2019.08.05|Dark Reading| → [[Microsoft Opens Azure Security Lab, Raises Top Azure Bounty to $40K|https://www.darkreading.com/cloud/microsoft-opens-azure-security-lab-raises-top-azure-bounty-to-%2440k/d/d-id/1335441]]|Azure Bug_Bounty|
|2019.08.05|//Akamai//|[[Top 10 Practices for Securing Cloud Workloads|https://blogs.akamai.com/2019/08/top-10-practices-for-securing-cloud-workloads.html]]|Workloads|
|2019.08.05|//Duo Security//|[[5 Best Practices to Secure Microsoft O365 Accounts|https://duo.com/blog/5-best-practices-to-secure-microsoft-o365-accounts]]Best_Practices O365|
|2019.08.05|//Alibaba Cloud//|[[New Thoughts on Cloud Native: Why Are Containers Everywhere?|https://medium.com/@Alibaba_Cloud/new-thoughts-on-cloud-native-why-are-containers-everywhere-ada1b7264b64]]|Containers|
|2019.08.05|//eXemplify//|[[Seven Steps to Secure Cloud Migration|http://www.exemplifygroup.com/seven-steps-to-secure-cloud-migration/]]|Migration|
|2019.10.21|//Microsoft//|[[Set up disaster recovery for Azure VMs|https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replication]]|Azure DRP|
|>|>|>|!Incident CapitalOne (2019.07.29)|
|2019.08.05|//Rhino Security Labs//|! → [[The Capital One Breach & "cloud_breach_s3" CloudGoat Scenario|https://rhinosecuritylabs.com/aws/capital-one-cloud_breach_s3-cloudgoat/]]|DataBreach Capital_One|
|2019.08.05|Business Insider| → [[Security researchers warned for years about the cloud-security flaw used in the massive Capital One hack, but Amazon apparently leaves it up to customers to protect|http://www.businessinsider.fr/us/capital-one-hack-vulnerability-on-cloud-amazon-known-for-years-2019-8]]|DataBreach Capital_One|
|2019.08.05|TechTarget| → [[Capital One hack highlights SSRF concerns for AWS|https://searchsecurity.techtarget.com/news/252467901/Capital-One-hack-highlights-SSRF-concerns-for-AWS]]|DataBreach Capital_One|
|2019.08.05|//CloudPassage//| → [[Capital One Data Breach: Non-Technical Tips To Not Be A Headline|https://blog.cloudpassage.com/2019/08/08/capital-one-data-breach/]]|DataBreach Capital_One|
|2019.08.05|//DarkTrace//| → [[Back to square one: The Capital One breach proved we must rethink cloud security|https://www.darktrace.com/en/blog/back-to-square-one-the-capital-one-breach-proved-we-must-rethink-cloud-security/]]|DataBreach Capital_One|
|2019.08.09|GeekWire| → [[Amazon and Capital One face legal backlash after massive hack affects 106M customers|https://www.geekwire.com/2019/amazon-capital-one-face-lawsuits-massive-hack-affects-106m-customers/]]|DataBreach Capital_One|
|2019.08.09|//BitSight//| → [[Cloud Security: Lessons Learned from the Capital One Data Breach|https://www.bitsight.com/blog/cloud-security-lessons-learned-from-capital-one-data-breach]]|DataBreach Capital_One|
!"//Uncovering the CSA Top Threats to Cloud Computing with Jim Reavis//"
[>img(150px,auto)[iCSA/J88BU.jpg]]Article de blog publié le 8 août 2019 — Rédigé par Greg Jensen, Sr. Principal Director - Security Cloud Business Group, Oracle
<<<
//For the few that attend this year's ''BlackHat conference'' kicking off this week in Las Vegas, many will walk away with an in depth understanding and knowledge on risk as well as actionable understandings on how they can work to implement new strategies to defend against attacks. For the many others who don't attend, Cloud Security Alliance has once again developed their [[CSA Top Threats to Cloud Computing: The Egregious 11|2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']].
I recently sat down with the CEO and founder of CSA, Jim Reavis, to gain a deeper understanding on what leaders and practitioners can learn from this year's report that covers the [[top 11 threats to cloud computing - The Egregious 11|2019.08.06 - Publication : 'Top Threats to Cloud Computing: Egregious Eleven']].

//''Greg Jensen''// — Jim, for those who have never seen this, what is the CSA Top Threats to Cloud report and who is your target reader?
//''Jim Raevis''// — The CSA Top Threats to Cloud Computing is a research report that is periodically updated by our research team and working group of volunteers to identify high priority cloud security risks, threats and vulnerabilities to enable organizations to optimize risk management decisions related to securing their cloud usage. The Top Threats report is intended to be a companion to CSA's Security Guidance and Cloud Controls Matrix best practices documents by providing context around important threats in order to prioritize the deployment of security capabilities to the issues that really matter.
Our Top Threats research is compiled via industry surveys as well as through qualitative analysis from leading industry experts. This research is among CSA's most popular downloads and has spawned several translations and companion research documents that investigate cloud penetration testing and real world cloud incidents. Top Threats research is applicable to the security practitioner seeking to protect assets, executives needing to validate broader security strategies and any others wanting to understand how cloud threats may impact their organization. We make every effort to relate the potential pitfalls of cloud to practical steps that can be taken to mitigate these risks.

//''Greg''// — Were there any findings in the Top Threats report that really stood out for you?
//''Jim''// — Virtually all of the security issues we have articulated impact all different types of cloud. This is important as we find a lot of practitioners who may narrow their cloud security focus on either Infrastructure as a Service (IaaS) or Software as a Service (SaaS), depending upon their own responsibilities or biases. The cloud framework is a layered model, starting with physical infrastructure with layers of abstraction built on top of it. SaaS is essentially the business application layer built upon some form of IaaS, so the threats are applicable no matter what type of cloud one uses. Poor identity management practices, such as a failure to implement strong authentication, sticks out to me as a critical and eminently solvable issue. I think the increased velocity of the "on demand" characteristic of cloud finds its way into the threat of insufficient due diligence and problems of insecure APIs. The fastest way to implement cloud is to implement it securely the first time.

//''Greg''// — What do you think are some of the overarching trends you've noticed throughout the last 3 iterations of the report?
//''Jim''// — What has been consistent is that the highest impact threats are primarily the responsibility of the cloud user. To put a bit of nuance around this as the definition of a "cloud user" can be tricky, I like to think of this in three categories: a commercial SaaS provider, an enterprise building its own "private SaaS" applications on top of IaaS or a customer integrating a large number of SaaS applications have the bulk of the technical security responsibilities. So much of the real world threats that these cloud users grapple with are improper configuration, poor secure software development practices and insufficient identity and access management strategies.

//''Greg''// — Are you seeing any trends that show there is increasing trust in cloud services, as well as the CSP working more effectively around Shared Responsibility Security Model?
//''Jim''// — The market growth in cloud is a highly quantifiable indicator that cloud is becoming more trusted. "Cloud first" is a common policy we see for organizations evaluating new IT solutions, and it hasn't yet caused an explosion of cloud incidents, although I fear we must see an inevitable increase in breaches as it becomes the default platform.
We have been at this for over 10 years at CSA and have seen a lot of maturation in cloud during that time. One of the biggest contributions we have seen from the CSPs over that time is the amount of telemetry they make available to their customers. The amount and diversity of logfile information customers have today does not compare to the relative "blackbox" that existed when we started this journey more than a decade ago.
Going back to the layered model of cloud yet again, CSPs understand that most of the interesting applications customers build are a mashup of technologies. Sophisticated CSPs understand this shared responsibility for security and have doubled down on educational programs for customers. Also, I have to say that one of the most rewarding aspects of being in the security industry is observing the collegial nature among competing CSPs to share threat intelligence and best practices to improve the security of the entire cloud ecosystem.
One of the initiatives CSA developed that helps promulgate shared responsibility is the CSA ''Security, Trust, Assurance & Risk'' ([[STAR]]) Registry. We publish the answers CSPs provide to our assessment questionnaire so consumers can objectively evaluate a CSP's best practices and understand the line of demarcation and where their responsibility begins.

//''Greg''// — How does the perception of threats, risks and vulnerabilities help to guide an organization's decision making & strategy?
//''Jim''// — This is an example of why it is so important to have a comprehensive body of knowledge of cloud security best practices and to be able to relate it to Top Threats. A practitioner must be able to evaluate using any risk management strategy for a given threat, e.g. risk avoidance, risk mitigation, risk acceptance, etc. If one understand the threats but not the best practices, one will almost always choose to avoid the risk, which may end up being a poor business decision. Although the security industry has gotten much better over the years, we still fight the reputation of being overly conservative and obstructing new business opportunities over concerns about security threats. While being paranoid has sometimes served us well, threat research should be one of a portfolio of tools that helps us embrace innovation.

//''Greg''// — What are some of the security issues that are currently brewing/underrated that you think might become more relevant in the near future?
//''Jim''// — I think it is important to understand that malicious attackers will take the easy route and if they can phish your cloud credentials, they won't need to leverage more sophisticated attacks. I don't spend a lot of time worrying about sophisticated CSP infrastructure attacks like the Rowhammer direct random access memory (DRAM) leaks, although a good security practitioner worries a little bit about everything. I try to think about fast moving technology areas that are manipulated by the customer, because there are far more customers than CSPs. For example, I get concerned about the billions of IoT devices that get hooked into the cloud and what kinds of security hardening they have. I also don't think we have done enough research into how blackhats can attack machine learning systems to avoid next generation security systems.
Our Israeli chapter recently published a fantastic research document on the 12 Most Critical Risks for Serverless Applications. Containerization and Serverless computing are very exciting developments and ultimately will improve security as they reduce the amount of resource management considerations for the developer and shrink the attack surface. However, these technologies may seem foreign to security practitioners used to a virtualized operating system and it is an open question how well our tools and legacy best practices address these areas.
The future will be a combination of old threats made new and exploiting fast moving new technology. CSA will continue to call them as we see them and try to educate the industry before these threats are fully realized.

//''Greg''// — Jim, it's been great hearing from you today on this new Top Threats to Cloud report. Hats off to the team and the contributors for this year's report. Has been great working with them all!//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/08/uncovering-the-csa-top-threats-to-cloud-computing-w-jim-reavis/]] sur le blog de la CSA.
!"//Challenges & Best Practices in Securing Application Containers and Microservices//"
[>img(150px,auto)[iCSA/J88BC.jpg]]Article de blog publié le 7 août 2019 — Rédigé par Anil Karmel, Co-Chair, CSA Application Containers and Microservices (ACM) Working Group
<<<
//Application Containers have a long and storied history, dating back to the early 1960s with virtualization on mainframes up to the 2000s with the release of Solaris and Linux Containers (LXC). The rise of Docker in the early 2010s elevated the significance of Application Containerization as an efficient and reliable means to develop and deploy applications. Coupled with the rise of Microservices as an architectural pattern to decompose applications into fundamental building blocks, these two approaches have become the de facto means for how modern applications are delivered.

As with any new standard, challenges arise in how to secure application containers and microservices. The National Institute of Standards and Technology's (NIST) Cloud Security Working Group launched a group focused on developing initial guidance around this practice area. The Cloud Security Alliance partnered with NIST on development of this guidance and focused on maturing the same culminating in the release of two foundational artifacts, "Challenges in Securing Application Containers and Microservices" and "Best Practices in Securing Application Containers." CSA's Application Container and Microservices Working Group continues the charge laid by NIST to develop additional guidance around best practices in securing Microservices.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/08/challenges-best-practices-in-securing-application-containers-and-microservices/]] sur le blog de la CSA.
|!Août|!Sources|!Titres et Liens|!Synthèse|
|2019.08.09|CSA|[[CSA Releases "The Six Pillars of DevSecOps" Report|https://cloudsecurityalliance.org/articles/csa-releases-the-six-pillars-of-devsecops-report/]]|Paper identifies areas critical to successful DevSecOps integration within an organization|
|2019.08.09|CSA|[[CSA Releases New Research - Top Threats to Cloud Computing: Egregious Eleven|https://cloudsecurityalliance.org/articles/csa-releases-new-research-top-threats-to-cloud-computing-egregious-eleven/]]|Research shows traditional security issues falling by the wayside while those stemming from senior management decisions of increasing concern|
!"//The Cloud in the Fight Against Cyber-Bullying//"
[>img(150px,auto)[iCSA/J87BT.jpg]]Article de blog publié le 7 août 2019 — Rédigé par le Cybersecurity International Institute (CSI)
<<<
//The CSI Institute (→ [[Cybersecurity International Institute|https://www.csii.gr/]]) is a non-governmental and not-for-profit organization. Our goal is to contribute to the information, education, and, overall practical awareness of citizens in new technologies, online safety, and cybersecurity issues. In this context, we aim to enhance the scientific research in the field of modern technology, with an emphasis on cybercrime and online threats (viruses, etc.).

The antibullying project is an original and innovative action, exclusively established by the CSI Institute. It is, in fact, the first global innovation of its kind as there has been no such action internationally that could impact the community worldwide. The initiative will focus on supporting awareness, education and prevention of bullying and cyber-bullying in all Greek schools as a first implementation step

The project aims to develop a communication window with teens and pre-teens in the whole country, to reduce the dramatic dimensions of bullying and cyberbullying. As many people might know, some of the countless negative effects of bullying and cyberbullying include depression, anxiety, social phobia, loneliness, isolation, panic attacks, difficulty in concentrating and attention, substance use, eating disorders, online grooming, trafficking, tendencies and behaviors of self-injury, and even suicidal intentions.

In the antibullying project, students from every class of schools throughout the country will be elected as (Anti-Bullying) Ambassadors. Their role will be to pass on the knowledge they acquire from the CSI Institute to their environment. They will also report any dangerous activities or behaviors within the school or digital environment to the dedicated digital center that has been set up. In this way, students will receive first-aid psychological assistance and support from our specialized scientists. The target group for this action is students from Greece, ranging in ages from the third grade of primary school to the third grade of senior high school. The aim is to inform, educate, and raise awareness in the educational system of Greece and then expand this operation internationally (starting from Europe and then continue globally).

This action has generated a great deal of interest among many international organizations, and its initially calculated to cost 150,000 euros. This number includes the cost of setting up the whole project (computer systems, digital cloud platforms, and the yearly staff expenses for the experts that will be hired).

This action will be undertaken by any organization or group that shows an interest in supporting its full implementation and function. Once implemented, the minimum cost per year will be approximately 90,000 euros. Additional costs will include: the daily wages of the six specialized scientists, the maintenance of the digital platform and any travels nationally and internationally, where there is increased interest due to multiple cases of bullying.

Our final goal is to have a positive impact internationally and reduce the number of bullying and cyber-bullying incidents, as well as their harmful effects.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/05/facebook-project-libra-the-good-the-bad-the-ugly-and-why-you-should-care%ef%bb%bf/]] sur le blog de la CSA.
!"//Six Pillars of DevSecOps//"
<<<
[>img(150px,auto)[iCSA/J87PS.png]]//In our current state of cyber security, there has been a large growth of application flaws that bypass the continuing addition of security frameworks to ensure overall health of a project life cycle. Reducing the complexity during development cycles as well as being given the resources to build a trusted environment are key to future success. This is where DevSecOps takes shape. DevSecOps is the integration of continuous security principles, processes, and technology into DevOps culture, practices, and workflows. The Six Pillars of DevSecOps sets forth to introduce concepts that can be utilized and help companies grow with. With use cases to follow by, this paper allows industry professionals to take the concepts and apply them to their own environments.//
<<<
__Périmètre :__
<<<
//This document defines the six focus areas of DevSecOps critical to implementing and integrating DevSecOps into an organization.
The DevSecOps pillars provided in this document are meant to provide a holistic framework that blends the traditionally siloed operations: development, infrastructure operations, and information security, into a cohesive group that facilitates creation of secure software.// [...]
* //Pillar 1 Collective Responsibility//
* //Pillar 2 Collaboration and Integration//
* //Pillar 3 Pragmatic Implementation//
* //Pillar 4 Bridging Compliance and Development//
* //Pillar 5 Automation//
* //Pillar 6 Measure, Monitor, Report and Action//
<<<
__Conclusion :__
<<<
//The CSA DevSecOps Working Group concludes that the focus areas described in this document is able to address weaknesses in secure software development in the context of DevSecOps and will act as a building block for the future dynamic and creation of a properly implemented DevSecOps environment.
Each of the pillars will be addressed in depth in subsequent separate whitepapers.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j87p/|https://CloudSecurityAlliance.fr/go/j87p/]]''
!"//Top Threats to Cloud Computing: Egregious Eleven//"
<<<
[>img(150px,auto)[iCSA/J86PT.jpg]]//The report provides organizations with an up-to-date, expert-informed understanding of cloud security concerns in order to make educated risk-management decisions regarding cloud adoption strategies.//
<<<
__Synthèse :__
<<<
//The Top Threats reports have traditionally aimed to raise awareness of threats, risks and vulnerabilities in the cloud. Such issues are often the result of the shared, on-demand nature of cloud computing.
In this fourth installment, we again surveyed 241 industry experts on security issues in the cloud industry. This year our respondents rated 11 salient threats, risks and vulnerabilities in their cloud environments. The Top Threats Working Group used the survey results along with its expertise to create the final 2019 report.
The latest report highlights the Egregious Eleven (ranked in order of significance per survey results with applicable previous rankings)://
# //Data Breaches//
# //Misconfiguration and Inadequate Change Control//
# //Lack of Cloud Security Architecture and Strategy//
# //Insufficient Identity, Credential, Access and Key Management//
# //Account Hijacking//
# //Insider Threat//
# //Insecure Interfaces and APIs//
# //Weak Control Plane//
# //Metastructure and Applistructure Failures//
# //Limited Cloud Usage Visibility//
# //Abuse and Nefarious Use of Cloud Services//
<<<
__Conclusion :__
<<<
//As cloud business models and security tactics evolve, this report raises awareness of critical security issues such as data breaches, misconfiguration and identity, and access management. Other threats highlight lack-of-control hurdles that users may experience with CSPs, such as limited cloud usage visibility and weak control plane. These issues can lead to data breaches or leaks beyond the traditional landscape, as seen in many past cases.
Considering that user interfaces and APIs are the modern way to consume services, it is concerning that there are still significant challenges when it comes to securing these features.
The cloud - with its complexity - is also the perfect place for attackers to hide. It is also, unfortunately, an ideal launchpad for attacks. Last but not least, insider threats make it more challenging to protect organizations from data loss.
All of these pitfalls require more industry attention and research.
This Top Threats in Cloud Computing report suggests an interesting and somewhat new perspective on cloud security. This new outlook focuses on configuration and authentication, and shifts away from the traditional focus on information security (e.g., vulnerabilities and malware). Regardless, these security issues are a call to action for developing and enhancing cloud security awareness, configuration, and identity management.//
<<<
&rArr; Communiqué de presse → ''[[CloudSecurityAlliance.fr/go/j86p/|https://CloudSecurityAlliance.fr/go/j86p/]]''
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j86b/|https://CloudSecurityAlliance.fr/go/j86b/]]''
!"//Facebook Project Libra - the good, the bad, the ugly and why you should care?//"
[>img(150px,auto)[iCSA/J85BF.jpg]]Article de blog publié le 5 août 2019 — Rédigé par Kurt Seifried, Chief Blockchain Officer, CSA
<<<
//From the Seifried Files
So you've probably heard by now that Facebook will be creating a crypto-currency called "Project Libra" and if you haven't well, now you know.

So first let's cover what is good about this. Facebook has announced Project Libra as a Stablecoin, its value will be pegged to a basket of stable "real world" currencies (I'm guessing something like a mix of USD, Euro and Yen), so speculation won't really be a thing. Lessons from other stablecoin launches have clearly been learned by Facebook, this one will be using OpenSource technology, it will actually be "owned" by the "Libra Foundation" which is headquartered in Switzerland. We already have the typical mix of white papers talking about the Libra blockchain, the on-chain software that will be used to enforce the chain governance, rules, smart contracts and so on. As is typical there's not an actual running production instance, just the test network, and the software hasn't yet been formally audited or put through a formal verification process, but it will be. Essentially Facebook is using every signal possible to show this as a legitimate and trustworthy crypto-currency that can be used for payments.

To be honest the technology and governance structure looks fine, there's nothing really new or significantly different which I think is a good thing, Project Libra is designed to provide a stablecoin that can be used as a payment system, something you don't really need or want a lot of new surprises and excitement in.

So are there any real downsides to Project Libra? Probably the biggest one is that Facebook is pushing this forwards, despite setting up an association with a goal of 100 major participants (companies, banks, NGO's, etc.) this project is still heavily tied to Facebook, and many people have a love-hate relationship with Facebook.

There's nothing really ugly about Libra either, but one aspect I'm curious to see play out is how tradable digital assets sold via Libra will handle pricing discrimination. Many companies would rather sell digital assets (like in game skins) at a discount in developing countries as opposed to not selling anything at all. For digital assets that can be exchanged or traded in game this could present an arbitrage opportunity for end users and secondary markets may develop, and as we've seen companies often hate this, because secondary markets are often lucrative (and frustrating for users, opportunities for fraud abound).

But there is one thing that Facebook brings to the crypto-currency table that almost nobody else can (apart from maybe Linkedin or Google…) which is KYC.

KYC is Know Your Customer, it's literally knowing who the account holder(s) are, their identity, location, address, which jurisdiction they are in and so on. This helps prevent things like identity theft and financial fraud, and also ties into the AML side of crypto-currency regulation. Anti-Money Laundering is exactly what it sounds like, and also ties into terrorist and other criminal funding activities.

Facebook has arguably the world's largest social graph, and the deepest knowledge of many people (many people essentially stream their entire life, and the lives of their families on Facebook). Facebook can easily verify who people are (and in many cases they already have via your phone number and so on) in a way that almost nobody else can. This combined with Facebook's reach (they can simply add Libra capability to their website and mobile client and boom, hundreds of millions of people have access to it instantly) gives them a potential advantage no other crypto-currency has ever had.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/05/facebook-project-libra-the-good-the-bad-the-ugly-and-why-you-should-care%ef%bb%bf/]] sur le blog de la CSA.
!1 - Les nouveautés CSA de la semaine du 29 juillet au 4 août 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog: ''CCM v3.0.1. Update for AICPA, NIST and FedRAMP Mappings''+++*[»]> <<tiddler [[2019.08.02 - Blog : CCM v3.0.1. Update for AICPA, NIST and FedRAMP Mappings]]>>=== 
* Publication : ''Information Security Management through Reflexive Security''+++*[»]> <<tiddler [[2019.08.01 - Publication : 'Information Security Management through Reflexive Security']]>>=== 
* Blog : ''Quantum Technology Captures Headlines in the Wall Street Journal''+++*[»]> <<tiddler [[2019.08.01 - Blog : 'Quantum Technology Captures Headlines in the Wall Street Journal']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.08.04 - Veille Hebdomadaire]] avec plus de 80 liens dont :
* Piratages et fuites de données : Incident Capital One et analyse de l'origine liée (ou non) à AWS, fuite de bucket AWS en Inde, attaque contre des comptes O365
* Rapports et sondages : Gartner, Netskope, Netwrix, Stackrox, Thycotic
* Pannes : O365, Slack
* Divers : Azure et conformité NIST SP 800-53, la KillChain contre AWS, prévention contre les fuites liées aux buckets S3, CASB
|!Août|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.08.04|
|2019.08.04|Les Echos[>img[iCSF/flag_fr.png]]|[[Les régulateurs bancaires américains en alerte sur le cloud|https://www.lesechos.fr/finance-marches/banque-assurances/les-regulateurs-bancaires-americains-en-alerte-sur-le-cloud-1122165]]|Regulations|
|2019.08.04|The Korea Times|[[Concerns growing over AWS cloud security in Korea|http://www.koreatimes.co.kr/www/tech/2019/08/133_273271.html]]|Risks|
|2019.08.04|//Sophos//|[[Seven Best Practices for Securing the Public Cloud|http://www.globalsecuritymag.com/Seven-Best-Practices-for-Securing,20190804,89601.html]]|Best_Practices|
|>|>|>|!2019.08.03|
|2019.08.03|Bleeping Computer|[[Misconfigured JIRA Servers Leak Info on Users and Projects|https://www.bleepingcomputer.com/news/security/misconfigured-jira-servers-leak-info-on-users-and-projects/]]|DataLeak Jira|
|>|>|>|!2019.08.02|
|2019.08.02|CERT-EU|[[Massive breach at Capital One, purportedly due to a cloud misconfiguration|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190802-1.pdf]]|DataBreach Capital_One|
|2019.08.02|DisruptOps|![[Breaking Attacker Kill Chains in AWS: IAM Roles|https://disruptops.com/breaking-attacker-kill-chains-in-aws-iam-roles/]]|KillChain AWS|
|2019.08.02|DZone|[[CASBs: It's Time To Remove The Broker|https://dzone.com/articles/casbs-its-time-to-remove-the-broker]]|CASB|
|2019.08.02|DevOps.com|![[Top 5 AWS Security Mistakes: Leaky S3 Buckets|https://devops.com/top-5-aws-security-mistakes-leaky-s3-buckets/]]|AWS S3|
|2019.08.02|MSSP Alert|[[40,000 Cloud Container Platforms Left Unsecured|https://www.msspalert.com/cybersecurity-research/40000-cloud-container-platforms-left-unsecured/]]|Misconfigurations|
|2019.08.02|//Gigamon//|[[Securing Beyond Shared Responsibility - Cloud Traffic Visibility|https://blog.gigamon.com/2019/08/02/securing-beyond-shared-responsibility-cloud-traffic-visibility/]]|Shared_Responsibility|
|2019.08.02|//IBM//|[[IBM's CTO, Cloud Platform Services, on "Cloud Paks", Containers, Paas-Bashing and Mainframes|https://www.cbronline.com/qa/bala-rajaraman-cto-ibm-cloud-platform-services]]|Misc|
|2019.08.02|//Akamai//|[[Security Fundamentals Are Key To Successful Cloud Migration|https://blogs.akamai.com/2019/08/security-fundamentals-are-key-to-successful-cloud-migration.html]]|Zero_Trust|
|>|>|>|!2019.08.01|
|2019.08.01|Les Echos[>img[iCSF/flag_fr.png]]|[[Une page se tourne pour le cloud souverain français|https://www.lesechos.fr/tech-medias/hightech/une-page-se-tourne-pour-le-cloud-souverain-francais-1118112]]|Sovereign_Cloud Cloudwatt|
|2019.08.01|Wall Street Journal|[[Fed Examined Amazon's Cloud in New Scrutiny for Tech|https://www.wsj.com/articles/fed-examined-amazons-cloud-in-new-scrutiny-for-tech-11564693812]]|AWS|
|2019.08.01|DZone|[[Your Cloud Application Security Checklist|https://dzone.com/articles/your-cloud-application-security-checklist]]|Misc|
|2019.08.01|DataBreaches.net|[[A misconfigured AWS bucket exposed personal and counseling logs of almost 300,000 Indian employees|https://www.databreaches.net/a-misconfigured-aws-bucket-exposed-personal-and-counseling-logs-of-almost-300000-indian-employees/]]|DataBreaches|
|2019.08.01|isBuzzNews|[[Practicing Safe Containerisation|https://www.informationsecuritybuzz.com/articles/practicing-safe-containerisation/]]|Containers|
|2019.08.01|FCW|[[Nuclear weapons security agency moving apps to cloud|https://fcw.com/articles/2019/08/01/nnsa-cloud-rockwell.aspx]]|Misc|
|2019.08.01|//Netwrix//|[[Lack of Budgets for Cloud Security Initiatives Slows Down Cloud Adoption for Government|https://vmblog.com/archive/2019/08/01/netwrix-survey-lack-of-budgets-for-cloud-security-initiatives-slows-down-cloud-adoption-for-government.aspx]]|Report Netwrix|
|2019.08.01|//Netwrix//| → [[2019 Netwrix Cloud Data Security Report|https://www.netwrix.com/2019cloudsecurityreport.html]]|Report Netwrix|
|2019.08.01|//Netwrix//[>img[iCSF/flag_fr.png]]| → [[Les budgets de sécurité du cloud insuffisants ralentissent son adoption dans le secteur public|https://cyberexperts.tech/les-budgets-de-securite-du-cloud-insuffisants-ralentissent-son-adoption-dans-le-secteur-public/]]|Report Netwrix|
|2019.08.01|//Azure//|![[New Azure Blueprint simplifies compliance with NIST SP 800-53|https://azure.microsoft.com/en-us/blog/new-azure-blueprint-simplifies-compliance-with-nist-sp-800-53/]]|Azure Compliance NIST|
|2019.08.01|//Azure//|[[Introducing Azure Dedicated Host|https://azure.microsoft.com/en-us/blog/introducing-azure-dedicated-host/]] ([[site dédié "ADH"|https://aka.ms/ADHWebsite]]=|Azure Isolation|
|2019.08.01|//Thycotic//|[[Security as a Service (Saas) on the Rise - 2019 Global Research Report|https://thycotic.com/resources/security-as-a-service-global-research-report/]]|Report Thycotic|
|2019.08.02|InfoSecurity Mag| → [[70% of Orgs Will Use Security-as-a-Service by 2021|https://www.infosecurity-magazine.com/news/orgs-securityasaservice-by-2021/]]|Report Thycotic|
|2019.08.01|//Managed Methods//|[[CASBs: Is It Time To Remove The "Broker" From Cloud Access Security Broker?|https://managedmethods.com/blog/casbs-time-to-remove-the-broker/]]|CASB|
|2019.08.01|//Security Intelligence//|[[The Secret to a Secure Multicloud Enterprise Is Open Source|https://securityintelligence.com/posts/the-secret-to-a-secure-multicloud-enterprise-is-open-source/]]|Multi_Cloud|
|2019.08.01|//Cruise//|[[Secrets Management in a Cloud Agnostic World|https://medium.com/cruise/secrets-management-3a7c47fe81b]]|Secret_Management|
|2019.08.01|//CompliantCloud//|[[The Crossover of Data Integrity and Data Privacy in the Cloud|https://compliantcloud.com/data-integrity-data-privacy-cloud-life-science/]]|Integrity Privacy|
|2019.08.01|//Aporeto//|[[Hardening Cloud Security|https://www.aporeto.com/blog/hardening-cloud-security/]]|Hardening|
|2019.08.01|//Aqua//|[[Kubernetes Pod Escape Using Log Mounts|https://blog.aquasec.com/kubernetes-security-pod-escape-log-mounts]]|Kubernetes Logging|
|2019.08.01|//Akamai//|[[4 Critical Elements Your Next Security Solution Must Have|https://blogs.akamai.com/2019/08/4-critical-elements-your-next-security-solution-must-have.html]]|Misc|
|>|>|>||
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.31|
|2019.07.31|ZDnet[>img[iCSF/flag_fr.png]]|[[Cloudwatt : arrêt du service en février prochain|https://www.zdnet.fr/actualites/cloudwatt-arret-du-service-en-fevrier-prochain-39888593.htm]]|Sovereign_Cloud Cloudwatt|
|2019.07.31|Rainbowtabl.es|[[Honda Motor Company leaks database with 134 million rows of employee computer data|https://rainbowtabl.es/2019/07/31/honda-motor-company-leak/]]|DataLeak ElasticSearch|
|2019.07.31|Bleeping Computer| → [[Unsecured Database Exposes Security Risks in Honda's Network|https://www.bleepingcomputer.com/news/security/unsecured-database-exposes-security-risks-in-hondas-network/]]|DataLeak ElasticSearch|
|2019.07.31|Dark Reading|[[Google Cloud Debuts New Security Capabilities|https://www.darkreading.com/cloud/google-cloud-debuts-new-security-capabilities/d/d-id/1335405]]|GCP|
|2019.07.31|CSO Online|[[Is the cloud lulling us into security complacency?|https://www.csoonline.com/article/3412006/is-the-cloud-lulling-us-into-security-complacency.html]]|Governance|
|2019.07.31|DZone|[[Cloud-Native Best Business Practices (Part 3) - Open Source|https://dzone.com/articles/cloud-native-best-business-practices-part-3-open-s]] (3/7)|Best_Practices|
|2019.07.31|ZDnet|[[Brazilian firms struggle with cloud security immaturity|https://www.zdnet.com/article/brazilian-firms-struggle-with-cloud-security-immaturity/]]|Report Symantec|
|2019.07.31|//Google Cloud//|[[Titan Security Keys: now available in Japan, Canada, France, and the UK|https://gsuiteupdates.googleblog.com/2019/07/titan-security-key-expansion.html]]|GCP Authentication|
|2019.07.31|//Google Cloud//|[[Defend high-risk users with the Advanced Protection Program for enterprise beta|https://gsuiteupdates.googleblog.com/2019/07/advanced-protection-program-enterprise.html]]|GCP|
|2019.07.31|Dark Reading| → [[Google Cloud Debuts New Security Capabilities|https://www.darkreading.com/cloud/google-cloud-debuts-new-security-capabilities/d/d-id/1335405]]|GCP|
|2019.07.31|//Rapid7//|[[Do You Have Containers in Your Environment? Using Container Discovery to Be Sure|https://blog.rapid7.com/2019/07/31/do-you-have-containers-in-your-environment-using-container-discovery-to-be-sure/]]|Containers Discovery|
|2019.07.31|//Blissfully//|[[SaaS Vendor Renewal Process: A Checklist for IT|https://www.blissfully.com/blog/saas-vendor-renewal-process-checklist/]]|SaaS Contracting|
|2019.07.31|//AtScale//|[[Orchestrating security policies across your hybrid cloud with intelligent data virtualization|https://www.helpnetsecurity.com/2019/07/31/intelligent-data-virtualization/]]|Misc|
|2019.07.31|//IbexLabs//|[[Fault Tolerance And Redundancy For Cloud Computing|https://www.ibexlabs.com/fault-tolerance-and-redundancy-for-cloud-computing/]]|Redundancy|
|2019.07.31|//Detectify//|[[Bypassing Cloudflare WAF with the origin server IP address|https://blog.detectify.com/2019/07/31/bypassing-cloudflare-waf-with-the-origin-server-ip-address/]]|Firewall|
|>|>|>|!2019.07.30|
|2019.07.30|Bleeping Computer|[[Outlook Is Down, Users Are Experiencing Sign-in Failures|https://www.bleepingcomputer.com/news/technology/outlook-is-down-users-are-experiencing-sign-in-failures/]]|Outage O365|
|2019.07.30|CSO Online|[[What is a CASB? What you need to know before you buy|https://www.csoonline.com/article/3104981/what-is-a-cloud-access-security-broker-and-why-do-i-need-one.html]]|CASB|
|2019.07.30|SecurityWeek|[[Microsoft Makes Azure Security Center for IoT Generally Available|https://www.securityweek.com/microsoft-makes-azure-security-center-iot-generally-available]]|Azure IoT|
|2019.07.30|Numerama[>img[iCSF/flag_fr.png]]|[[Paris sait les risques du Cloud Act, mais ne peut pas dissuader les Français d'aller sur Google ou Facebook|https://www.numerama.com/politique/537429-paris-sait-les-risques-du-cloud-act-mais-ne-peut-pas-dissuader-les-francais-daller-sur-google-ou-facebook.html]]|CLOUD_Act|
|2019.07.30|CompareTheCloud|[[Changing from network access to application access|https://www.comparethecloud.net/articles/changing-from-network-access-to-application-access/]]|Access_Controls|
|2019.07.30|CSO Online|[[6 lessons from Venmo's lax approach to API security|https://www.csoonline.com/article/3410044/6-lessons-from-venmos-lax-approach-to-api-security.html]]|Data_Leak APIs|
|2019.07.30|MSSP Alert|[[AWS Cloud Cybersecurity: Customer Errors Threaten Amazon's Credibility|https://www.msspalert.com/cybersecurity-news/aws-cloud-cybersecurity-configuration-errors/]]|AWS Misconfigurations|
|2019.07.31|//Digital Shadows//|[[The Account Takeover Kill Chain: A Five Step Analysis|https://www.digitalshadows.com/blog-and-research/the-account-takeover-kill-chain-a-five-step-analysis/]]|KillChain|
|2019.07.30|//Lastline//|[[8 IaaS Cloud Security Challenges You Should Be Aware Of|https://www.lastline.com/blog/8-iaas-cloud-security-challenges-you-should-be-aware-of/]]|IaaS Risks|
|2019.07.30|//Cyware//|[[Community Psychiatric Clinic responds to incident involving unauthorized access to Office 365 accounts|https://cyware.com/news/community-psychiatric-clinic-responds-to-incident-involving-unauthorized-access-to-office-365-accounts-2a548992]]|O365 Incident|
|2019.07.30|//Stackrox//|[[Kubernetes and Container Security and Adoption Trends|https://www.stackrox.com/kubernetes-adoption-and-security-trends-and-market-share-for-containers/]]|Report Containers|
|2019.07.30|VMblog| → [[StackRox Report Reveals Security Concerns Have Increased Despite Rapid Adoption of Containers and Kubernetes|https://vmblog.com/archive/2019/07/30/stackrox-report-reveals-security-concerns-have-increased-despite-rapid-adoption-of-containers-and-kubernetes.aspx]]|Report Containers|
|2019.07.30|SecurityWeek| → [[Security a Top Concern as Containerization Gathers Pace|https://www.securityweek.com/security-top-concern-containerization-gathers-pace]]|Report Containers|
|2019.07.30|BetaNews| → [[Organizations struggle with container security|https://betanews.com/2019/07/30/container-security-struggle/]]|Report Containers|
|2019.09.03|//Tripwire//| → [[Survey Reveals Kubernetes Usage Skyrocketing, but Security Concerns Remain|https://www.tripwire.com/state-of-security/devops/kubernetes-usage-skyrocketing-security-concerns-remain/]]|Report Containers|
|2019.07.31|//Netskope//|[[Netskope Cloud Report - August 2019|https://resources.netskope.com/cloud-reports/netskope-cloud-report-august-2019]]|Report Netskope|
|2019.08.01|Solutions Review| → [[Cloud Services Accounts for 85% of Enterprise Web Traffic|https://solutionsreview.com/cloud-platforms/cloud-services-accounts-for-85-of-enterprise-web-traffic/]]|Report Netskope|
|2019.08.01|BetaNews| → [[85 percent of enterprise web traffic is cloud services|https://betanews.com/2019/08/01/enterprise-web-traffic-cloud/]]|Report Netskope|
|2019.07.30|//Radware//|[[Security Considerations for Cloud Hosted Services|https://blog.radware.com/security/cloudsecurity/2019/07/security-considerations-for-cloud-hosted-services/]]|Hosting|
|2019.07.30|//TAG Cyber//|[[More Benefits, Risks, and Insurance Issues in the Cloud|https://threatvector.cylance.com/en_us/home/more-benefits-risks-and-insurance-issues-in-the-cloud.html]]|Risks Insurance|
|2019.07.30|//Google Cloud//|[[3 questions to ask before moving your organization's content to the cloud|https://cloud.google.com/blog/topics/perspectives/3-questions-to-ask-before-moving-your-organizations-content-to-the-cloud]]|Misc|
|2019.07.30|//DivvyCloud//|[[PERSPECTIVE: Automation Is the Antidote for Government Agencies Plagued by Cyberattacks|https://www.hstoday.us/subject-matter-areas/cybersecurity/perspective-automation-is-the-antidote-for-government-agencies-plagued-by-cyberattacks/]]|Automation|
|>|>|>|!2019.07.29|
|2019.07.29|Capital One|[[Capital One Announces Data Security Incident|https://press.capitalone.com/phoenix.zhtml]]|DataBreach Capital_One|
|2019.07.29|Washington Post| → [[Capital One looked to the cloud for security. But its own firewall couldn't stop a hacker.|https://www.washingtonpost.com/technology/2019/07/30/capital-one-looked-cloud-security-its-own-firewall-couldnt-stop-hacker/]]|DataBreach Capital_One|
|2019.07.29|The New York Times| → [[Capital One Data Breach Compromises Data of Over 100 Million|https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html]]|DataBreach Capital_One|
|2019.07.29|Bloomberg| → [[Capital One Says Breach Hit 100 Million Individuals in U.S.|https://www.bloomberg.com/news/articles/2019-07-29/capital-one-data-systems-breached-by-seattle-woman-u-s-says]]|DataBreach Capital_One|
|2019.07.29|MSSP Alert| → [[Capital One Data Breach Details: 10 Things to Know|https://www.msspalert.com/cybersecurity-breaches-and-attacks/capital-one-details/]]|DataBreach Capital_One|
|2019.07.30|Krebs On Security| → [[Capital One Data Theft Impacts 106M People|https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/]]|DataBreach Capital_One|
|2019.07.30|//Threatpost//| → [[Former AWS Engineer Arrested as Capital One Admits Massive Data Breach|https://threatpost.com/aws-arrest-data-breach-capital-one/146758/]]|DataBreach Capital_One|
|2019.07.30|MSSP Alert| → [[AWS Cloud Cybersecurity: Customer Errors Threaten Amazon's Credibility|https://www.msspalert.com/cybersecurity-news/aws-cloud-cybersecurity-configuration-errors/]]|DataBreach Capital_One|
|2019.07.30|//Lacework//| → [[How Capital One Illustrates the Need for Cloud Configuration Visibility|https://www.lacework.com/capital-one-cloud-configuration-visibility/]]|DataBreach Capital_One|
|2019.07.30|CIO Dive| → [[5 things to know about Capital One's breach|https://www.ciodive.com/news/5-things-to-know-about-capital-ones-breach/559909/]]|DataBreach Capital_One|
|2019.07.30|J Cole Morrison| → [[The Technical Side of the Capital One AWS Security Breach|https://start.jcolemorrison.com/the-technical-side-of-the-capital-one-aws-security-breach/]]|DataBreach Capital_One|
|2019.07.30|Laureen Weinstein| → [[Another Breach: What Capital One Could Have Learned from Google's "BeyondCorp"|https://lauren.vortex.com/2019/07/30/another-breach-what-capital-one-could-have-learned-from-googles-beyondcorp]]|DataBreach Capital_One|
|2019.07.30|Evan Johnson| → [[Preventing The Capital One Breach|https://ejj.io/blog/capital-one]]|DataBreach Capital_One|
|2019.07.31|//Digital Shadows//| → [[Capital One Breach: What we know and what you can do|https://www.digitalshadows.com/blog-and-research/capital-one-breach-what-we-know-and-what-you-can-do/]]|DataBreach Capital_One|
|2019.07.31|//Duo Security//| → [[Capital One Breach Does Not Mean the Cloud is Insecure|https://duo.com/decipher/capital-one-breach-does-not-mean-the-cloud-is-insecure]]|DataBreach Capital_One|
|2019.08.01|The Last Watchdog| → [[ROUNDTABLE: Huge Capital One breach shows too little is being done to preserve data privacyThe Last Watchdog|https://www.lastwatchdog.com/roundtable-huge-capital-one-breach-shows-too-little-is-being-done-to-preserve-data-privacy/]]|DataBreach Capital_One|
|2019.08.01|//Fugue//|! → [[A Technical Analysis of the Capital One Cloud Misconfiguration Breach|https://www.fugue.co/blog/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach]]|DataBreach Capital_One|
|2019.08.02|Dark Reading| → [[Capital One: What We Should Learn This Time|https://www.darkreading.com/cloud/capital-one-what-we-should-learn-this-time/d/d-id/1335426]]|DataBreach Capital_One|
|2019.08.02|CIO Dive| → [[Capital One breach raises questions about security and cloud-first strategies|https://www.ciodive.com/news/capital-one-breach-raises-questions-about-security-and-cloud-first-strategi/560129/]]|DataBreach Capital_One|
|2019.08.02|Krebs On Security| → [[What We Can Learn from the Capital One Hack|https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/]]|DataBreach Capital_One|
|2019.07.29|Bleeping Computer|[[Slack Experiencing Large-Scale Outage Caused by Messaging Issue|https://www.bleepingcomputer.com/news/technology/slack-experiencing-large-scale-outage-caused-by-messaging-issue/]]|Outage Slack|
|2019.07.29|DZone|![[Did I Just See Google Cloud Go Back in Time?|https://dzone.com/articles/did-i-just-see-google-cloud-go-back-in-time]]|History|
|2019.07.29|DZone|[[Step-by-Step Guide: Establishing Container Networking|https://dzone.com/articles/step-by-step-guide-establishing-container-networki]]|Containers|
|2019.07.29|Bleeping Computer|[[Microsoft Adds IoT Device Protection to Azure Security Center|https://www.bleepingcomputer.com/news/microsoft/microsoft-adds-iot-device-protection-to-azure-security-center/]]|Azure IoT|
|2019.07.29|IoT for all|[[Cloud-Native Environments: A Challenge for Traditional Cybersecurity Practices|https://www.iotforall.com/cloud-native-environments-challenge-traditional-cybersecurity-practices/]]|Misc|
|2019.07.29|CISO Mag|[[Debunking five myths in cloud security|https://www.cisomag.com/debunking-five-myths-in-cloud-security/]]|Misc|
|2019.07.29|The Register|[[Microsoft preps to purge its cloud access security broker of shonky crypto protocols TLS 1.0, 1.1|https://www.theregister.co.uk/2019/07/29/tls_microsoft_cloud_security/]]|Cryptography|
|2019.07.29|The Register|[[We need you for a multi-cloud sanity check: Which providers do you use and need, and how do you choose them?|https://www.theregister.co.uk/2019/07/29/cloud_provider_survey/]]|Survey|
|2019.07.29|HelpNet Security|[[Cloud adoption and security are not mutually exclusive|https://www.helpnetsecurity.com/2019/07/29/cloud-adoption-and-security/]]|Misc|
|2019.07.29|Container Journal|[[Cluster Monitoring With Prometheus Operator|https://containerjournal.com/2019/07/29/cluster-monitoring-with-prometheus-operator/]]|Kubernetes|
|2019.07.29|Security Scoreboard|[[Benefits of Continuous Compliance Monitoring in the Cloud|https://securityscorecard.com/blog/benefits-continuous-compliance-monitoring-in-cloud]]|Compliance Monitoring|
|2019.07.29|CyberSecurity Hub|[[Cloud Security Market Report: Exploring The Right Enterprise Strategy|https://www.cshub.com/cloud/reports/cloud-security-market-report-exploring-the-right-enterprise-strategy]]|Report|
|2019.07.29|Technology Decisions|[[Cloud customers still making basic security mistakes|https://www.technologydecisions.com.au/content/cloud-and-virtualisation/article/cloud-customers-still-making-basic-security-mistakes-1251148303]]|Best_Practices|
|2019.07.29|CBR Online|[[What Is DevOps Security - and Does it Drive Secure Deployments?|https://www.cbronline.com/feature/devops-security]]|DevSecOps|
|2019.07.29|CircleID|[[Gartner Says Worldwide IaaS Public Cloud Services Market Grew 31.3% in 2018|http://www.circleid.com/posts/20190729_worldwide_iaas_public_cloud_services_market_in_2018/]]|IaaS|
|2019.07.29|//Threatpost//|[[Cloud Security Concerns Loom for 93% of Businesses Adopting Apps and BYOD|https://threatpost.com/cloud-security-concerns-loom-for-93-of-businesses-adopting-apps-and-byod/146739/]]|BYOD|
|2019.07.29|//Cloud Passage//|[[Why IaaS requires cloud security automation|https://blog.cloudpassage.com/2019/07/29/iaas-requires-cloud-security-automation/]]|IaaS Automation|
|2019.07.29|//Security Intelligence//|![[Cloud Provider Relationships Don't Last, So Protect Your Data With an Exit Plan|https://securityintelligence.com/posts/cloud-provider-relationships-dont-last-so-protect-your-data-with-an-exit-plan/]]|Reversibility|
|2019.07.29|//PaloAlto Networks//|[[Advantages of Cloud-Delivered Security for U.S. Govt Agencies|https://blog.paloaltonetworks.com/2019/07/cloud-delivered-security-benefits-govt-agencies/]]|Government|
|2019.07.29|//Imperva//|[[Enabling Faster DDoS Mitigation for Cloud Assets|https://www.imperva.com/blog/enabling-faster-ddos-mitigation-for-cloud-assets/]]|DDoS Mitigation|
|2019.07.29|Techrepublic|[[Is homomorphic encryption ready to deliver confidential cloud computing to enterprises?|https://www.techrepublic.com/article/is-homomorphic-encryption-ready-to-deliver-confidential-cloud-computing-to-enterprises/]]|Encryption Homomorphic|
|2019.07.29|//Azure//|[[Announcing general availability for the Azure Security Center for IoT|https://azure.microsoft.com/en-us/blog/announcing-general-availability-for-the-azure-security-center-for-iot/]]|Azure IoT|
!"//CCM v3.0.1-080319//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CCM v3.0.1 version du 3 août 2019''"__
<<<
//The CCM, the only meta-framework of cloud-specific security controls, mapped to leading standards, best practices and regulations. CCM provides organizations with the needed structure, detail and clarity relating to information security tailored to cloud computing. CCM is currently considered a de-facto standard for cloud security assurance and compliance.//
<<<
&rArr; Téléchargement (après inscription, mais ''indisponible pour le moment'') → ''[[CloudSecurityAlliance.fr/go/j83c/|https://CloudSecurityAlliance.fr/go/j83c/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CSA CCM v3.0.1 Addendum for AICPA, NIST and FedRAMP Mappings//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CSA CCM v3.0.1 Addendum - AICPA TSC 2017''"__
<<<
//This document is an addendum to the CCM V3.0.1 that contain controls mapping between the CSA CCM and the AICPA TSC 2017. The document aims to help AICPA TSC 2017 compliant organizations meet CCM requirements. This is achieved by identifying compliance gaps in AICPA TSC 2017 in relation to the CCM. This document contains the following information:
* Controls Mapping
* Gap Analysis
* Gap Identification (i.e. Partial, Full or No Gap)
//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j83a/|https://CloudSecurityAlliance.fr/go/j83a/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate''"__
<<<
//This document is an addendum to the CCM V3.0.1 that contain controls mapping between the CSA CCM and the NIST 800-53 R4 Moderate Baseline. The document aims to help NIST 800-53 R4 Moderate compliant organizations meet CCM requirements. This is achieved by identifying compliance gaps in NIST 800-53 in relation to the CCM. This document contains the following information:
* Controls Mapping
* Gap Analysis
* Gap Identification (i.e. Partial, Full or No Gap)
//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j83n/|https://CloudSecurityAlliance.fr/go/j83n/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CCM v3.0.1 Addendum - FedRAMP Moderate//"
[>img(150px,auto)[iCSA/J83PC.jpg]]__"''CCM v3.0.1 Addendum - FedRAMP Moderate''"__
<<<
//This document is an addendum to the CCM V3.0.1 that contain controls mapping between the CSA CCM and the FedRAMP R4 Moderate Baseline. The document aims to help FedRAMP compliant organizations meet CCM requirements. This is achieved by identifying compliance gaps in FedRAMP in relation to the CCM. This document contains the following information:
* Controls Mapping
* Gap Analysis
* Gap Identification (i.e. Partial, Full or No Gap)
//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j83f/|https://CloudSecurityAlliance.fr/go/j83f/]]''
[img(25%,1px)[iCSF/BluePixel.gif]]
!"//CCM v3.0.1. Update for AICPA, NIST and FedRAMP Mappings//"
[>img(150px,auto)[iCSA/J82BC.jpg]]Article de blog publié le 2 août 2019 — Rédigé par Victor Chin et Lefteris Skoutaris, Research Analysts, CSA
<<<
//The CSA Cloud Controls Matrix (CCM) Working Group is glad to announce the new update to the CCM v3.0.1. This minor update will incorporate the following mappings:
* Association of International Certified Professional Accountants (AICPA) Trust Services Criteria (TSC) 2017
* National Institute of Standards and Technology (NIST) 800-53 R4 Moderate
* Federal Risk Authorization and Management Program (FedRAMP) Moderate

A total of four documents will be released. The updated CCM (CCM v3.0.1-03-08-2019) will be released to replace the outdated CCM v3.0.1-12-11-2017. Additionally, three addendums will be released for AICPA TSC 2017, NIST 800-53 R4 Moderate and FedRAMP moderate, separately. The addendums will contain gap analyses and also control mappings. We hope that organizations will find these documents helpful in bridging compliance gaps between the CCM, AICPA TSC 2017, FedRAMP and NIST 800-53 R4 Moderate.
With the release of this update the CCM Working Group will be concluding all CCM v3 work and refocusing our efforts on CCM v4.

The upgrade of CCM v3 to the next version 4 has been made imperative due to the evolution of the cloud security standards, the need for more efficient auditability of the CCM controls and integration into CCM of the security requirements deriving from the new cloud technologies introduced.
In this context, a CCM task force has already been established to take on this challenge and drive CCM v4 development. The CCM v4 working group is comprised of CSA's community volunteers comprised of industry's leading experts in the domain of cloud computing and security. This endeavor is supported and supervised by the [[CCM co-chairs and strategic advisors|https://cloudsecurityalliance.org/research/working-groups/cloud-controls-matrix]] who will ensure that the CCM v4 vision requirements and development plan are successfully implemented.
Some of the core objectives that drive CCM v4 development include:
* Improving the auditability of the controls
* Providing additional implementation and assessment guidance to organizations
* Improve interoperability and compatibility with other standards
* Ensuring coverage of requirements deriving from new cloud technologies (e.g., microservices, containers) and emerging technologies (e.g., IoT)
//[...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/02/ccm-v3-0-1-update-for-aicpa-nist-and-fedramp-mappings/]] sur le blog de la CSA
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j82m/|https://CloudSecurityAlliance.fr/go/j82m/]]'' (format XLSX)
!"//Quantum Technology Captures Headlines in the Wall Street Journal//"
[>img(150px,auto)[iCSA/J81BQ.jpg]]Article de blog publié le 1^^er^^ août 2019 — Rédigé par le groupe de travail "Quantum-Safe Security"
<<<
//Last month, we celebrated the 50th anniversary of the Apollo 11 moon landing. Apollo, which captured the imagination of the whole world, epitomizes the necessity for government involvement in long term, big science projects. What started as a fierce race between the USA and the USSR at the apex of the cold war ended up as a peaceful mission, "one giant leap for mankind".

This "Leap" was just one of many steps that lead to the US, Russia, Japan, Europe and Canada sharing the International Space Station for further space exploration. The parallel with the quantum computer, which recently made headlines in the Wall Street Journal, is striking gauntlet to be picked up. A foreign power, in this case China, developed advanced quantum technologies passing its western counterparts and warrants a competitive response. Here again, the US policymakers rise to the challenge and call for a significant investment in quantum technologies (as presented in the WSJ article: [[In a White House Summit on Quantum Technology, Experts Map Next Steps|https://CloudSecurityAlliance.fr/go/j81q/]]).

Quantum technologies may not capture the imagination of so many star-gazing children as space. However, show them a golden "chandelier" of a quantum computer, tell them that it operates at temperatures colder than space, explain that it can do more optimization calculations than all classical computers combined, and we might get some converts. We will need these engineers, developers and professions we have not yet thought of to get the full and profound impacts that are likely with quantum computers. If history is any guide, the currently expected applications in pharmaceuticals, finance and transportation mentioned in the WSJ are only a small portion of the real potential. Just these fields will require education on the quantum technologies at a broad level, as called for by the bipartisan participants to the White House Summit on Quantum Technologies. In addition, the threat of the quantum computer on our existing cybersecurity infrastructure (again reported in the WSJ: [[The Day When Computers Can Break All Encryption Is Coming|https://CloudSecurityAlliance.fr/go/j81b/]]), is real today. Sensitive digital data can already be recorded today and decrypted once a powerful-enough quantum computer is available.

This brings us back to the cold war space race, now with many potential players shielded in the obscurity of cyberspace. Let's hope that, as with Apollo, the end result will be improvement for humankind. The international effort, led by the National Institute of Standards and Technology (NIST), to develop new quantum-resistant algorithms, as well as the development of quantum technologies, such as quantum random number generation and quantum-key distribution (QKD), to counter the very threat of the quantum computer, are steps in the right direction.

CSA's quantum-safe security working group has produced several research papers addressing many aspects of quantum-safe security that were discussed in both of these articles. These documents can help enterprises to better understand the quantum threat and steps they can start taking to address this coming threat.//
[...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/30/organizations-must-realign-to-face-new-cloud-realities/]] sur le blog de la CSA
!"//Information Security Management through Reflexive Security//"
<<<
[>img(150px,auto)[iCSA/J81PI.png]]//This document defines "Reflexive Security" as a new security management approach that is built upon the interrelationships between security, development and operations necessary for protecting the security stance and the deliverables of an organization.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j81r/|https://CloudSecurityAlliance.fr/go/j81r/]]''
!"//It's Time for Security Leadership to Embrace the Cloud-First Future//"
[>img(100px,auto)[iCSA/J89BA.jpg]]^^Bien que publié le 9 août 2019 sur le blog de la CSA, cet article l'a déjà été il y a 1 mois, le 1er août 2019 sur le site de la société Fugue.
Il faisait partie des articles déjà mentionnés dans notre [[veille datée du 4 août|2019.08.04 - Veille Hebdomadaire]] et signalé comme "à lire".
A noter que si le fait que l'article ait déjà été publié est enfin mentioné, le lien fourni est erroné...
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/08/09/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach/]] sur le blog de la Cloud Security Alliance ou [[l'original|https://www.fugue.co/blog/a-technical-analysis-of-the-capital-one-cloud-misconfiguration-breach]]^^

[img(25%,1px)[iCSF/BluePixel.gif]]
!Actualités, Blog, Publications et Veille "Sécurité du Cloud"
<<tiddler fAll2LiTabs with: 201907>>
<<tiddler fAll2Tabs10 with: VeilleM","_201907>>
<<tiddler fAll2LiTabs with: NewsL","201907>><<tiddler .ReplaceTiddlerTitle with: [[Newsletters - Juillet 2019]]>>
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>| Aucune alerte |
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Alertes et Vulnérabilités - Juillet 2019]]>>
<<tiddler .ReplaceTiddlerTitle with: [[Actualités - Juillet 2019]]>><<tiddler fAll2LiTabs with: Actu","201907>>
<<tiddler fAll2LiTabs with: Blog","201907>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Blog - Juillet 2019]]>>
<<tiddler fAll2LiTabs with: Publ","201907>>
[img(25%,1px)[iCSF/BluePixel.gif]]
<<tiddler .ReplaceTiddlerTitle with: [[Publications - Juillet 2019]]>>
!"//Use Cases for Blockchain Beyond Cryptocurrency//"
[>img(150px,auto)[iCSA/J7VBU.jpg]]Article de blog publié le 24 juillet, retiré le 25 juillet, puis publié définitivement le 31 juillet 2019
<<<
[<img(150px,auto)[iCSA/J7OBU.jpg]]//CSA's newest white paper, Documentation of Relevant Distributed Ledger Technology and Blockchain Use Cases v2 is a continuation of the efforts made in v1. The purpose of this publication is to describe relevant use cases beyond cryptocurrency for the application of these technologies.

In the process of outlining several use cases across discrete economic application sectors, we covered multiple industry verticals, as well as some use cases which cover multiple verticals simultaneously. For this document, we considered a use case as relevant when it provides the potential for any of the following:
* disruption of existing business models or processes;
* strong benefits for an organization, such as financial, improvement in speed of transactions, auditability, etc.;
* large and widespread application; and
* concepts that can be applied in real-world scenarios.

From concept to the production environment, we also identified six separate stages of maturity to get a better assessment of how much work has been done within the scope and how much more work remains to be done.
# Concept
# Proof of concept
# Prototype
# Pilot
# Pilot production
# Production
Some of the industry verticals which we identified are finance, supply chain, media/entertainment, and insurance, all of which are ripe for disruption from a technological point of view.
The document also clearly identified the expected benefits from the adoption of DLTs/blockchain in these use cases, type of DLT, use of private vs public blockchain, infrastructure provider-CSP and the type of services (IaaS, PaaS, SaaS). Identification of some other key features in the use case implementations such as Smart Contracts and Distributed Databases have also been outlined.

The working group hopes this document will be a valuable reference to all key stakeholders in the blockchain/DLT ecosystem, as well as contribute to its maturity.//
<<<
[img(25%,1px)[iCSF/BluePixel.gif]]
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/31/use-cases-for-blockchain-beyond-cryptocurrency/]] sur le blog de la CSA. /% 25 -> 31 %/
!"//Documentation of Relevant Distributed Ledger Technology and Blockchain Use Cases v2//"
<<<
[>img(150px,auto)[iCSA/J7OBU.jpg]]//Thanks to the rise in popularity of Bitcoin cryptocurrency, the innovative technologies of Blockchain and other systems of distributed ledger technology (DLT) have proven their ability to increase security of data during transactions and provide immutable long-term data storage. This document provides several use cases for this DLT technology outside of cryptocurrencies.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7vb/|https://CloudSecurityAlliance.fr/go/j7vb/]]''



!"//Organizations Must Realign to Face New Cloud Realities//"
[>img(150px,auto)[iCSA/J7UBO.jpg]]Article de blog publié le 30 juillet 2019 — Rédigé par Jim Reavis, Co-founder and Chief Executive Officer, CSA
<<<
//While cloud adoption is moving fast, many enterprises still underestimate the scale and complexity of cloud threats

Technology advancements often present benefits to humanity while simultaneously opening up new fronts in the on-going and increasingly complex cyber security battle. We are now at that critical juncture when it comes to the cloud: While the compute model has inherent security advantages when properly deployed, the reality is that any fast-growth platform is bound to see a proportionate increase in incidents and exposure.

The Cloud Security Alliance (CSA) is a global not-for-profit organization that was launched 10 years ago as a broad coalition to create a trusted cloud ecosystem. A decade later, cloud adoption is pervasive to the point of becoming the default IT system worldwide. As the ecosystem has evolved, so have the complexity and scale of cyber security attacks. That shift challenges the status quo, mounting pressure on organizations to understand essential technology trends, the changing threat landscape and our shared responsibility to rapidly address the resultant issues.

> {{{ A decade later, cloud adoption is pervasive to the point of becoming the default IT system worldwide. As the ecosystem has evolved, so have the complexity and scale of cyber security attacks. }}}

There are real concerns that organizations have not adequately realigned for the cloud compute age and in some cases, are failing to reinvent their cyber defense strategies. Symantec's inaugural Cloud Security Threat Report (CSTR) is a landmark report that shines a light on the current challenges and provides a useful roadmap that can help organizations improve and mature their cloud security strategy. The report articulates the most pressing cloud security issues of today, clarifies the areas that should be prioritized to improve an enterprise security posture, and offers a reality check on the state of cloud deployment.
Cloud in the Fast Lane

What the CSTR reveals and the CSA can confirm is that cloud adoption is moving too fast for enterprises, which are struggling with increasing complexity and loss of control. According to the Symantec CSTR, over half (54%) of respondents agree that their organization's cloud security maturity is not keeping pace with the rapid expansion of new cloud apps.

The report also revealed that enterprises underestimate the scale and complexity of cloud threats. For example, the CSTR found that most commonly investigated incidents included garden variety data breaches, DDOS attacks and cloud malware injections. However, Symantec internal data shows that unauthorized access accounts for the bulk of cloud security incidents (64%), covering both simple exploits as well as sophisticated threats such as lateral movement and cross-cloud attacks. Companies are beginning to recognize their vulnerabilities–nearly two thirds (65%) of CSTR respondents believe the increasing complexity of their organization's cloud infrastructure is opening them up to entirely new and dangerous threat vectors.

For example, identity-related attacks have escalated in the cloud, making proper identity and access management the fundamental backbone of security across domains in a highly virtualized technology stack. The speed with which cloud can be "spun up" and the often-decentralized manner in which it is deployed magnifies human errors and creates vulnerabilities that attackers can exploit. A lack of visibility into detailed cloud usage hampers optimal policies and controls.

> {{{ The report also revealed that enterprises underestimate the scale and complexity of cloud threats. }}}

As CSA delved into this report, we found strong alignment with the best practices research and education we advocate. As the CSTR reveals, a Zero Trust strategy, building out a software-defined perimeter, and adopting serverless and containerization technologies are critical building blocks for a mature cloud security posture.

The CSTR also advises organizations to develop robust governance strategies supported by a Cloud Center of Excellence (CCoE) to rally stakeholder buy-in and get everyone working from the same enterprise roadmap. Establishing security as a continuous process rather than front-loading efforts at the onset of procurement and deployment is a necessity given the frenetic pace of change.

As the CSTR suggests and we can confirm, security architectures must also be designed with an eye towards scalability, and automation and cloud-native approaches like DevSecOps are essential for minimizing errors, optimizing limited man power and facilitating new controls.

While there is a clear strategy for securing cloud operations, too few companies have embarked on the changes. Symantec internal data reports that 85% are not using best security practices as outlined by the Center for Internet Security (CIS). As a result, nearly three-quarters of respondents to the CSTR said they experienced a security incident in cloud-based infrastructure due to this immaturity.

> {{{ The CSTR is a pivotal first step in increasing that awareness. }}}

The good news is that the users of cloud have a full portfolio of solutions, including multi-factor authentication, data loss prevention, encryption and identity and authentication tools, at their disposal to address cloud security threats along with new processes and an educated workforce. The bad news is that many users of cloud are not aware of the full magnitude of their cloud adoption, the demarcation of the shared responsibility model and the inclination to rely on outdated security best practices. The CSTR is a pivotal first step in increasing that awareness.

Cloud is and will continue to be the epicenter of IT, and increasingly the foundation for cyber security. Understanding how threat vectors are shifting in cloud is fundamental to overhauling and modernizing an enterprise security program and strategy. CSA recommends the Symantec CSTR report be read widely and we look forward to future updates to its findings.

Download 2019 Cloud Security Threat Report >> https://resource.elq.symantec.com/LP=7326?inid=symc_cloud-security-threat-report_cstr_to_leadgen_form_LP-7326_cstr&CID=70138000001FlejAAC

Interested in learning more? You can watch our CloudBytes webinar with Jim Reavis, Co-Founder & CEO at Cloud Security Alliance, and Kevin Haley, Director Security Technology and Response at Symantec as they discuss the key findings from the 2019 Cloud Security Threat Report. Watch it here >>
//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/30/organizations-must-realign-to-face-new-cloud-realities/]] sur le blog de la CSA
!1 - Les nouveautés CSA de la semaine du 22 au 28 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Etat d'avancement du programme pilote FedSTAR''+++*[»]> <<tiddler [[2019.07.24 - Blog : Etat d'avancement du programme pilote FedSTAR]]>>=== 
* Actu : ''Best Practices for Implementing a Secure Application Container Architecture''+++*[»]> <<tiddler [[2019.07.26 - Actu : 'Cloud Security Alliance Releases Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
* Publication : ''Best Practices for Implementing a Secure Application Container Architecture''+++*[»]> <<tiddler [[2019.07.26 - Publication : 'Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.28 - Veille Hebdomadaire]] avec plus de 80 liens :
* Piratages et fuites de données : fuite FormGet, phishing O365, suites de l'attaque contre iNSYNQ
* Rapports et sondages : Checkpoint, Cyren/Osterman, PaloAlto Networks, RiskRecon/Cyentia, SkyBox, et Symantec
* Divers : suite du CLOUD Act, SSO et IAM dans le Cloud, importance des contrats Cloud, outils de tests, DarkWeb et MaaS
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.28|
|2019.07.28|ITwire|[[Email attacks having a major impact on businesses: study|https://www.itwire.com/security/email-attacks-having-a-major-impact-on-businesses-study.html]]|Report Barracuda|
|>|>|>|!2019.07.27|
|2019.07.27|Packt|![[Understanding security features in the Google Cloud Platform (GCP)|https://hub.packtpub.com/understanding-security-features-in-the-google-cloud-platform-gcp/]]|GCP|
|>|>|>|!2019.07.26|
|2019.07.26|CERT-EU|[[Cloud hosting firm iNSYNQ hit byransomware attack|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190726-1.pdf]]|Attacks Ransomware iNSYNQ|
|2019.07.26|Infosec Institute|[[Amazon Inspector: A cloud-based vulnerability assessment tool|https://resources.infosecinstitute.com/amazon-aws-inspector-walkthrough/]]|AWS Control|
|2019.07.26|Solutions Review|[[7 Cloud Security Best Practices to Keep Your Cloud Environment Secure|https://solutionsreview.com/cloud-platforms/7-cloud-security-best-practices-to-keep-your-cloud-environment-secure/]]|Best_Practices|
|2019.07.26|Forbes|[[Why Invest In Cloud-Based Machine Learning For Cybersecurity?|https://www.forbes.com/sites/extrahop/2019/07/26/why-invest-in-cloud-based-machine-learning-for-cybersecurity/]]|MachineLearning|
|2019.07.26|Center for Internet Security|[[Cleaning Out Your Old Data and Devices|https://www.cisecurity.org/newsletter/cleaning-out-your-old-data-and-devices/]]|Cleaning|
|2019.07.26|The Register|[[Don't fall into the trap of thinking you're safe and secure in the cloud. It could become a right royal pain in the SaaS|http://go.theregister.com/feed/www.theregister.co.uk/2019/07/26/secure_saas_in_the_smb/]]|SaaS|
|2019.07.26|//RiskRecon / Cyentia//|![[RiskRecon and Cyentia Institute: Definitive Study on Cloud Security Risk Quantifies Global Industry Exposure and Reveals Predictors of Cloud Success|https://blog.riskrecon.com/company/news-releases/definitive-study-on-cloud-security-risk-quantifies-global-industry-exposure]] ([[rapport|https://www.riskrecon.com/cloud-risk-surface-report]]|Report RiskRecon|
|2019.07.26|//TechBeacon / HP//|[[How to secure your cloud infrastructure: The 3 planes of OpSec|https://techbeacon.com/security/how-secure-your-cloud-infrastructure-3-planes-opsec]]|OpSec|
|2019.07.26|//Google Cloud//|[[Least privilege for Cloud Functions using Cloud IAM|https://cloud.google.com/blog/products/application-development/least-privilege-for-cloud-functions-using-cloud-iam/]]|GCP IAM|
|2019.07.26|//JumpCloud//|[[What is AWS SSO?|https://jumpcloud.com/blog/aws-sso/]]|AWS SSO|
|2019.07.26|BetaNews|[[Microsoft's web-based Outlook 365 is leaking users' IP addresses in emails|https://betanews.com/2019/07/26/microsoft-office-outlook-365-ip-leak/]]|O365 Data_Leak|
|2019.07.26|//Anchore//|[[Federal Container Security Best Practices - Unifying Configuration Management and Container Security with Anchore Enterprise|https://anchore.com/federal-container-security-best-practices-unifying-configuration-management-and-container-security-with-anchore-enterprise/]]|Containers Best_Practices|
|2019.07.26|SANS|[[How to Protect Enterprise Systems with Cloud-Based Firewalls|https://www.sans.org/reading-room/whitepapers/analyst/protect-enterprise-systems-cloud-based-firewalls-39085]]|Analysis Misc.|
|>|>|>|!2019.07.25|
|2019.07.25|CNet[>img[iCSF/flag_fr.png]]|[[Cloud computing : connaître les risques et savoir l'utiliser|https://www.cnetfrance.fr/produits/cloud-computing-connaitre-les-risques-et-savoir-l-utiliser-39762624.htm]]|Risks|
|2019.07.25|Les Numériques[>img[iCSF/flag_fr.png]]|[[Apple, Google, Microsoft, Dropbox... Quels sont les meilleurs services cloud ?|https://www.lesnumeriques.com/vie-du-net/apple-google-microsoft-dropbox-quels-sont-les-meilleurs-services-cloud-a138185.html]]|Misc|
|2019.07.25|CyberDefense Mag|[[Adapting Security Policies to Fit the Cloud Computing Era|https://www.cyberdefensemagazine.com/adapting-security-policies/]]|Security_Policy|
|2019.07.25|Bleeping Computer|[[Microsoft Office 365 Webmail Exposes User's IP Address in Emails|https://www.bleepingcomputer.com/news/microsoft/microsoft-office-365-webmail-exposes-users-ip-address-in-emails/]]|O365 Data_Leak|
|2019.07.25|TechCrunch|[[FormGet security lapse exposed thousands of sensitive user-uploaded documents|https://techcrunch.com/2019/07/25/formget-security-lapse-exposed-documents/]]|AWS S3 Bucket Data_Leak|
|2019.07.26|Cyware| → [[FormGet exposed company documents and customer data due to unsecured AWS S3 storage bucket|https://cyware.com/news/formget-exposed-company-documents-and-customer-data-due-to-unsecured-aws-s3-storage-bucket-5002fc3f]]|AWS S3 Bucket Data_Leak|
|2019.07.25|Solutions Review|[[What Is Software as a Service? A Beginner's Guide to SaaS|https://solutionsreview.com/cloud-platforms/what-is-software-as-a-service-a-beginners-guide-to-saas/]]|SaaS|
|2019.07.25|Cloud Native Computing Foundation|[[The 10 Most Viewed Videos from Past KubeCon + CloudNativeCons|https://www.cncf.io/blog/2019/07/25/the-10-most-viewed-videos-from-past-kubecon-cloudnativecons/]]|Kubernetes Conference|
|2019.07.25|FCW|[[Contracting, cloud essential to modernizing House IT|https://fcw.com/articles/2019/07/25/house-it-modernization.aspx]]|Contracting|
|2019.07.25|AccountingWeb|[[How to Manage Your Vendors for Better Security|https://www.accountingweb.com/technology/trends/how-to-manage-your-vendors-for-better-security]]|Third_Party|
|2019.07.25|Chef|![[Secure Your Cloud Estate with Continuous Audits|https://blog.chef.io/2019/07/25/secure-your-cloud-estate-with-continuous-audits/]]|Continuous_Audit|
|2019.07.25|LeMagIT[>img[iCSF/flag_fr.png]]|[[PRA en cloud : à quoi faut-il s'attendre ?|https://www.lemagit.fr/conseil/PRA-en-cloud-a-quoi-faut-il-sattendre]]|DRP|
|2019.07.25|//Checkpoint//|[[From Supply Chain to Email, Mobile and the Cloud, No Environment is Immune to Cyber Attacks|https://www.globenewswire.com/news-release/2019/07/25/1888032/0/en/Check-Point-Research-From-Supply-Chain-to-Email-Mobile-and-the-Cloud-No-Environment-is-Immune-to-Cyber-Attacks.html]]|Report Checkpoint|
|2019.07.25|//Checkpoint//| → [[Cyber Attack Trends: Annual Report 2019 1H (téléchargement)|https://pages.checkpoint.com/cyber-attack-2019-trends.html]]|Report Checkpoint|
|2019.07.25|IT Social[>img[iCSF/flag_fr.png]]| → [[Cloud public : une sécurité à renforcer|https://itsocial.fr/enjeux/cloud-computing/cloud-public-prive-hybride/cloud-public-securite-a-renforcer-2/]]|Public_Cloud|
|2019.07.25|//Managed Methods//|[[Cloud Application Security Checklist|https://managedmethods.com/blog/cloud-application-security-checklist/]]|Checklist|
|2019.07.25|//RedScan//|[[The rise of Office 365 phishing scams: How one compromised account can cost millions|https://www.cloudcomputing-news.net/news/2019/jul/25/rise-office-365-phishing-scams-how-one-compromised-account-can-cost-millions/]]|O365 Phishing|
|2019.07.25|//Azure//|[[Azure publishes guidance for secure cloud adoption by governments|https://azure.microsoft.com/en-us/blog/azure-publishes-guidance-for-secure-cloud-adoption-by-governments/]] ([[document|https://aka.ms/AzureWWPS]])|Azure Guidance Government|
|2019.07.25|//Lastline//|[[Built-in Cloud Security Controls Essential to Securing an Expanded Network, Assert CISOs|https://www.lastline.com/blog/built-in-cloud-security-controls-essential-to-securing-an-expanded-network-assert-cisos/]]|Controls|
|2019.07.25|//CloudCheckr//|[[Your Organization's Role in the Shared Responsibility Model|https://cloudcheckr.com/document/shared-responsibility-model/]] (après incription)|Shared_Responsibility|
|2019.07.25|//JumpCloud//|[[Azure AD LDAP Server|https://jumpcloud.com/blog/azure-ad-ldap-server/]]|AzureAD LDAP|
|>|>|>|!2019.07.24|
|2019.07.24|CERT-EU|[[Hacking groups compete for cryptojacking cloud-based infrastructure|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190514-1.pdf]]|CryptoJacking|
|2019.07.24|CERT-EU|[[Docker breach exposes a significant number of accounts|https://media.cert.europa.eu/static/MEMO/2019/TLP-WHITE-CERT-EU-MEMO-190430-1.pdf]]|Breach Docker|
|2019.07.24|DZone|![[AWS Resources That Should Be Backed Up|https://dzone.com/aricles/aws-resources-that-should-be-backed-up-and-how-to]]|AWS BackUps|
|2019.07.24|DZone|[[Serverless Multi-Tier Architecture on AWS|https://dzone.com/articles/serverless-multi-tier-architecture-on-aws]]|AWS Serverless|
|2019.07.24|DZone|[[Cloud vs. On-Premise Software Deployment - What's Right for You? |https://dzone.com/articles/cloud-vs-on-premise-software-deployment-whats-righ]]|Misc|
|2019.07.24|DZone|[[Top 10 AWS Architect Interview Questions 2019|https://dzone.com/articles/top-10-aws-architect-interview-questions-2019]]|AWS|
|2019.07.24|TechRepublic|[[How to prevent unsigned Docker images from being pulled|https://www.techrepublic.com/article/how-to-prevent-unsigned-docker-images-from-being-pulled/]]|Docker|
|2019.07.24|//PaloAlto Networks//|![[Cloudy with a Chance of Entropy|https://www.paloaltonetworks.com/resources/research/unit42-cloud-with-a-chance-of-entropy]] ([[rapport|https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/research/unit42-cloud-with-a-chance-of-entropy]])|Report PaloAlto Misconfigurations|
|2019.07.24|SiliconAngle| → [[Report finds 34M vulnerabilities across AWS, Google Cloud and Azure|https://siliconangle.com/2019/07/24/report-finds-34m-vulnerabilities-across-aws-google-cloud-azure/]]|AWS Azure GCP Containers Vulnerabilities|
|2019.07.25|Global Security Mag[>img[iCSF/flag_fr.png]]| → [[Palo Alto Networks identifie plus de 34 millions de vulnérabilités dans les ressources AWS, Azure et GCP|http://www.globalsecuritymag.fr/Palo-Alto-Networks-identifie-plus,20190725,89448.html]]|AWS Azure GCP Containers Vulnerabilities|
|2019.07.26|CSO| → [[Over a quarter of cloud loads have been compromised by cryptojackers|https://www.cso.com.au/article/664586/over-quarter-cloud-loads-been-compromised-by-cryptojackers/]]|AWS Azure GCP Containers Vulnerabilities|
|2019.07.24|//Avanan//|[[Office 365 Credential Validator Phishing Attack|https://www.avanan.com/resources/office-365-credential-validator-phishing-attack]]|O365 Phishing|
|2019.07.24|HelpNet Security| → [[Phishers targeting Office 365 admins have a new trick up their sleeve|https://www.helpnetsecurity.com/2019/07/24/phishers-targeting-office-365-admins/]]|O365 Phishing|
|2019.07.24|//Rapid7//|[[Why the Modern SIEM Is in the Cloud|https://blog.rapid7.com/2019/07/24/why-the-modern-siem-is-in-the-cloud/]]|SIEM|
|2019.07.24|//ResearchAndMarkets//|[[Global Cyber Security Markets to 2025 - Growing Use of Cloud-Based Security Solutions|https://www.globenewswire.com/news-release/2019/07/24/1887393/0/en/Global-Cyber-Security-Markets-to-2025-Growing-Use-of-Cloud-Based-Security-Solutions.html]]|Report|
|2019.07.24|//SkyBox Security//|[[Cloud Container Vulnerabilities Soar, According to Report|https://www.bloomberg.com/press-releases/2019-07-24/skybox-security-cloud-container-vulnerabilities-soar-according-to-report]]|Report SkyBox|
|2019.07.25|Le Big Data[>img[iCSF/flag_fr.png]]| → [[Containers Cloud : les risques de cybersécurité ont crû 240% en 2 ans|https://www.lebigdata.fr/containers-cloud-risques-cybersecurite]]|Report SkyBox|
|2019.07.25|Forbes| → [[Why Cloud Computing Cyber Security Risks Are On The Rise: Report|https://www.forbes.com/sites/jeanbaptiste/2019/07/25/why-cloud-computing-cyber-security-risks-are-on-the-rise-report/]]|Report SkyBox|
|2019.07.24|//Alibaba Cloud//|[[8220 Mining Group Now Uses Rootkit to Hide Its Miners|https://medium.com/@Alibaba_Cloud/8220-mining-group-now-uses-rootkit-to-hide-its-miners-15d6c571cdb3]]|CryptoMining|
|2019.07.24|SANS|[[JumpStart Guide for Cloud-Based Firewalls in AWS|https://www.sans.org/reading-room/whitepapers/analyst/jumpstart-guide-cloud-based-firewalls-aws-39080]]|Analysis Misc.|
|>|>|>|!2019.07.23|
|2019.07.23|Journal du Net[>img[iCSF/flag_fr.png]]|[[Les participants des Rencontres du Cloud en interviews|https://www.journaldunet.com/solutions/cloud-computing/1441766-interviews-les-rencontres-du-cloud/]]|Conference|
|2019.07.23|Bleeping Computer|[[Microsoft to Improve Office 365 Malicious Email Analysis|https://www.bleepingcomputer.com/news/security/microsoft-to-improve-office-365-malicious-email-analysis/]]|O365 Detection|
|2019.07.23|CBR Online|[[Docker Enterprise 3.0: What's New?|https://www.cbronline.com/news/docker-enterprise-3-0-whats-new]]|Docker|
|2019.07.23|DZone|[[Understanding Dockerfile|https://dzone.com/articles/understanding-dockerfile]]|Docker|
|2019.07.23|GeekWire|[[Microsoft-owned LinkedIn is moving to the public cloud, and guess which platform it's choosing?|https://www.geekwire.com/2019/microsoft-owned-linkedin-moving-public-cloud-guess-platform-choosing/]]|Azure LinkedIn|
|2019.07.23|SecurityWeek|[[Attackers Turn Elasticsearch Databases Into DDoS Bots|https://www.securityweek.com/attackers-turn-elasticsearch-databases-ddos-bots]]|Attacks ElasticSearch|
|2019.07.23|CyberSecurity Insiders|[[Ways to help keep Cloud Security intact in the finance industry|https://www.cybersecurity-insiders.com/ways-to-help-keep-cloud-security-intact-in-the-finance-industry/]]|Misc|
|2019.07.23|//OVH//[>img[iCSF/flag_fr.png]]|[[Pourquoi il faut choisir le cloud européen|https://www.lesechos.fr/idees-debats/cercle/pourquoi-il-faut-choisir-le-cloud-europeen-1039819]]|CLOUD_Act|
|2019.07.23|//Rhino Security Labs//|[[AWS IAM Privilege Escalation|https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation]]|AWS IAM Privilege_Escalation|
|2019.07.23|//SecurityIntelligence / IBM//|[[What's New in the 2019 Cost of a Data Breach Report|https://securityintelligence.com/posts/whats-new-in-the-2019-cost-of-a-data-breach-report/]]|Report DataBreach|
|2019.07.23|//MDSec//|![[Introducing the Office 365 Attack Toolkit|https://www.mdsec.co.uk/2019/07/introducing-the-office-365-attack-toolkit/]]|O365 Tools|
|2019.07.23|//NetApp//|[[Challenges and Solutions of File Services in the Cloud Architecture|https://pupuweb.com/file-services-cloud-computing/]]|Misc|
|2019.07.23|//PaloAlto Networks//|[[4 Practical Steps for 'Shift Left' Security|https://blog.paloaltonetworks.com/2019/07/4-practical-steps-shift-left-security/]]|DevSecOps|
|2019.07.23|//Managed Methods//|[[Cloud Application Security Architecture for SaaS Security|https://managedmethods.com/blog/cloud-application-security-architecture/]]|Architecture|
|2019.07.23|//CyberDB//|[[Ten tips for better AWS cyber security|https://www.cyberdb.co/ten-tips-better-aws-cyber-security/]]|AWS Best_Practices|
|>|>|>|!2019.07.22|
|2019.07.22|DisruptOps|[[Dev, Sec and Ops: Communications Breakdown|https://disruptops.com/dev-sec-and-ops-communications-breakdown/]]|DevSecOps|
|2019.07.22|MSSP Alert|[[Hackers Attacking Misconfigured AWS S3 Cloud Buckets|https://www.msspalert.com/cybersecurity-breaches-and-attacks/aws-s3-bucket-data-leaks/]]|AWS_S3 Data_Leaks|
|2019.07.22|Dechert|[[Actual Impact of 2018 U.S. CLOUD Act Still Hazy|https://info.dechert.com/10/12598/july-2019/actual-impact-of-2018-u.s.-cloud-act-still-hazy.asp?sid=0a005ac3-1df4-43c4-a944-f723188079ce]]|CLOUD_Act|
|2019.07.22|Fox Rothschild|![[EU Agencies Issue Joint Response On Impact Of US CLOUD Act|https://dataprivacy.foxrothschild.com/2019/07/articles/european-union/gdpr/eu-agencies-issue-joint-response-on-impact-of-us-cloud-act/]]|CLOUD_Act|
|2019.07.22|Dark Reading|[[How Cybercriminals Break into the Microsoft Cloud|https://www.darkreading.com/cloud/how-cybercriminals-break-into-the-microsoft-cloud/d/d-id/1335314]]|Azure Attacks Conference|
|2019.07.22|Rick's Cloud|[[Multi-cloud strategy: battle of the clouds or the strongest alliance ever?|https://rickscloud.com/multi-cloud-strategy-battle-of-the-clouds-or-the-strongest-alliance-ever/]]|Multi_Cloud|
|2019.07.22|DZone|[[Microsoft Azure vs. Amazon Web Services: A Cloud Platform Comparison|https://dzone.com/articles/microsoft-azure-vs-amazon-web-services-a-cloud-pla]]|AWS Azure|
|2019.07.22|Kitploit|[[Dockernymous - A Script Used To Create A Whonix Like Gateway/Workstation Environment With Docker Containers |https://www.kitploit.com/2019/07/dockernymous-script-used-to-create.html]]|Docker Tools|
|2019.07.22|SiliconAngle|[[Zscaler transforms IT security from "castle and moat" to direct access via the cloud |https://siliconangle.com/2019/07/22/zscaler-transforms-security-castle-moat-direct-access-via-the-cloud-cubeconversations/]]|Misc|
|2019.07.22|//iNSYNQ//|![[Update: We're beginning to turn on customer desktops|https://blog.insynq.com/blog/update-were-beginning-to-turn-on-customer-desktops]]|Attacks Ransomware iNSYNQ|
|2019.07.22|SC Magazine| → [[Cloud-hosting firm iNSYNQ shut down by MegaCortex ransomware|https://www.scmagazine.com/home/security-news/ransomware/cloud-hosting-firm-insynq-shut-down-by-megacortex-ransomware/]]|Attacks Ransomware iNSYNQ|
|2019.07.23|InfoRiskToday| → [[iNSYNQ Continues Recovery From MegaCortex Ransomware Attack|https://www.inforisktoday.com/insynq-continues-recovery-from-megacortex-ransomware-attack-a-12816]]|Attacks Ransomware iNSYNQ|
|2019.08.08|AccountingToday| → [[Inside the Insynq attack: 'We had to assume they were listening'|https://www.accountingtoday.com/news/inside-the-insynq-ransomware-attack-we-had-to-assume-they-were-listening]]|Attacks Ransomware iNSYNQ|
|2019.07.22|//SecurityIntelligence / IBM//|![[The Dark Web Market Is Moving Toward IaaS and MaaS - Here's Why|https://securityintelligence.com/posts/the-dark-web-market-is-moving-toward-iaas-and-maas-heres-why/]]|DarkWeb IaaS MaaS|
|2019.07.22|//Stackrox//|[[Kubernetes Security 101 - Everything You Must Know to Secure k8s|https://www.stackrox.com/post/2019/07/kubernetes-security-101/]]|Kubernetes|
|2019.07.22|//Cyren//|[[Office 365 Email Security in the Enterprise: 2019 Benchmarking Survey|https://www.cyren.com/201906_RPT_O365_EmailSec_Survey]]|Report Cyren Osterman|
|2019.07.22|ZDnet| → [[40% of enterprises experienced Office 365 credential theft, report finds|https://www.techrepublic.com/article/40-of-enterprises-experienced-office-365-credential-theft-report-finds/]]|Report Cyren Osterman|
|2019.07.22|//Azure//|[[What's the difference between Azure Monitor and Azure Service Health?|https://azure.microsoft.com/en-us/blog/what-s-the-difference-between-azure-monitor-and-azure-service-health/]]|Azure Monitor|
|2019.07.22|//Tripwire//|[[Using AWS Session Manager with Enhanced SSH and SCP Capability|https://www.tripwire.com/state-of-security/security-data-protection/cloud/aws-session-manager-enhanced-ssh-scp-capability/]]|AWS SSH SCP|
|2019.07.22|//iland Internet//|[[Choosing A Cloud Provider for VMware Workloads? Ask These Questions First|https://cloudtweaks.com/2019/07/choosing-a-cloud-provider-vmware-workload/]]|VMware|
|2019.07.22|//eXemplify//|[[Security in the Cloud: Who's Responsible?|http://www.exemplifygroup.com/security-in-the-cloud-whos-responsible/]]|Misc|
|2019.07.22|//Checkpoint//|[[Secure your AWS, Azure and Google Environment Automatically with CloudBots|https://blog.checkpoint.com/2019/07/22/secure-your-aws-azure-and-google-environment-automatically-with-cloudbots/]]|CloudBots|
|2019.07.22|//Symantec//|[[How Immature Security Practices Complicate Cloud Migration|https://www.symantec.com/blogs/expert-perspectives/how-immature-security-practices-complicate-cloud-migration]]|Report Symantec|
|2019.07.26|IT World Canada| → [[More than 90% of security decision-makers fail to keep tabs on workloads in the cloud |https://www.itworldcanada.com/article/more-than-90-of-security-decision-makers-fail-to-keep-tabs-on-workloads-in-the-cloud/420387]]|Report Symantec|
|2019.08.09|Health Data Management|[[As cloud use rises among payers, so do cybersecurity concerns|https://www.healthdatamanagement.com/news/as-cloud-use-rises-among-payers-so-do-cybersecurity-concerns]]|Report Symantec|
!"//Cloud Security Alliance Releases Best Practices for Implementing a Secure Application Container Architecture//"
[>img(150px,auto)[iCSA/J7QPB.png]]Annonce de la CSA publiée le 26 juillet 2019.
<<<
//SEATTLE - July 26, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released Best Practices for Implementing a Secure Application Container Architecture. Produced by the CSA's ''Application Containers and Microservices Working Group'', this paper is the second in a series of reports covering the securing of app containers and microservices and offers detailed recommendations and best practices to address the challenges laid out in the recently released "[[CSA Releases Research Identifying Challenges in Securing Application Containers and Microservices|2019.07.16 - Actu : 'CSA Releases Research Identifying Challenges in Securing Application Containers and Microservices']]".

Increasingly, enterprises are migrating to the cloud, and unsurprisingly, the number of stakeholders and their unique needs are growing at an exponential rate. Common ground is needed, then, to ensure that developers, operators, and architects are able to efficiently -- and effectively -- address the myriad components involved in application container architecture. Recognizing this, CSA is producing a series of white papers to facilitate secure migration to the crowd.

The paper was developed through extensive collaboration among a diverse group of participants with strong knowledge and practical experience in information security, operations, application containers, and microservices. Among the risks covered are: code promotion across environments, securing the host, container continuous monitoring from the platform/host, container networking, validating the integrity and security quality of the image, container forensics, trust chain through containers, container volume and secret management, platform and container management, and container encryption.

"Application containers and microservices architecture are being used to design, develop, and deploy applications, leveraging agile software development approaches such as development operations. Couple this with the fact that application containers and microservices have unique characteristics -- each with distinct security ramifications based on the stakeholder -- it's vital that security is embedded into the software development process," said Andrew Wild, Container and Microservices Working Group Co-chair. "It's CSA's hope that this document will serve as a springboard for careful examination and discussion of how to best secure application containers."//
[...]
<<<
&rArr; Lire [[la suite|https://cloudsecurityalliance.org/articles/csa-releases-best-practices-for-implementing-a-secure-application-container-architecture/]] sur le site de la CSA
!"//Best Practices for Implementing a Secure Application Container Architecture//"
<<<
[>img(150px,auto)[iCSA/J7QPB.png]]//Application containers and a microservices architecture are being used to design, develop and deploy applications leveraging agile software development approaches such as Development Operations. Security needs to be embedded into these software development approaches. This document serves to identify recommendations and best practices to address the challenges in securing application containers in the engineering of trustworthy secure systems through the lens of the Developer, Operator and Architect.//
<<<
__Table des matières :__
<<<
|TablNoBord|k
|.|Abstract|
|.|Acknowledgements|
|.|Executive Summary|
|1.|Introduction|
|1.1.|Purpose and Scope|
|1.2.|Document Structure|
|1.3.|Audience|
|2.|Application Container and Microservices|
|3.|Application Container Mitigations for Challenges|
|3.1.|Code Promotion Across Environments|
|3.2.|Securing the Host|
|3.3.|Container Continuous Monitoring from the Platform/Host|
|3.4.|Container Networking - Communications between Host and Container|
|3.5.|Container Networking - Communications between Containers|
|3.6.|Validate Integrity and Security Quality of the Image|
|3.7.|Container Forensics|
|3.8.|Trust Chain through Containers|
|3.9.|Container Volume Management|
|3.10.|Container Secret Management|
|3.11.|Platform Management - Notification of Lifecycle Events|
|3.12.|Platform Management - Resource Request|
|3.13.|Platform Management - Container Resource Management|
|3.14.|Container Management - Scaling Container Resources|
|3.15.|Container Management - Data Backups and Replication|
|3.16.|Container Management - Container rehosting between CMPs|
|3.17.|Container Encryption|
|.|Appendix A - Acronyms|
|.|Appendix B - Glossary|
|.|Appendix C - References|
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7qc/|https://CloudSecurityAlliance.fr/go/j7qc/]]'' 
|!Juillet|!Sources|!Titres et Liens|!Synthèses|
|2019.07.26|CSA|[[Cloud Security Alliance Releases Best Practices for Implementing a Secure Application Container Architecture|https://cloudsecurityalliance.org/articles/csa-releases-best-practices-for-implementing-a-secure-application-container-architecture/]]|Second report in series provides mitigation options for 18 possible risks surrounding integration of application containers into trustworthy, secure systems|
|2019.07.16|CSA|[[Cloud Security Alliance Releases New Research Identifying Challenges in Securing Application Containers and Microservices|https://cloudsecurityalliance.org/articles/csa-releases-new-research-indentifying-challenges-in-securing-application-containers-and-microservices/]]|Report identifies challenges in securing application containers and microservices through the lens of the developer, operator and architect|
|2019.07.12|CSA|[[Cloud Security Alliance Releases Cloud Penetration Testing Playbook|https://cloudsecurityalliance.org/articles/cloud-security-alliance-releases-cloud-penetration-testing-playbook/]]|Reports provides foundation for public cloud penetration testing methodology|
|2019.07.02|CSA|[[Cloud Security Alliance Congress EMEA 2019 Call for Papers - Deadline Extended|https://cloudsecurityalliance.org/articles/csa-congress-emea-2019-call-for-papers-deadline-extended/]]|Papers examining new frontiers accelerating change in information security are sought|
!"//FedSTAR Pilot Program Status//"
[>img(150px,auto)[iCSA/J7OBF.jpg]]Article de blog publié le 24 juillet 2019
<<<
/%
À mesure que l'utilisation de la technologie cloud s'est généralisée, l'inquiétude suscitée par la sécurité du cloud s'est accrue. Les agences gouvernementales et les utilisateurs du secteur privé se préoccupent de la protection des données et de la disponibilité des services. De nombreux pays et entités privées ont conçu et mis en œuvre des programmes de sécurité pour accroître le niveau d'assurance et de confiance des services en nuage. En conséquence, plusieurs programmes de certification et d'accréditation ont été créés. En 2019, plus de 40 systèmes de certification de sécurité différents ont été développés et mis en œuvre dans le monde entier, y compris le programme CSA STAR.
D'une part, l'introduction de systèmes de certification et d'accréditation a simplifié la création de relations de confiance entre les fournisseurs de services dans le cloud (CSP) et les clients et, par conséquent, rationalisé les processus d'approvisionnement. D'autre part, la multiplication des schémas de certification a pour effet secondaire de générer une fatigue liée à la conformité. Ce problème a un impact significatif sur les ressources que les services de cloud computing doivent appliquer à la sécurité. De nombreux fournisseurs de services de contrôle ont un personnel dédié à la conformité aux multiples certifications de sécurité qui régissent leurs services. En plus de peser lourdement sur les CSP existants, la nécessité de se conformer à plusieurs certifications de sécurité est un obstacle majeur à l'entrée sur le marché des nouveaux CSP.
Il y a environ 18 mois, CSA a commencé à travailler avec le bureau du programme FedRAMP de la US General Services Administration sur l'idée de FedSTAR, un programme destiné à faciliter la reconnaissance des programmes FedRAMP et STAR. Le projet FedSTAR fait partie d'une initiative plus vaste de la CSA visant à faire évoluer STAR vers un cadre mondial permettant la reconnaissance multipartite de la certification nationale, internationale et spécifique à un secteur.
Il existe un programme équivalent à FedSTAR en Europe avec le projet EU-SEC. Le CSA a introduit l'idée d'une reconnaissance multipartite auprès de la communauté des parties prenantes, ce qui suscite beaucoup d'intérêt, tant de la part du gouvernement que du secteur privé.
Les projets FedSTAR et EU-SEC ont deux objectifs principaux:
* Construire une base pour la reconnaissance mutuelle entre la certification de sécurité, les attestations et les accréditations nationales, internationales et sectorielles
* Accorder une certification de confiance reconnue par les CSP et les clients
* Réduire les coûts de mise en conformité pour les CSP qui veulent satisfaire aux exigences de l'industrie et du gouvernement
* Exigences de support pour la surveillance continue
La solution à ce problème mondial n'est pas d'établir un nouveau système de certification de sécurité avec différents processus, preuves de conformité et contrôles à la source. FedSTAR vise plutôt à mettre au point un processus favorisant la reconnaissance mutuelle entre le gouvernement fédéral américain FedRAMP et le CSA STAR. La solution repose sur le fait que FedRAMP et CSA STAR s'appuient sur des ensembles de contrôles sanctionnés et largement utilisés en tant que source de conformité en matière de sécurité.
Le but de FedSTAR est qu'une fois que la société a obtenu la certification STAR ou l'autorisation d'exploitation de FedRAMP, elle ne peut obtenir cette certification qu'en auditant le delta de contrôles définissant les écarts entre les exigences de FedRAMP Moderate et de Cloud Control Matrix (CCM). ). À cet effet, l'équipe d'audit de FedSTAR serait obligée d'obtenir les accréditations du vérificateur principal de la certification STAR et des professionnels 3PAO.




%/ //As the use of cloud technology has become more widespread, the concern about cloud security has increased. Government agencies and private sector users are concerned with protecting data and ensuring service availability. Many countries and private entities have designed and implemented security programs to increase the level of assurance and trust of cloud services. As a result, multiple certifications and accreditation programs were created. As of 2019, over 40 different security certification systems have been developed and implemented worldwide, including the CSA STAR program.
On the one hand, the introduction of certification and accreditation systems has simplified the creation of trusted relationships between Cloud Services Providers (CSPs) and customers and consequently streamlined the procurement processes. On the other hand, the proliferation of certification schemas has the side effect of generating compliance fatigue. This issue is having a significant impact on the resources that cloud services must apply to security. Many CSPs have dedicated staff for ensuring compliance with multiple security certifications governing their services. In addition to being a resources drain on existing CSPs, the need to comply with multiple security certifications is a major obstacle to market entry for new CSPs.
About 18 months ago, CSA began working with the FedRAMP program office at the U.S. General Services Administration on the idea of FedSTAR, a program to facilitate the recognition between FedRAMP and STAR programs. The FedSTAR project is part of a larger CSA initiative aimed at evolving STAR to a global framework for multiparty recognition of national, international, and sector-specific certification.
There is an equivalent program to FedSTAR in Europe with the EU-SEC project. CSA introduced the idea of multiparty recognition to the stakeholder community, and there has been a lot of interest from both the government and private sectors.
Both FedSTAR and EU-SEC projects have four primary goals:
* Build a foundation for mutual recognition between national, international and sector-specific security certification, attestations and accreditations
* Grant a trusted certification that is recognized by CSPs and customers
* Reduce the compliance cost for CSPs that want to meet the requirements of both industry and government
* Support requirements for continuous monitoring
The solution to this global problem is not to establish a new security certification system with different processes, evidence of compliance, and source controls. Rather, FedSTAR aims to develop a process that supports mutual recognition between the U.S. Federal government FedRAMP and CSA STAR. The solution is based on the fact that both FedRAMP and CSA STAR are grounded in sanctioned, widely-used sets of controls as the source of security compliance.
The goal of FedSTAR is that once a company has achieved either STAR Certification or FedRAMP authorization to operate, that company can obtain the other certification only by auditing the delta of controls that defines the gaps between the requirements of FedRAMP Moderate and Cloud Control Matrix (CCM). In support of this, the FedSTAR auditing team would be required to have both the STAR Certification Lead Auditor and 3PAO professional accreditations.
[>img(500px,auto)[iCSA_/J7OFPPS.png]]
/%
Bien que STAR Certification et FedRAMP ne soient pas compatibles en l'état, ils ont des éléments de base communs, notamment le niveau de maturité de chaque programme, l'exigence d'évaluateurs tiers indépendants et l'utilisation d'examens basés sur le contrôle.
Notre hypothèse de travail, basée sur les recherches initiales, est que la reconnaissance mutuelle entre les deux systèmes serait facile à établir en raison du chevauchement des certifications FedRAMP Moderate et CSA CCM.
Ces facteurs ont conduit à notre décision de codifier les processus et de mesurer le niveau d'effort requis pour qu'un CSP passe de la certification modérée FedRAMP à la certification CSA STAR.

''Où sommes-nous actuellement?''
* Nous avons développé une analyse des écarts entre CSA STAR et FedRAMP modérée
* Nous avons mis en place un ensemble de mesures visant à quantifier le temps, le personnel et les autres ressources nécessaires pour obtenir une certification CSA STAR après avoir reçu une autorisation modérée d'exploitation de FedRAMP.
* Nous avons identifié un CSP qui a accepté d'inclure une évaluation de certification CSA STAR dans son examen annuel de la conformité à FedRAMP. cet effort débutera à la fin de l'été 2019. Ce sera notre premier projet pilote.

'' Mesures du succès ''
La CSA part de l'hypothèse de travail selon laquelle il lui faudra déployer des efforts minimes pour obtenir une certification CSA STAR à partir d'un ATO FedRAMP Moderate. Cependant, cette hypothèse doit être validée. Par conséquent, en collaboration avec les membres de la communauté des évaluateurs indépendants tiers, nous avons défini un ensemble de mesures que les participants pilotes ont accepté de collecter. Ces mesures incluent des critères qualitatifs et quantitatifs.
# Disponibilité / temps de préparation - Mesure quantitative permettant de comprendre les efforts requis par l'audité pour se préparer à un audit de certification STAR à partir d'un poste de FedRAMP Conformité moyenne - exprimée en nombre de jours-homme
# Temps d'audit - Mesure quantitative du temps requis pour obtenir la certification STAR? Quels sont les efforts nécessaires pour la préparation de la documentation et l'évaluation 3PAO?
# Exactitude de la cartographie et de l'analyse des écarts - CSA a fourni une "analyse de la cartographie et des écarts CCM-FedRAMP" à l'appui de cet effort. Nous demandons des commentaires sur l'utilité de la carte et l'efficacité des "contrôles compensatoires" proposés par la CSA.
# Réutilisation des preuves d'audit - Identification des documents et des preuves créés lors d'un audit FedRAMP pouvant être appliqués aux exigences de CCM V3.0.1
# Base de compétences - Quelles sont les compétences requises pour effectuer un audit FedRAMP à CSA STAR? Le CSP devait-il fournir des compétences supplémentaires pour obtenir la certification STAR?
# Le pilote recueillera également des informations sur les outils fournis pour faciliter son exécution.

''Prochaines étapes''
Le moment est maintenant critique pour le projet FedSTAR. Nous avons effectué la planification et le développement de l'infrastructure appropriés. Nos séances d'information sur le programme - réalisées en collaboration avec FedRAMP - ont suscité l'intérêt de la communauté du cloud. Le moment est venu d'exécuter les projets pilotes et d'analyser les résultats. Un programme pilote débutera à la fin de l'été 2019.
* Besoin de CSP supplémentaires pour s'inscrire pour participer au programme
* Nécessité de créer un groupe de discussion pour examiner les résultats du projet pilote et guider le programme
%/
While STAR Certification and FedRAMP are not compatible as deployed, they have basic elements in common including the level of maturity of each program, the requirement for independent 3rd party assessors and the use of control-based reviews.
Our working assumption, based on initial research, is that the mutual recognition between the two systems would be easy to establish because of the overlap between the FedRAMP Moderate and CSA CCM certifications.
These factors led to our decision to codify processes and measure the level of effort required for a CSP to go from FedRAMP moderate certification to CSA STAR certification.

''Where are we now?''
* We have developed a gap analysis between CSA STAR and FedRAMP moderate
* We have established a set of measures designed to quantify the time, staff and other resources needed to obtain a CSA STAR certification after receiving a FedRAMP moderate authorization to operate
* We have identified one CSP who has agreed to include a CSA STAR certification assessment in its annual review for FedRAMP compliance; this effort will begin in late summer 2019. This will be our first pilot.

''Measures of Success''
CSA has the working assumption that it will require a minimal level of effort to receive a CSA STAR certification starting from a FedRAMP Moderate ATO. However, this hypothesis must be validated. Therefore, working with members of the Third Party Independent Assessor community, we have established a set of measures that pilot participants have agreed to collect. These measures include both qualitative and quantitative criteria.
# Readiness/Preparation time - Quantitative measure to understand the effort required by the auditee to prepare for a STAR Certification audit starting from a position of FedRAMP Moderate compliance - expressed in the number of man-days
# Audit time - Quantitative measure of the time required to get the STAR certification? Specifically what effort is needed for documentation preparation and 3PAO assessment
# Accuracy of the mapping and gap analysis - CSA has provided a "CCM-FedRAMP Mapping and Gap Analysis" to support this effort. We are asking for comments on the usefulness of the Map and the effectiveness of the "compensating controls" suggested by CSA
# Re-use of audit evidences - Identification of those documents and evidences created during a FedRAMP audit that can be applied to the requirements of CCM V3.0.1
# Skill Base - What are the skills required to complete a FedRAMP to CSA STAR audit? Were there additional skills that the CSP need to provide to complete the STAR Certification?
# The pilot will also collect information on the tools provided to facilitate pilot execution.

''Next Steps''
Now is a critical time for the FedSTAR project. We have done the appropriate planning and infrastructure development. Our briefings on the program - done in conjunction with FedRAMP - have generated interest in the cloud community. The time is right to execute the pilots and analyze the results. One pilot program will begin in late Summer 2019.
* Need additional CSPs to sign-up to participate in the program
* Need to establish a Focus Group to review pilot results and guide the program
//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/24/fedstar-pilot-program-status/]] sur le blog de la CSA
!1 - Les nouveautés CSA de la semaine du 15 au 21 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Shift Left' to Harden Your Cloud Security Posture''+++*[»]> <<tiddler [[2019.07.18 - Blog : 'Shift Left to Harden Your Cloud Security Posture']]>>=== 
* Blog : ''Partage d'expérience Cloud dans le Secteur Financier''+++*[»]> <<tiddler [[2019.07.19 - Blog : Partage d'expérience Cloud dans le Secteur Financier]]>>=== 
* Publication : ''Best Practices for Implementing a Secure Application Container Architecture''+++*[»]> <<tiddler [[2019.07.16 - Publication : 'Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.21 - Veille Hebdomadaire]] avec une cinquantaine de liens :
* Piratages et fuites de données : nouvelle attaque de raçongiciel chez un prestataire Cloud (iNSYNQ)
* Rapports et sondages : Alcide, Bitglass, Blackblaze, Duo Security, Gartner, Synopsys
* Divers : OVH en cours de qualification SecNumCloud, Docker, tests d'intrusion
!3 - Agenda
* ''28 __juillet__'' : __''Dernière semaine''__ pour soumettre une proposition pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.21|
|2019.07.21|Bleeping Computer|[[Phishers Target Office 365 Admins with Fake Admin Alerts|https://www.bleepingcomputer.com/news/security/phishers-target-office-365-admins-with-fake-admin-alerts/]]|O365 Phishing|
|>|>|>|!2019.07.20|
|2019.07.20|0x00sec|[[A Blue Team guide to AWS Cloudtrail monitoring|https://0x00sec.org/t/a-blue-team-guide-to-aws-cloudtrail-monitoring/15086/]]|AWS Monitoring|
|>|>|>|!2019.07.19|
|2019.07.19|Challenges[>img[iCSF/flag_fr.png]]|![[Face au Cloud Act américain, le grand retour du "cloud souverain" français|https://www.challenges.fr/entreprise/face-au-cloud-act-americain-le-grand-retour-du-cloud-souverain-franais_664976]]|CLOUD_Act Sovereign_Cloud|
|2019.07.19|Les Echos[>img[iCSF/flag_fr.png]]|![[Cloud Act : Amazon traite les requêtes de la justice américaine|https://www-lesechos-fr.cdn.ampproject.org/c/s/www.lesechos.fr/amp/1039103]]|CLOUD_Act AWS|
|2019.07.19|DZone|[[Containers Without Docker|https://dzone.com/articles/containers-with-out-docker]]|Containers Docker|
|2019.07.19|HelpNet Security|[[New open source solution reduces the risks associated with cloud deployments|https://www.helpnetsecurity.com/2019/07/19/reduce-cloud-deployment-risks/]]|AWS UCE|
|2019.07.19|//Lacework//|[[Cloud Security Incident Response: Continuous vs. Emergency Approaches|https://www.lacework.com/continuous-cloud-security-incident-response/]]|Incident_Response|
|2019.07.19|//Checkpoint//[>img[iCSF/flag_fr.png]]|[[Le Rapport de sécurité du Cloud 2019 de Check Point identifie l'éventail des problèmes de sécurité des entreprises dans les Clouds publics|http://www.globalsecuritymag.fr/Le-Rapport-de-securite-du-Cloud,20190717,89196.html]]|Report Checkpoint|
|2019.07.19|//iNSYNQ//|![[iNSYNQ experienced a ransomware attack on 7/16/19 perpetrated by unknown malicious attackers|https://www.insynq.com/support/#status]]|Attacks Ransomware|
|2019.07.19|MSSP Alert| → [[Ransomware Attacks Cloud Service Provider Insynq; MSPs Impacted|https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/insynq-outage/]]|Attacks Ransomware|
|2019.07.19|Bleeping Computer| → [[iNSYNQ Cloud Hosting Provider Hit by Ransomware Attack|https://www.bleepingcomputer.com/news/security/insynq-cloud-hosting-provider-hit-by-ransomware-attack/]]|Attacks Ransomware|
|2019.07.19|Krebs On Security| → [[QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack|https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/]]|Attacks Ransomware|
|2019.07.19|//Chef//|[[Don't Leave Your S3 Buckets Wide Open|https://blog.chef.io/2019/07/19/dont-leave-your-s3-buckets-wide-open/]]|Protection S3|
|2019.07.19|//Inedo//|[[50+ Kubernetes DevOps Tools on GitHub|https://blog.inedo.com/50-kubernetes-devops-tools-github]]|Kubernetes Tools|
|2019.07.19|ZDnet|[[Encryption laws to run up against CLOUD Act and GDPR: Law Council|https://www.zdnet.com/article/encryption-laws-to-run-up-against-cloud-act-and-gdpr-law-council/]]|CLOUD_Act|
|2019.07.19|//Managed Sentinel//|![[Mapping of On-Premises Security Controls vs Major Cloud Providers|https://www.managedsentinel.com/2019/05/28/on-prem-vs-cloud/]] (versions [[PNG|https://www.managedsentinel.com/wp-content/uploads/2019/05/Cloud-vs-On-Premises-v-4.png]] et [[PDF|https://www.managedsentinel.com/downloads/on_prem_vs_cloud_v4.pdf]])|Azure Security|
|>|>|>|!2019.07.18|
|2019.07.18|Global Security Mag[>img[iCSF/flag_fr.png]]|[[L'adoption rapide et massive du cloud public réforme les modèles de sécurité des entreprises|http://www.globalsecuritymag.fr/L-adoption-rapide-et-massive-du,20190718,89247.html]]|Misc|
|2019.07.18|Le Monde Informatique[>img[iCSF/flag_fr.png]]|[[Google Cloud certifié hébergeur de données de santé en France|https://www.lemondeinformatique.fr/actualites/lire-google-cloud-certifie-hebergeur-de-donnees-de-sante-en-france-75949.html]]|GCP Healthcare France|
|2019.07.18|Ronnie Flathers|![[Docker for Pentesters|https://blog.ropnop.com/docker-for-pentesters/]]|Docker PenTesting|
|2019.07.18|Bleeping Computer|[[Fake Office 365 Site Pushes Trickbot Trojan as Browser Update|https://www.bleepingcomputer.com/news/security/fake-office-365-site-pushes-trickbot-trojan-as-browser-update/]]|O365 Phishing|
|2019.07.18|DZone|![[Why I Am Worried About My Personal Data in The Cloud|https://dzone.com/articles/why-am-i-worried-about-my-personal-data-in-the-clo]]|Privacy|
|2019.07.18|SecurityTrails|[[How to Install Kali Linux in the Cloud|https://securitytrails.com/blog/install-kali-linux-cloud]]|Audit Tools|
|2019.07.18|Down the Security Rabbitole|[[DtSR Episode 354 - Pragmatic Azure Security|http://podcast.wh1t3rabbit.net/dtsr-episode-354-pragmatic-azure-security]] ([[podcast|http://hwcdn.libsyn.com/p/8/b/1/8b1e1c3fa9a57563/DtSR_Episode_354_-_Pragmatic_Azure_Security.mp3]])|Azure|
|2019.07.18|TechRadar Pro|[[.cloud domains: a name that's made for fame|https://www.techradar.com/news/cloud-domains-a-name-thats-made-for-fame]]|Domains|
|2019.07.18|//iland Internet//|[[Migrating infrastructure to the cloud -- what the board needs to know|https://betanews.com/2019/07/18/migrating-infrastructure-to-the-cloud/]]|Governance Risks|
|2019.07.18|//Lacework//|[[How to Improve Breach Detection in the Cloud|https://www.lacework.com/improve-breach-detection-cloud/]]|Breach Detection|
|2019.07.18|//Tripwire//|[[Multi-Cloud Security Best Practices Guide|https://www.tripwire.com/state-of-security/security-data-protection/cloud/multi-cloud-security-best-practices-guide/]]|MultiCloud Best_Practices|
|2019.07.18|//Security Intelligence//|![[Does Your Cloud Vendor Contract Include These Crucial Security Requirements?|https://securityintelligence.com/posts/does-your-cloud-vendor-contract-include-these-crucial-security-requirements/]]|Contracts|
|2019.07.18|//Cylance//|[[Benefits, Risks, and Insurance Issues in the Cloud|https://threatvector.cylance.com/en_us/home/benefits-risks-and-insurance-issues-in-the-cloud.html]]|Compliance|
|2019.07.18|//Managed Methods//|[[Is Microsoft Cloud Secure? Office 365 Apps Security|https://managedmethods.com/blog/is-microsoft-cloud-secure/]]|Azure O365|
|2019.07.18|//Azure//|[[Azure Monitor for containers with Prometheus now in preview|https://azure.microsoft.com/en-us/blog/azure-monitor-for-containers-with-prometheus-now-in-preview/]]|Azure Containers Monitoring|
|2019.07.18|//HiveMQ//|[[A Better Solution for IoT Security and MQTT|https://www.hivemq.com/blog/a-better-solution-for-iot-security-and-mqtt/]]|IoT MQTT|
|>|>|>|!2019.07.17|
|2019.07.17|disruptOps|[[Cloud Security CoE Shared Services|https://disruptops.com/cloud-security-coe-shared-services/]]|Best_Practices|
|2019.07.17|DFRWS|[[AFF4-L: A scalable open logical evidence container|http://dfrws.org/sites/default/files/session-files/paper-aff4_l_a_scalable_open_logical_evidence_container.pdf]]|Forensics Conference|
|2019.07.17|Felix Felix Wilhelm|![[Quick and dirty way to get out of a privileged k8s pod or docker container by using cgroups release_agent feature|https://mobile.twitter.com/_fel1x/status/1151487053370187776/]]|Docker Vulnerability PoC|
|2019.07.19|//Trail of Bits//| → [[Understanding Docker container escapes|https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/]]|Docker Vulnerability PoC|
|2019.07.17|Infosecurity Mag|[[93% of Orgs Worry About Cloud Security|https://www.infosecurity-magazine.com/news/93-of-orgs-worry-about-cloud]]|Report|
|2019.07.17|HelpNet Security|[[As cyber attacks increase, the cloud-based database security market grows|https://www.helpnetsecurity.com/2019/07/17/cloud-based-database-security-market/]]|Report ResearchAndMarkets|
|2019.07.17|//Synopsys//|[[2019 Cloud Security Report|https://www.synopsys.com/software-integrity/resources/analyst-reports/security-in-the-cloud.html]]|Report Synopsis|
|2019.07.17|AWS Insider.net| → [[Cloud Security Survey: Top Concern Is Data Loss/Leakage|https://awsinsider.net/articles/2019/07/17/cloud-security-report.aspx]]|Report Synopsis|
|2019.07.17|Dark Reading| → [[Data Loss, Leakage Top Cloud Security Concerns|https://www.darkreading.com/cloud/data-loss-leakage-top-cloud-security-concerns/d/d-id/1335277]]|Report Synopsis|
|2019.07.17|Computer Weekly| → [[Most security pros still concerned about public cloud security|https://www.computerweekly.com/news/252466841/Most-security-pros-still-concerned-about-public-cloud-security]]|Report Synopsis|
|2019.07.17|//Bitglass//|[[Bitglass 2019 Cloud Security Report: Only 20 Percent of Organizations Use Cloud Data Loss Prevention Despite Storing Sensitive Information in the Cloud|https://www.businesswire.com/news/home/20190717005003/en/Bitglass-2019-Cloud-Security-Report-20-Percent]]|Report Bitglass|
|2019.07.18|HelpNet Security| → [[Adoption rates of basic cloud security tools and practices still far too low|https://www.helpnetsecurity.com/2019/07/18/basic-cloud-security-tools/]]|Report Bitglass|
|2019.07.17|//Alibaba Cloud//|[[How to Enable Transparent Data Encryption on Alibaba Cloud|https://medium.com/@Alibaba_Cloud/how-to-enable-transparent-data-encryption-on-alibaba-cloud-b46cbb86b96d]]|Alibaba Encryption|
|2019.07.17|//HiveMQ//|[[Client, Broker / Server and Connection Establishment - MQTT Essentials: Part 3|https://www.hivemq.com/blog/mqtt-essentials-part-3-client-broker-connection-establishment/]] (3/5)|MQTT|
|>|>|>|!2019.07.16|
|2019.07.16|DZone|![[Automated Remediation for Cloud-Specific Threats|https://dzone.com/articles/automated-remediation-for-cloud-specific-threats]]|Threats|
|2019.07.16|Container Journal|[[The 3 Phases of Containerization|https://containerjournal.com/2019/07/16/the-3-phases-of-containerization/]]|Containers|
|2019.07.16|Solutions Review|[[What Are the Benefits of a Cloud Managed Service Provider?|https://solutionsreview.com/cloud-platforms/what-are-the-benefits-of-a-cloud-managed-service-provider/]]|CloudMSP|
|2019.07.16|OVH[>img[iCSF/flag_fr.png]]|[[Private Cloud en cours de qualification SecNumCloud|https://www.ovh.com/fr/blog/private-cloud-en-cours-de-qualification-secnumcloud/]]|Certification|
|2019.07.16|//Gartner//|[[G00365830: Magic Quadrant for Cloud Infrastructure as a Service, Worldwide|https://www.gartner.com/en/documents/3947472]]|Gartner|
|2019.07.18|Silicon Angle| → [[Google gains ground in Gartner's latest Magic Quadrant for cloud infrastructure |https://siliconangle.com/2019/07/18/google-gains-ground-gartners-latest-magic-quadrant-cloud-infrastructure-services/]]|Gartner IaaS|
|2019.07.18|ZDnet| → [[Google Cloud gains in Gartner's 2019 cloud infrastructure Magic Quadrant|https://www.zdnet.com/article/google-cloud-gains-in-gartners-2019-cloud-infrastructure-magic-quadrant/]] ([[quadrant|https://zdnet3.cbsistatic.com/hub/i/2019/07/18/de65f5b8-eb36-469c-8597-43bbc2af6a64/0d6e05e2ccdc7ee56d4212632233a7e5/gartner-iaas-2019-mq.png]])|Gartner IaaS|
|2019.07.19|CRN| → [[Gartner's 2019 Magic Quadrant For Cloud IaaS: Six Top Providers|https://www.crn.com/slide-shows/cloud/gartner-s-magic-quadrant-for-cloud-iaas-six-top-providers]]|Gartner IaaS|
|2019.07.22|AWS Insider| → [[AWS Dominates Cloud Infrastructure Report for 9th Year|https://awsinsider.net/articles/2019/07/22/gartner-iaas-2019.aspx]]|Gartner IaaS|
|2019.07.22|CBR Online| → [[IaaS Magic Quadrant: Gartner Gets the Claws Out|https://www.cbronline.com/news/cloud-iaas-gartner]]|Gartner IaaS|
|2019.07.16|//Securosis//|[[Build Your Own Multi-Cloud Security Monitoring in 30 Minutes or Less with StreamAlert|https://disruptops.com/build-your-own-multi-cloud-security-monitoring-in-30-minutes-or-less-with-streamalert/]]|Monitoring|
|2019.07.16|//Duo Security//|[[Dragged Into the Light: Duo Security Report Reveals Businesses Gaining Control of Shadow IT|https://duo.com/about/press/releases/dragged-into-the-light-duo-security-report-reveals-businesses-gaining-control-of-shadow-it]]|Report DuoSecurity|
|2019.07.16|Dark Reading| → [[Security Snapshot: OS, Authentication, Browser & Cloud Trends|https://www.darkreading.com/cloud/security-snapshot-os-authentication-browser-and-cloud-trends/d/d-id/1335262]]|Report DuoSecurity|
|2019.07.16|//BlackBlaze//|[[More From Our Annual Survey: Choosing the Best Cloud for Backing Up|https://www.backblaze.com/blog/choosing-the-best-cloud-for-backing-up/]]|Report BlackBlaze|
|2019.07.16|//Rhino Security Labs//|[[Exploring the Power of Phished Persistent Cookies in AWS|https://rhinosecuritylabs.com/aws/aws-phished-persistent-cookies/]]|AWS|
|2019.07.16|//Zscaler//|[[Abusing Microsoft's Azure domains to host phishing attacks|https://www.zscaler.com/blogs/research/abusing-microsofts-azure-domains-host-phishing-attacks]]|Azure Phishing|
|2019.07.16|//G2//|[[11 Myths About Cloud Storage: Debunked|https://learn.g2.com/cloud-storage]]|Storage|
|2019.07.16|//PaloAlto Networks//|[[Seven Guiding Principles to Selecting the Right Cloud Security Solution|https://blog.paloaltonetworks.com/2019/07/seven-guiding-principles-selecting-right-cloud-security-solution/]]|Misc|
|2019.07.16|//ThreatStack//|![[16 Cloud Security Experts Share the Most Costly Security Technology Misconceptions When It Comes to Cloud Migration|https://www.threatstack.com/blog/16-cloud-security-experts-share-the-most-costly-security-technology-misconceptions-when-it-comes-to-cloud-migration]]|Migration|
|2019.07.16|//Datanami//|[[The State of Storage: Cloud, IoT, and Data Center Trends|https://www.datanami.com/2019/07/16/the-state-of-storage-cloud-iot-and-data-center-trends/]]|Storage|
|2019.07.16|Silicon Angle|[[8M lines of hotel-related code exposed in latest Elasticsearch database configuration failure|https://siliconangle.com/2019/07/16/8m-hotel-records-exposed-latest-elasticsearch-database-configuration-fail/]]|Data_Leaks|
|2019.07.16|//Security Intelligence//|[[The Fine Art of Protecting Microsoft Office 365 Apps With Multifactor Authentication|https://securityintelligence.com/posts/the-fine-art-of-protecting-microsoft-office-365-apps-with-multifactor-authentication/]]|O365 MFA|
|2019.07.16|//Managed Methods//|[[What Is Cloud Application Security?|https://managedmethods.com/blog/what-is-cloud-application-security/]]|Misc|
|2019.07.16|//Cruise//|[[Container Platform Security at Cruise (2/2)|https://medium.com/cruise/container-platform-security-7a3057a27663]]|Containers|
|2019.07.16|//Radware//|[[Have Crypto-Miners Infiltrated Your Public Cloud?|https://blog.radware.com/security/cloudsecurity/2019/07/have-crypto-miners-infiltrated-your-public-cloud/]]|Cryptomining|
|2019.07.16|NSA|[[Cloud Security Basics|https://media.defense.gov/2019/Jul/16/2002158059/-1/-1/0/CSI-CLOUD-SECURITY-BASICS.PDF]]|Guidance|
|>|>|>|!2019.07.15|
|2019.07.15|Cloud Native Computing Foundation|[[Demystifying Containers - Part II: Container Runtimes|https://www.cncf.io/blog/2019/07/15/demystifying-containers-part-ii-container-runtimes/]]|Containers|
|2019.07.15|8 Bit Men|[[A Thorough Guide to High Availability, HA Cluster Architecture & Fault Tolerance|https://www.8bitmen.com/a-simple-guide-to-high-availability-ha-cluster-architecture-fault-tolerance/]]|Fault_Tolerance|
|2019.07.15|8 Bit Men|![[A Super Helpful Guide to Understanding Workload & It's Types in Cloud|https://www.8bitmen.com/a-super-helpful-guide-to-understanding-workload-its-types-in-cloud/]]|Workloads|
|2019.07.15|8 Bit Men|![[AWhat Is an Instance In Cloud Computing? – A Thorough Guide|https://www.8bitmen.com/what-is-an-instance-in-cloud-computing-a-thorough-guide/]]|Instances|
|2019.07.15|//Alcide//|[[New Analysis by Alcide Finds 89% of Kubernetes Deployments Not Leveraging Secrets Resources|https://containerjournal.com/2019/07/15/new-analysis-by-alcide-finds-89-of-kubernetes-deployments-not-leveraging-secrets-resources/]]|Kubernetes|
|2019.07.15|//AlienVault//|[[Cloud Security and Risk Mitigation|https://www.alienvault.com/blogs/security-essentials/cloud-security-and-risk-mitigation]]|Risks Mitigation|
|2019.07.15|//Lacework//|[[Cloud Compliance Security, Part 2: The Importance of Security Controls (2/2)|https://www.lacework.com/cloud-compliance-security-part-2-importance-security-controls/]]|Compliance|
|2019.07.15|//TrendMicro//|[[SLUB Gets Rid of GitHub, Intensifies Slack Use|https://blog.trendmicro.com/trendlabs-security-intelligence/slub-gets-rid-of-github-intensifies-slack-use/]]|Attacks Slack|
|2019.07.15|//Azure//|![[Advancing Microsoft Azure reliability|https://azure.microsoft.com/en-gb/blog/advancing-microsoft-azure-reliability/]]|Azure Reliability|
|2019.07.15|//Outpost24//|[[Infosecurity Europe 2019 infographic: Cyber resilience for application and cloud security|https://outpost24.com/blog/Infosecurity-Europe-2019-infographic-Cyber-resilience-for-application-and-cloud-security]]|Resilience|
!"//Signal vs. Noise: Banker Cloud Stories//"
[>img(150px,auto)[iCSA/J7JBS.jpg]]Article de blog publié le 19 juillet 2019 — Rédigé par Craig Balding
<<<
//Une bonne question à poser à un professionnel, quelque soit son secteur d'activité est : à quels événements professionnels participez-vous et pourquoi ?
En plusieurs décennies, j'ai participé et fait l'impasse sur beaucoup d'entre eux, mon principal critère de choix étant le rapport "signal/bruit". En d'autres termes, je sélectionne des événements auxquels assistent des personnes qui façonnent notre industrie — visionnaires, expérimentateurs de premier plan, décideurs, et bien sûr des ceux qui ont une réelle expérience "terrain". Evitez les "moulins à parole" et recherchez les "retours d'expérience".// [...]
//En juin, 23 membres de notre groupe de travail CSA du secteur de la finance s'est réuni dans la belle ville de Louvain, en Belgique, où nous avons passé la journée à partager nos expériences et à discuter des pratiques émergentes, en appliquant la règle de Chatham House.

''Les thèmes abordés''
La journée comprenait des présentations de haute volée, puis du réseautage. Chaque présentation de 10 minutes servait de point de départ à des séances de questions / réponses pointues de 10 minutes aussi.// [...]

//''Et la suite ?''
Nos prochains thèmes seront : la sécurité des containers; comprendre la complexité du Cloud compte-tenu des scénarios d'adoption eux aussi toujours plus complexes; transformations et agilité dans le secteur financier.// [...]
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/19/signal-vs-noise-banker-cloud-stories-by-craig-balding/]] sur le blog de la CSA
!"//'Shift Left' to Harden Your Cloud Security Posture//"
[>img(150px,auto)[iCSA/J7IBS.jpg]]Article de blog publié le 18 juillet 2019 — Rédigé par Josh Stella, Co-founder & Chief Technology Officer, Fugue
<<<
//After a decade-long uneasy courtship with cloud computing, enterprises are migrating their IT systems to platforms like AWS and Azure as fast as they can. This means the key question for the security team is no longer "do we trust the cloud?" -- it's "can we trust ourselves in the cloud?" Answering "yes" requires embracing a term common in application developers circles: "Shift Left". Just as developers unit test their application code prior to merging into the build, they should also implement automated unit security testing of their modules prior to merging into the stage environment.

''Small errors create big problems''
If you've been running in the cloud at scale, you're familiar with the challenge of trying to constantly monitor for the security risks created by resources without known owners, misconfigurations, and humans making errors like leaving too much access after a maintenance event. Human error is the number one cause of data breaches in the cloud, primarily due to the misconfiguration of cloud infrastructure.
Asking the security team to monitor and address misconfigurations in real-time is asking them to tilt at windmills. They quickly become overwhelmed by alerts and struggle to keep up with manual remediation or an ever-growing bag of bespoke automated remediation scripts. The all-too-common result is that the organization finds its brand name and reputation splashed across news headlines and articles about data exposure or loss due to a cloud misconfiguration.

''Security and compliance shift left''
Among developers, the term "shift left" describes moving a particular function to earlier phases of their processes to make identifying and fixing bugs and other errors easier and less time-consuming. The longer they wait, the more difficult making a fix becomes, and that creates delays.
Developers typically relegate security and compliance considerations as afterthoughts implemented as a gate during the test phase. Then they grow frustrated when red flags go up that force them to perform rework in design, development, and testing, and blame the security team for delays moving applications into production.
Automating the shift left of compliance and security into the design and develop phases will eliminate those delays and frustrations, make better systems, and turn those functions into highway builders rather than toll booth operators.

''Establish universal policy interpretations and secure baselines''
This isn't just a process change, it's a culture change. Organizations will likely need to get their security, DevOps and compliance teams to commit to establishing trust and confidence with one another. The best way to accomplish this is to have a "contract" between the teams in the form of actual code that includes explicit and shared interpretations of policy and establishes a baseline of the environment that is enforced via automated tools and processes all the way through the software development lifecycle (SDLC).
A baseline is a complete configuration of an application from the infrastructure up. Baselining allows all stakeholders to determine if the configuration is acceptable early in the process. Developers need to make sure the system functions as intended. Operations needs to know that the system is reliable and maintainable. Security needs to know that it is configured in conformance with best practices and policies at deployment and during operations, and compliance needs to know that it meets audit and/or regulatory controls.
By establishing a definition of known-good into the design and development phases, all parties can come to an agreement early in the process and work together to avoid costly delays. The term "DevSecOps" is becoming more popular as security and DevOps realize they need to come together to address security and compliance considerations earlier in the development process. Creating and enforcing a known-good baseline provides developers with real-time automated feedback through the design and develop phases so they avoid interrupts that breed delays and ensure that the production environment meets all security and compliance policies when deployed to the cloud.//
<<<
&rArr; Lire [[l'original|https://blog.cloudsecurityalliance.org/2019/07/18/shift-left-to-harden-your-cloud-security-posture/]] sur le blog de la CSA
Cet article est la consolidation de 3 articles publiés sur le site de la société Fugue, déjà mentionnés dans la veille hebdomadaire+++*[»]>
|2019.04.17|//Fugue//|[[Shifting Left on Cloud Security and Compliance|https://www.fugue.co/blog/shifting-left-on-cloud-security-and-compliance]] (1/3)|Risks|
|2019.05.24|//Fugue//|[[Shift Left on Cloud Security, Part II - Phases of the SDLC|https://www.fugue.co/blog/shift-left-on-cloud-security-part-ii-phases-of-the-sdlc]] (2/3)|Risks|
|2019.06.27|//Fugue//|[[Shift Left on Cloud Security, Part III: Extending into Production|https://www.fugue.co/blog/shift-left-on-cloud-security-part-iii-extending-into-production]] (3/3)|Risks|
=== 
Communiqué de presse du 16 juillet 2019
<<<
//Report identifies challenges in securing application containers and microservices through the lens of the developer, operator and architect
[>img(150px,auto)[iCSA/J7GPC.png]]SEATTLE - July 16, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released the Challenges in Securing Application Containers and Microservices. Produced by the CSA's Application Containers and Microservices Working Group, this report examines and prioritizes the challenges application architects, developers and operators will encounter when designing, deploying and operating secure application containers and microservices. It is the first in a series of reports that will cover best practices to address and help mitigate the challenges for app containers and microservices outlined in this document, as well as delineating a unified standard for microservices architecture.

"Application containers and microservices have specific characteristics that come with distinct security ramifications," said Anil Karmel, Application Container and Microservices Working Group Co-chair. "By prioritizing various challenges surrounding the securing of application containers and microservices and separating them into use case and feature categories, those involved in the software development lifecycle will be able to make informed security decisions."

Challenges were scored based on 10 weighted questions as applied against application container and microservices features. The top three challenges surrounding application containers were identified as:
* The use of monitoring and security solutions in multi-tenant hosting environments that do not require root or "privileged" access to the container host. These solutions are specifically designed to expose information from more than one tenant and their compromise could result in information spillage or system compromise.
* Ensuring trust in host systems that store images and launch containers. The absence of host-hardening processes can result in the compromise of images, runtime environments and stored data.
* Host hardening is an important requirement for secure container hosting, and a challenge exists to ensure that hardening doesn't interfere with authorized capabilities (e.g., network, storage) of the containers themselves. The absence can result in service availability issues.

The three most critical issues pertaining to microservices challenges were identified as:
* Finding a balance between the costs and benefits of rebuilding a microservice architecture and then orchestrating those microservices. The absence will result in either cost overruns or an application that does not fully benefit from a microservice architecture.
* A container's lifespan when architecting stateful microservices. Care must be taken to design a microservice that does not lose state when a container is no longer running as its absence can result in data loss.
* Ensuring interoperability when writing or maintaining a microservice that interfaces with several other microservices. Reliable test harnesses are required and their absence can result in increased availability and performance issues as the application is decomposed into microservices.
//
<<<
* +++*[Détails complémentaires »]> <<tiddler [[2019.07.16 - Publication : 'Best Practices for Implementing a Secure Application Container Architecture']]>>=== 
* &rArr; Lire [[la suite|https://cloudsecurityalliance.org/articles/csa-releases-new-research-indentifying-challenges-in-securing-application-containers-and-microservices/]] sur le site de la CSA
!"//Challenges in Securing Application Containers and Microservices//"
<<<
[>img(150px,auto)[iCSA/J7GPC.png]]//Application containers and a microservices architecture are being used to design, develop and deploy applications leveraging agile software development approaches such as Development Operations. Security must be embedded into these software development approaches. This document serves to identify challenges in securing application containers and microservices in the engineering of trustworthy secure systems through the lens of the Developer, Operator and Architect.//
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7gc/|https://CloudSecurityAlliance.fr/go/j7gc/]]''





!1 - Les nouveautés CSA de la semaine du 8 au 14 juillet 2019
* [>img[iCSF/cloud-security-alliance-fr.png]]Blog : ''Inscription au Mastère Spécialisé de l'ISEP "Expert Cloud Computing"''+++*[»]> <<tiddler [[2019.07.08 - Blog : Inscription au Mastère Spécialisé de l'ISEP 'Expert Cloud Computing']]>>=== 
* Actualités : ''Cloud Security Alliance Releases Cloud Penetration Testing Playbook''+++*[»]> <<tiddler [[2019.07.12 - Actu : 'CSA Releases Cloud Penetration Testing Playbook']]>>=== 
* Publication : ''Cloud Penetration Testing Playbook''+++*[»]> <<tiddler [[2019.07.12 - Publication : 'Cloud Penetration Testing Playbook']]>>=== 
!2 - Veille Web
La [[Veille Web|2019.07.14 - Veille Hebdomadaire]] avec une soixantaine de liens :
* Piratages et fuites de données : Magecart et les attaques systématiques contre les buckets Amazon S3 mal configurés
* Rapports et sondages : Blueprint d'architecture Cloud sécurisée par le Global Cities Team Challenge, sondages Netwrix et Gemalto
* Pannes : Twitter
* Divers : Protection des données dans des buckets AWS, Docker, Kubernetes
!3 - Agenda
* ''28 __juillet__'' : ''derniers jours'' avant la clôture de l'appel à présentations pour le ''CSA Congress EMEA'' des 20 et 21 novembre 2019 à Berlin+++*[»]> <<tiddler [[2019.06.21 - Actu : Encore un mois pour soumettre un sujet au CSA Congress EMEA 2019]]>>=== 
|!Juillet|!Sources|!Titres et Liens|!Keywords|
|>|>|>|!2019.07.14|
|2019.07.14|BetaNews|[[Planning a cloud migration? Get your identity privileges in check first|https://betanews.com/2019/07/14/planning-a-cloud-migration-get-your-identity-privileges-in-check-first/]]|Identity|
|2019.07.14|//HiveMQ//|[[The lightweight IoT Protocol MQTT: How to get started|https://www.hivemq.com/blog/how-to-get-started-with-mqtt/]]|MQTT|
|>|>|>|!2019.07.12|
|2019.07.12|RTS[>img[iCSF/flag_fr.png]]|[[Swisscom a effacé les données de centaines de clients MyCloud|https://www.rts.ch/info/suisse/10569711-swisscom-a-efface-les-donnees-de-centaines-de-clients-mycloud.html]]|Outage Swisscom|
|2019.07.12|EDPB / EDPS|![[LIBE Committee letters to the EDPS and to the EDPB regarding legal assessment of the impact of the US Cloud Act on the European legal framework for personal data protection (pdf)|https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_edps_joint_response_us_cloudact_coverletter.pdf]]|CLOUD_Act|
|2019.07.12|HelpNet Security|![[How businesses can become more nimble and secure by moving to the cloud|https://www.helpnetsecurity.com/2019/07/12/becoming-secure-cloud-adoption/]] |Misc|
|2019.07.12|DZone|[[4 Ways to Cut Costs When Backing up VMs in The Cloud|https://dzone.com/articles/4-ways-to-cut-costs-when-backing-up-vms-in-the-clo]]|VMs|
|2019.07.12|Cyber Defense Mag|[[US Agency Security Doubts Hinder Move To Hybrid Cloud|https://www.cyberdefensemagazine.com/us-agency-security-doubts-hinder-move-to-hybrid-cloud/]]|Hybrid_Cloud|
|2019.07.12|FinExtra|[[How to build the regulator's confidence in the cloud|https://www.finextra.com/newsarticle/34114/how-to-build-the-regulators-confidence-in-the-cloud]]|Compliance|
|2019.07.12|Cyware|[[DNA Testing Company Vitagene Exposed Over 3,000 Patient Records Due to Misconfigured Database|https://cyware.com/news/dna-testing-company-vitagene-exposed-over-3000-patient-records-due-to-misconfigured-database-cb415557]]|AWS Data_Leak|
|2019.07.12|CloudTech|[[How public cloud continues to drive demand for cybersecurity solutions|https://www.cloudcomputing-news.net/news/2019/jul/12/public-cloud-drives-demand-for-cybersecurity-solutions/]]|Solutions|
|2019.07.12|safecontrols|![[Securing media stored in cloud storage buckets against unauthorised access|https://safecontrols.blog/2019/07/12/securing-media-stored-in-cloud-storage-buckets-against-unauthorised-access/]] |AWS Storage|
|2019.07.12|//Cloudflare//|![[Details of the Cloudflare outage on July 2, 2019|https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/]] |Outage Cloudflare|
|2019.07.12|//Forcepoint//|[[Prioritizing cloud security initiatives|https://www.forcepoint.com/blog/insights/prioritizing-cloud-security-initiatives]]|Misc|
|2019.07.12|//Lacework//|[[Cloud Compliance Security, Part 1: Understanding Expectations & Building Requirements (1/2)|https://www.lacework.com/cloud-compliance-security-part-1-expectations-requirements/]]|Compliance|
|2019.07.12|//AlertLogic//|[[Five Insights from and About the First AWS re:Inforce|https://blog.alertlogic.com/five-insights-from-and-about-the-first-aws-reinforce/]]|AWS Conference|
|2019.07.12|//DeltaRisk//|[[Federal Agencies Moving to the Cloud Must Take Stock of Information Systems|https://deltarisk.com/blog/federal-agencies-moving-to-the-cloud-must-take-stock-of-information-systems/]]|Strategy|
|>|>|>|!2019.07.11|
|2019.07.11|GeekWire|[['Something is technically wrong': Twitter outage extends beyond an hour|https://www.geekwire.com/2019/something-technically-wrong-twitter-outage-extends-beyond-hour/]]|Outage Twitter|
|2019.07.11|Dark Reading|[[The Security of Cloud Applications|https://www.darkreading.com/cloud/the-security-of-cloud-applications-/a/d-id/1335157]]|Misc|
|2019.07.11|CSO|[[How a decentralized cloud model may increase security, privacy|https://www.csoonline.com/article/3405439/how-a-decentralized-cloud-model-may-increase-security-privacy.html]]|Architecture|
|2019.07.11|DZone|[[Understanding Docker Networking|https://dzone.com/articles/understanding-docker-networking]]|Docker|
|2019.07.11|DZone|[[Updating and Modernizing: Moving from Virtual Machines to Containers|https://dzone.com/articles/updating-and-modernizing-moving-from-virtual-machi]]|VMs Containers|
|2019.07.11|DZone|[[Kubernetes vs OpenShift: What Is the Difference?|https://dzone.com/articles/kubernetes-vs-openshift-what-is-the-difference]]|Kubernetes OpenShift|
|2019.07.11|//Fugue//|![[5 Things Executives Need to Know About Cloud Security|https://www.fugue.co/blog/5-things-executives-need-to-know-about-cloud-security]] |Best_Practices|
|2019.07.11|//PaloAlto Networks//|[[How Western Asset Management Is Mitigating Cloud Threats|https://blog.paloaltonetworks.com/2019/07/western-asset-management-mitigating-cloud-threats/]]|Threats Mitigation|
|2019.07.11|//TrendMicro//|[[Migrating Network Protection to the Cloud with Confidence|https://blog.trendmicro.com/migrating-network-protection-to-the-cloud-with-confidence/]]|Protection|
|2019.07.11|//Microsoft//|[[Authentication Methods–Usage & Insights|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Authentication-Methods-Usage-amp-Insights/ba-p/745370]]|Active_Directory|
|2019.07.11|//TAG Cyber//|[[Cloud Security for the Masses|https://threatvector.cylance.com/en_us/home/cloud-security-for-the-masses.html]]|Misc|
|2019.07.11|//Forcepoint//|[[Cloud app security in a direct-to-cloud world|https://www.forcepoint.com/blog/insights/cloud-app-security-direct-cloud-world]]|Misc|
|2019.07.11|//Whistic//|[[Phase 5 of The 5 Phases of Responding to a Security Questionnaire & How To Get Proactive (5/5)|https://blog.whistic.com/phase-5-of-the-5-phases-of-responding-to-a-security-questionnaire-how-to-get-proactive-19421dbac65]]|Misc|
|2019.07.11|//Managed Methods//|[[3 Critical Microsoft Cloud Security Issues|https://managedmethods.com/blog/3-critical-microsoft-cloud-security-issues/]]|Azure O365|
|>|>|>|!2019.07.10|
|2019.07.10|Journal du Net[>img[iCSF/flag_fr.png]]|[[Multi-cloud : comment assurer la disponibilité des données ?|https://www.journaldunet.com/solutions/expert/71422/multi-cloud---comment-assurer-la-disponibilite-des-donnees.shtml]]|Multi_Cloud|
|2019.07.10|GCTC|"Secure Cloud Architecture: Towards a Smart City cloud privacy, Security, and Rights-Inclusive Architecture" ([[blueprint|https://gctc.opencommons.org/images/f/ff/CommunityCloudPrivacy.pdf]])|Architecture|
|2019.07.11|GCN| → [[A secure cloud architecture for smart cities|https://gcn.com/articles/2019/07/11/smart-city-secure-cloud-architecture.aspx]]|Architecture|
|2019.07.10|Container Journal|[[Inside the Canonical Container Strategy|https://containerjournal.com/2019/07/10/inside-the-canonical-container-strategy/]]|Containers|
|2019.07.10|BetaNews|[[Is your online cloud storage secure enough?|https://betanews.com/2019/07/10/online-cloud-storage-secure-enough/]]|Storage|
|2019.07.10|DZone|[[Sending Custom Application Stats From EC2 Server to CloudWatch for Monitoring|https://dzone.com/articles/sending-custom-application-stats-from-ec2-for-clou]]|Monitoring|
|2019.07.10|KitPloit|[[Cloud Security Audit - A Command Line Security Audit Tool For Amazon Web Services|https://www.kitploit.com/2019/07/cloud-security-audit-command-line.html]]|Audit Tools|
|2019.07.10|//RiskIQ//|[[Spray and Pray: Magecart Campaign Breaches Websites En Masse Via Misconfigured Amazon S3 Buckets|https://www.riskiq.com/blog/labs/magecart-amazon-s3-buckets/]]|AWS Attacks Magecart|
|2019.07.11|Wired| → [[Hack Brief: A Card-Skimming Hacker Group Hit 17K Domains - and Counting|https://www.wired.com/story/magecart-amazon-cloud-hacks/]]|AWS Attacks Magecart|
|2019.07.11|CBR Online| → [[Magecart Launches "Spray and Pray" Attacks on AWS S3 Buckets, Hits 17,000|https://www.cbronline.com/news/magecart-aws-s3-card-skimmers]]|AWS Attacks Magecart|
|2019.07.11|infoRisk Today| → [[RiskIQ: Magecart Group Targeting Unsecured AWS S3 Buckets|https://www.inforisktoday.com/riskiq-magecart-group-targeting-unsecured-aws-s3-buckets-a-12771]]|AWS Attacks Magecart|
|2019.07.12|Bleeping Computer| → [[Over 17,000 Domains Infected with Code that Steals Card Data|https://www.bleepingcomputer.com/news/security/over-17-000-domains-infected-with-code-that-steals-card-data/]]|AWS Attacks Magecart|
|2019.07.12|ComputerWeekly| → [[Magecart Hackers Infect 17,000 Domains via Insecure S3 Buckets|https://www.securityweek.com/magecart-hackers-infect-17000-domains-insecure-s3-buckets]]|AWS Attacks Magecart|
|2019.07.12|The Register| → [[When did you last check your AWS S3 security? Here's four scary words: 17k Magecart infections|https://www.theregister.co.uk/2019/07/12/riskiq_magecart_s3/]]|AWS Attacks Magecart|
|2019.07.17|//DivvyCloud//| → [[Hacker Group "Magecart" Attacking Misconfigured S3 Buckets|https://divvycloud.com/blog/protect-your-s3-buckets-from-magecart/]]|AWS Attacks Magecart|
|2019.07.10|//AlienVault//|[[What is Chaos Engineering in penetration testing?|https://www.alienvault.com/blogs/security-essentials/what-is-chaos-engineering-in-pen-testing]]|PenTesting Chaos_Engineering|
|2019.07.10|//Avanan//|[[Watch Out for HTML Attachments, the Latest Phishing Trend Targeting Office 365|https://www.avanan.com/resources/phishing-trend-targeting-office-365-uses-html-attachments]]|Phishing O365|
|>|>|>|!2019.07.09|
|2019.07.09|Dark Reading|![[Cloud Security and Risk Mitigation|https://www.darkreading.com/perimeter/cloud-security-and-risk-mitigation/a/d-id/1335100]] |Risks Mitigation|
|2019.07.09|Container Journal|[[Building Secure Production-Ready Kubernetes Clusters and Containers (2/2)|https://containerjournal.com/2019/07/09/building-secure-production-ready-kubernetes-clusters-and-containers-part-2/]]|Containers|
|2019.07.09|DZone|[[Top Issues Facing Internet of Medical Things and How to Solve Them|https://dzone.com/articles/main-issues-of-internet-of-medical-things-and-how]]|Medical IoT|
|2019.07.09|DZone|[[Deconstructing Serverless Computing Part 4: Developing to Infinity and Beyond!|https://dzone.com/articles/deconstructing-serverless-computing-part-4-develop]]|Serverless|
|2019.07.09|//Stackrox//|[[Gartner: How-To Guide on Securing Containers|https://www.stackrox.com/post/2019/07/gartner-how-to-guide-on-securing-containers/]] (3/3)|Containers|
|2019.07.09|//BlackBlaze//|[[More People Than Ever Backing Up According to Our Survey|https://www.backblaze.com/blog/more-people-than-ever-backing-up-according-to-our-survey/]]|Report BlackBlaze|
|2019.07.09|//Sysdig//|![[33 Kubernetes security tools|https://sysdig.com/blog/33-kubernetes-security-tools/]] |Kubernetes|
|2019.07.09|//Microsoft//|[[Your Pa$$word doesn't matter|https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Your-Pa-word-doesn-t-matter/ba-p/731984]]|Authentication|
|2019.07.09|//Symantec//|[[Why a CASB is Essential to any Cloud and Enterprise Security Strategy|https://www.symantec.com/blogs/product-insights/why-casb-essential-any-cloud-and-enterprise-security-strategy]]|CASB|
|2019.07.09|//Avanan//|[[Cloud Email Security Supplements Address SaaS Vulnerabilities|https://www.avanan.com/resources/cloud-email-security-supplements-address-saas-vulnerabilities]]|SaaS|
|2019.07.09|//Rapid7//|[[Securing Your Cloud Environments with InsightIDR, Part 2: Amazon Web Services (AWS)|https://blog.rapid7.com/2019/07/09/securing-your-cloud-environments-with-insightidr-part-2-amazon-web-services-aws/]] (2/3)|AWS|
|2019.07.09|//Alibaba Cloud//|[[DevOps: How to Have Less Downtime|https://medium.com/@Alibaba_Cloud/devops-how-to-have-less-downtime-c04f630160f2]]|DevOps Availability|
|2019.07.09|//Alibaba Cloud//|[[Building An Immutable Cloud Infrastructure On Alibaba Cloud|https://medium.com/@Alibaba_Cloud/building-an-immutable-cloud-infrastructure-on-alibaba-cloud-b49ac03923c8]]|Availability|
|2019.07.09|//Netwrix//|[[Netwrix survey: 32% of healthcare organizations store all their sensitive data in the cloud, yet lack the resources to protect it|https://www.netwrix.com/netwrix_survey_32_percent_of_healthcare_organizations_store_all_their_sensitive_data_in_the_cloud.html]] ([[rapport|http://www.netwrix.com/go/cloudsecurity2019_healthcare]])|Report|
|2019.07.09|//Blissfully//|[[Five Important Questions To Ask About Your Business's SaaS Tools|https://www.blissfully.com/blog/five-questions-businesss-saas-tools/]]|SaaS|
|2019.07.09|//Sysdig//|[[How to detect Kubernetes vulnerability CVE-2019-11246 using Falco|https://sysdig.com/blog/how-to-detect-kubernetes-vulnerability-cve-2019-11246-using-falco/]]|CVE-2019-11246 Kubernetes|
|2019.07.09|//Managed Methods//|[[Everything You Need to Know About Office 365 Cloud App Security|https://managedmethods.com/blog/office-365-cloud-app-security/]]|Azure O365|
|2019.07.09|//Symantec//|[[Containing Your Containers - It's Time to Batten Down the Hatches|https://www.symantec.com/blogs/product-insights/containing-your-containers-its-time-batten-down-hatches]]|Containers|
|2019.07.09|//CCSI//|[[Cloud Audit Protection Against Security Threats|https://www.ccsinet.com/blog/cloud-security-audit/]]|Auditing|
|2019.07.09|//Sysdig//|![[33(+) Kubernetes security tools|https://sysdig.com/blog/33-kubernetes-security-tools/]]|Kubernetes Tools|
|>|>|>|!2019.07.08|
|2019.07.08|!CSA|[[Organizations Must Realign to Face New Cloud Realities|https://www.symantec.com/blogs/feature-stories/organizations-must-realign-face-new-cloud-realities]] |CSA JimReavis|
|2019.07.08|//eXemplify//|[[Steps to Improved Cloud Security|http://www.exemplifygroup.com/steps-to-improved-cloud-security/]]|Misc|
|2019.07.08|//Gemalto//|[[Study: 49% of ITDMs Feel Cloud Apps Are the Biggest Targets of Digital Threats|https://blog.gemalto.com/security/2019/07/08/study-49-of-itdms-feel-cloud-apps-are-the-biggest-targets-of-digital-threats/]] ([[rapport|https://safenet.gemalto.com/access-management-index/]])|Report Gemalto|
|2019.07.08|ComputerWeekly| → [[Nearly half of firms fear cloud apps make them insecure|https://www.computerweekly.com/news/252466371/Nearly-half-firms-fear-cloud-apps-make-them-insecure]]|Report Gemalto|
|2019.07.09|Dark Reading| → [[Organizations Are Adapting Authentication for Cloud Applications|https://www.darkreading.com/cloud/organizations-are-adapting-authentication-for-cloud-applications/d/d-id/1335200]]|Authentiction|
|2019.07.10|HelpNet Security| → [[Do cloud apps make you a target for cyber attacks?|https://www.helpnetsecurity.com/2019/07/10/cloud-apps-cyber-attacks/]]|Report Gemalto|
|2019.07.08|//StorageCraft//|[[Will Brexit Affect StorageCraft's Cloud Products?|https://blog.storagecraft.com/will-brexit-affect-storagecrafts-cloud-products/]]|Brexit|
Communiqué de presse du 12 juillet 2019
<<<
//Reports provides foundation for public cloud penetration testing methodology
[>img(150px,auto)[iCSA/j7CPC.png]]SEATTLE - July 12, 2019 - The Cloud Security Alliance (CSA), the world's leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today released the Cloud Penetration Testing Playbook. Developed by the CSA Top Threats Working Group, the playbook addresses the methodological and knowledge gaps in the security testing of information systems and applications in public cloud environments with a focus on penetration testing of cloud-hosted applications and services. By providing advice on key topics the report aims to help mature cloud penetration testing and, in the process, create a more secure cloud computing environment.

The playbook represents a collective effort to provide guidance for the penetration testing of systems in public cloud environments and allows penetration testers to use the document's objectives to test the security of public cloud systems and environments. It also touches legal and other associated concerns, aiming to educate key decision makers on the complexities of penetration testing in a multi-stakeholder, layered information technology stack.

"As cloud services become ever more integral to critical business capabilities, as well as foundational for many cloud-native businesses, it is past time we lift the veil on offensive cloud security and testing. In this publication, some of world's leading cloud security experts and CSA proudly deliver this exclusive knowledge from the domain of the skilled few to the benefit of everyone," said Alexander Getsin, lead author and industry cyber security architect.

The CSA Top Threats Working Group, co-chaired by Jon-Michael Brook, principal contributor in the industry and CSA Research Fellow, was established to provide organizations with an up-to-date, expert-informed understanding of cloud security risks, threats and vulnerabilities in order to make educated risk-management decisions regarding cloud adoption strategies. Individuals interested in becoming involved in the future research and initiatives of this group are invited to do so by visiting the Join page.//
<<<
* +++*[Détails complémentaires »]> <<tiddler [[2019.07.12 - Publication : 'Cloud Penetration Testing Playbook']]>>=== 
* &rArr; Lire [[la suite|https://cloudsecurityalliance.org/articles/cloud-security-alliance-releases-cloud-penetration-testing-playbook/]] sur le site de la CSA
!"//Cloud Penetration Testing Playbook//"
<<<
[>img(150px,auto)[iCSA/j7CPC.png]]//This work focuses on testing systems and services hosted in public cloud environments. This refers to customer-controlled or customer-managed systems and services. For example, a custom virtual machine, managed and controlled by the cloud customer, in an IaaS environment would be in-scope whereas the hypervisor of an IaaS environment that is controlled by the cloud service provider isn't. As for testing hybrid clouds, this document does not cover the hybrid interface and on-premises environment.//
<<<
__Table des Matières :__
<<<
# Introduction
** Target Audience
# Scope of this Document
# Cloud Penetration Testing Scope
# Cloud Penetration Testing in Context
# Cloud Penetration Testing Objectives
# Cloud Penetration Test Cases and Concerns
## Preparation
## Threat Modelling
## Reconnaissance and Research
## Testing
## Report
# Legal
# Training and Resources
# Conclusions
# References
<<<
&rArr; Téléchargement (après inscription) → ''[[CloudSecurityAlliance.fr/go/j7cp/|https://cloudsecurityalliance.fr/go/j7cp/]]''
!Le Mastère Spécialisé® de l'ISEP "Expert Cloud Computing" existe depuis 7ans
[>img(150px,auto)[iCSF/ISEP-FC.jpg]]Le Cloud Computing ne fait pas que modifier la façon de consommer l'informatique, il change aussi les métiers au sein des DSI Directions des Services Informatiques. Bien que l'informatique dématérialisée ne s'appuie pas sur des avancées technologiques, elle n'a rien d'un effet de mode ni d'une simple évolution.

Depuis 7 ans, le Cloud Computing a profondément muri et les besoins de compétence des entreprises s'orientent de plus en plus vers les offres SaaS (Software-as-a-Service) dans leur évolution vers la digitalisation et les transformations métiers que cela génère.

[>img(700px,auto)[iCSF/J78PAMDLSDBDE.png]]Depuis 7 ans le Mastère Spécialisé® ''Expert Cloud Computing'' a évolué dans son contenu pour prendre en compte les évolutions des besoins en compétence dans les transformations des entreprises en intégrant les nouveautés technologiques (Internet des Objets, Bigdata, Intelligence Artificielle, Blockchain) de façon à coller aux besoins de l'instant dans la formation.

Le shéma ci-contre résume le positionnement actuel de ce Mastère Spécialisé® dans le spectre des besoins des entreprises.

Ce Mastère Spécialisé®, qui reste à dominante technique, prend en compte les besoins de nouvelles compétences des Ingénieurs non seulement liés au développement des nouvelles technologiques utilisant les ressources Cloud mais aussi de permettre aux lauréats du Mastère Spécialisé® de connaître et traiter les besoins des entreprises dans les domaines stratégiques tels que :
* la sécurité,
* la protection des données,
* les évolutions des Si d'entreprises en fonction des stratégies de transformations.

La pédagogie développée pour ce Mastère Spécialisé® fait toujours appel à la théorie madrée d'une forte proportion d'enseignements en liaison avec des projets opérationnels et concrets développant les qualités d'empathie et de travail en réseau des élèves.

__Planning :__
* Date de début de formation : jeudi 3 octobre 2019
* Date de fin de formation : vendredi 3 juillet 2020
* Soutenances de thèses : 17 ou 18 septembre 2020

__Labels & Accréditations :__
* Le Mastère Spécialisé® est ''labellisé par la CGE (Conférence des Grandes Ecoles) depuis 2012''.
* Le Mastère Spécialisé® est inscrit au ''RNCP (Registre National des Certifications Professionnelles)'' depuis janvier 2015 ; en conséquence, __il est éligible au financement par les OPCA et les Fongecif__
** Le Code RNCP du Mastère Spécialisé® est le [[21792|http://www.rncp.cncp.gouv.fr/grand-public/visualisationFiche?format=fr&fiche=21792]].
* Le Mastère Spécialisé® est éligible au compte personnel de formation(CPF), et peut être partiellement ou totalement financé.
** Le Mastère Spécialisé® est inscrit au CPF sous le n° 145653.
* Le Mastère Spécialisé® est inscrit au CNCP (Commission Nationale de la Certification Professionnelle).

__Liens :__
* Descriptif court du Mastère Spécialisé® ''Expert Cloud Computing''
** ⇒'' https://cloudsecurityalliance.fr/pdf/20190708-Descriptif-MS-CloudComputing-ISEP_2019-2020.pdf ''
* Descriptif détaillé du Mastère Spécialisé® ''Expert Cloud Computing'' sur le site ISEP Formation Continue
** ⇒ ''[[CloudSecurityAlliance.fr/go/McCC/|https://cloudsecurityalliance.fr/go/McCC/]]''

__Contacts et pour recevoir la documentation et le dossier d'inscription pour ce Mastère :__
* Mme Aïcha ABDAT, Assistante administrative ISEP Formation Continue
** Téléphone : 01 49 54 52 59
** Adresse : 10 rue de Vanves, 92130 Issy-les-Moulineaux
** email : ''&#8238;rf.pesi@tadba.ahcia&#8236;''
** Web : ''[[CloudSecurityAlliance.fr/go/McCC/|https://cloudsecurityalliance.fr/go/McCC/]]''
{{floatC{
<html><i class