Security Boulevard

It started like any other Monday morning. Coffee cups steamed beside keyboards, servers hummed gently in climate-controlled rooms, and email inboxes pinged with weekend catch-up. But within minutes, that ordinary...

The post Ransomware Simulation Playbook- Build Real-World Cyber Resilience Without Paying the Price appeared first on Strobes Security.

The post Ransomware Simulation Playbook- Build Real-World Cyber Resilience Without Paying the Price appeared first on Security Boulevard.

Your Data, Your Responsibility: Securing Your Organization's Future in the Cloud
madhav
Tue, 05/20/2025 - 04:37

Cloud adoption has fundamentally changed the way businesses operate, offering scalability, agility, and cost efficiencies that were unimaginable just a decade ago. But with this shift comes a necessary conversation: the cloud can also introduce complex security risks without the right care and practices in place.

Think sensitive and regulated data, intellectual property (IP), or code for your next winning product. When it comes to the future of your organization, business leaders must ask themselves:

• How are we making sure our critical data and IP are completely protected in the cloud?
• Who has access to the keys and protocols which are designed to protect our sensitive information?
• Are we consistently managing and securing keys across different cloud environments?
• Are we simply taking a “good enough” approach to cloud security without considering real risks?

If these are not questions that are already being discussed with teams, they need to be.

The Complexity of Multi-Cloud Security

The Thales 2025 Data Threat Report highlights that entities must rethink their approach to data security due to structural and geopolitical changes. In the AI era, the data businesses collect, store, process and share takes center stage. Although data breach rates fell to 45% in 2025 from 56% in 2021, cloud and application security continue to be the greatest security concerns for security leaders.

Cyberattacks are also becoming more sophisticated and tenacious. According to the Thales 2024 Cloud Security Study, 44% of organizations reported experiencing a cloud data breach, with 14% encountering such incidents within the past year. Among these breaches, 31% were attributed to misconfiguration or human error. Organizations that are not taking proactive steps will realize it’s only a matter of time before they become part of that statistic.

Who is Really Responsible for Cloud Security?

Too many business leaders assume that cloud security is their Cloud Service Provider’s (CSP’s) total responsibility, which is a dangerous misconception. In reality, the CSP and the customer share responsibility – or as Google put it, they share fate.

This is called the Shared Responsibility Model, and it defines clear boundaries:

• Cloud providers are responsible for securing the infrastructure—the physical data centers, networks, and hardware.
• The customer is responsible for securing their data, applications, and user access.

This means that although cloud-native security protocols, like encryption, help to protect the provider’s infrastructure, it does not necessarily protect the customer. If their data is compromised, it is they—not the cloud provider—who will fall foul of regulators and face the financial, legal, and reputational consequences.

Businesses need to ask themselves who in their organization is ensuring that the security strategy aligns with these realities.

The Security Challenges of Hybrid IT

Today’s IT environments are a mix of on-premises, hybrid, and multi-cloud services, creating previously unimagined levels of complexity. Security teams, finding themselves on the back foot, are being forced to bolt on security point products as an afterthought or look towards cloud-native security controls— that could mean relinquishing direct control over their access security.

Leveraging multiple clouds results in a fragmented approach that leads to siloed security solutions that are difficult to manage, gaping holes in protection across different platforms, and soaring costs and inefficiencies due to a lack of integration.

The truth is that as cloud environments only continue to grow, IT teams will continue to battle to manage multiple disconnected security tools. This is not a scalable approach—so entities need to consider what they are doing to consolidate and strengthen security across all cloud environments.

Cloud Security Risks: Are You Leaving the Door Open?

Many firms trust cloud-native controls, like encryption, to protect their data but do not consider where the encryption keys are stored. If they are managed within the same cloud ecosystem, this could put the business at risk. This is why:

• Single Point of Failure – If bad actors breach cloud tenant, they could get their hands on the business’s data, and the encryption keys to keep it safe.
• Regulatory Gaps – Compliance frameworks like GDPR, DORA, and PCI-DSS now require stricter key control. Data sovereignty requirements also mandate control over key management. Businesses must establish whether depending on a CSP meets these evolving regulations.
• Separation of Duties – After all, encryption can only be as secure as its key management process, so companies must understand who actually controls their encryption keys.

The 2025 Thales report indicates that there has been some good progress in protecting sensitive data:

• 68% of organizations report that they encrypt 40% or more of their sensitive cloud data.
• 57% of organizations use MFA to protect access to cloud assets, with 40% of them using phishing resistant methods like biometrics and passkeys.

However, there’s still room for improvement. The question businesses need to ask themselves is, what is their appetite for being at risk?

Are You Protecting the Lifeblood of Your Business?

A company’s intellectual property, business models, and proprietary data set it apart from the competition. But in a cloud-driven world, many organizations fail to consider how well they are truly protecting their value.

Firms should ask themselves:

• Are we in control of our competitive edge in the cloud?
• Could third parties gain access to our sensitive business data?
• What happens if our trade secrets are leaked or misused?

Breaches do not just impact data—they impact business reputation, revenue, and future success. In competitive markets, a single data breach can result in crippling fines, negative publicity, and lost customers. According to a global study by IBM the average cost of a data breach has risen to $4.88 million—a very sobering statistic.

Organizations invest fortunes in R&D and innovation and should think about whether it is worth risking losing it all due to poor cloud security.

The Potential Security Gaps in Cloud Provider Protections

Various cloud models require different security approaches—for instance, IaaS environments require security controls that won’t always translate well to SaaS deployments. One CSP’s security capabilities won’t necessarily apply to a different cloud vendor’s environment, and unfortunately, hybrid and multi-cloud environments create many more security gaps than companies realize.

When security is implemented in a siloed, reactive fashion, the result is inefficiencies and inconsistencies, high management overheads, uncontrollable costs, security blind spots, and loss of control. Organizations need to ensure that cloud security isn’t being implemented in a disjointed, piecemeal way.

Cloud Security Must Be Proactive, Not Reactive

According to the Thales 2025 Data Threat Report, 64% of organizations cite cloud security as their most pressing concern, since both SaaS data and cloud storage remain top attack targets. Losing sensitive data is the number one security concern for entities moving to the cloud. Data Loss Prevention (DLP) and encryption are top security controls, but how encryption keys are managed is of utmost importance.

Businesses need to establish who controls their encryption keys, where they are stored, and, importantly, can they retrieve them if needed—or are they locked in by a cloud provider?

The Thales DTR report echoes that sentiment; secrets management emerged as the top security challenge for DevSecOps engineers. According to Gartner, by 2027, more than 60% of organizations will adopt a centralized multicloud Key Management as a Service (KMaaS) to integrate with native CSP key management due to increased impacts of international data residency and privacy requirements.

Are You Asking the Right Questions?

Cloud security is not just an IT problem—it’s a business risk that impacts the entire organization. Businesses need to ask their teams:

• What are we doing to protect our most valuable data and IP in the cloud?
• How can I improve my security across all clouds while complementing cloud-native security?
• What is the best approach to deploying encryption and key management?
• Who actually controls our encryption keys?
• How are we ensuring compliance with evolving regulations?

The businesses that proactively address these questions will not only protect their data but also secure their competitive advantage for years to come. The question, is are you one of them?

Next steps

• Learn how to leverage the cloud without giving up control
• Discover best practices for cloud data protection and key management
• Explore Thales cloud security solutions
• Speak to a Thales cloud security expert

Brian Robertson | Principal Product Marketing Manager
More About This Author > basic

The post Your Data, Your Responsibility: Securing Your Organization’s Future in the Cloud appeared first on Security Boulevard.

Understanding the Realm of Non-Human Identities in Cloud Security Is your organization fully prepared to confront the new wave of cloud security challenges? If your answer is uncertain or negative, have you considered transforming your cybersecurity strategy to include Non-Human Identities (NHIs) and secrets management? Imagine the NHIs as ‘tourists’ traveling, with ‘passports’ being their […]

The post Adapting to New Security Challenges in the Cloud appeared first on Entro.

The post Adapting to New Security Challenges in the Cloud appeared first on Security Boulevard.

Feeling Overwhelmed By the Complexity of Cybersecurity? Are you one of the many professionals struggling to stay ahead of increasingly complex and evolving cybersecurity threats? If so, you’re not alone. The task of securing data and applications, particularly in the realm of the cloud, becomes more of a daunting task with each passing day. However, […]

The post Feeling Relieved with Solid Secrets Management appeared first on Entro.

The post Feeling Relieved with Solid Secrets Management appeared first on Security Boulevard.

Why is Identity Theft Prevention a Vital Component of Good Security? Have you ever considered the potential cost of a security breach and the resulting identity theft? According to the Federal Trade Commission (FTC), identity theft affected 4.8 million people in 2020, resulting in a financial loss of a staggering $56 billion. This striking statistic […]

The post Getting Better at Preventing Identity Theft appeared first on Entro.

The post Getting Better at Preventing Identity Theft appeared first on Security Boulevard.

Does your Organization Struggle with Compliance? If so, you’re not alone. Compliance with cybersecurity regulations often involves navigating a complex web of rules, many of which are constantly changing. This can be a burdensome task for any organization, particularly those operating. But what if there was a way to alleviate this burden? Enter the field […]

The post Relaxing the Burden of Compliance with Automation appeared first on Entro.

The post Relaxing the Burden of Compliance with Automation appeared first on Security Boulevard.

Learn the 10 most overlooked SaaS security risks, including shadow tenants, unmanaged identities, and risky OAuth scopes, and how to detect and reduce them.

The post 10 SaaS Security Risks Most Organizations Miss | Grip appeared first on Security Boulevard.

by Source Defense Don’t Trust Your Online Revenue Channel to Sub-par Solutions for eSkimming Security (Beware the big box “me too” solutions) As PCI DSS 4.0.1 enforcement has driven demand for eSkimming security and compliance controls (also known as client-side protection), several big-box CDN and “swiss army knife” security vendors have rushed to capitalize –

The post Revenue Risk Hidden in Fly by Night New eSkimming Tools appeared first on Source Defense.

The post Revenue Risk Hidden in Fly by Night New eSkimming Tools appeared first on Security Boulevard.

Customers using Application Detection and Response (ADR) technology blocked a remarkable number of attacks over the past month. For the second time since we began writing this monthly report, we’ve seen a massive escalation of attacks against a small number of applications, and all of the attacks were blocked. 

The post ADR Blocks Spike in Cyber Attacks and Sharp Rise in Path Traversal Attacks | April Attack Data | Contrast Security appeared first on Security Boulevard.

via the inimitable Daniel Stori at Turnoff.US!

Permalink

The post Randall Munroe’s XKCD ‘Modern’ appeared first on Security Boulevard.

Docker remains a cornerstone of modern development environments, helping teams containerize applications, speed up delivery pipelines, and standardize across systems. But as container usage grows, so do concerns about software supply chain security, dependency management, and image provenance.

The post Developing with Docker and Sonatype: Building secure software at scale appeared first on Security Boulevard.

Stephen Klein didn’t just stir the pot. He lit a fire.

Related: Klein’s LinkedIn debate

In a sharply worded post that quickly went viral on LinkedIn, the technologist and academic took direct aim at what he called the “hype-as-a-service” business … (more…)

The post MY TAKE: Semantics aside, “agentic AI” is already reshaping how we work, think, envision what’s next first appeared on The Last Watchdog.

The post MY TAKE: Semantics aside, “agentic AI” is already reshaping how we work, think, envision what’s next appeared first on Security Boulevard.

Struggling with Auth0's pricing or technical limitations? This comprehensive guide analyzes the top commercial and open-source authentication alternatives for 2025, helping you select the perfect solution based on your specific technical requirements, deployment preferences, and budget constraints.

The post Beyond Auth0: A Comprehensive Guide to Authentication Alternatives in 2025 appeared first on Security Boulevard.

Author/Presenter: Amit Srour

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – GroundFloor – Prepare For The Apocalypse – Exposing Shadow And Zombie APIs appeared first on Security Boulevard.

Author/Presenter: John Evans

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – GroundFloor – Building Data Driven Access With The Tools You Have appeared first on Security Boulevard.

Each Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In this Exposure Management Academy FAQ, we help CISOs understand exposure management, look at how advanced you might be and outline how to structure a program. You can read the entire Exposure Management Academy series here.

Since we started the Exposure Management Academy in March, we’ve received lots of questions. To provide answers, we launched an exposure management FAQ series in April and we’re following that with a few more questions and answers. 

Do you have a question about exposure management? If so, fill out the form at the bottom of this page and we’ll address your question in a future post.

I’m a CISO. What should I know about exposure management?

This is a fundamental question we hear from many CISOs. In short, exposure management offers CISOs a unified view of the most significant cyber exposures across their organization’s entire attack surface. 

Toxic combinations of preventable weaknesses — including vulnerabilities, misconfigurations and excessive permissions — can lead to substantial business exposure if they’re exploited. To effectively practice exposure management, you need to be able to identify these toxic risk combinations that create attack paths leading to your most valuable assets or administrative privileges. 

Implementing an exposure management program can help you streamline prioritization and remediation efforts, making it easier for your security teams to be proactive about reducing your exploitable attack surface. 

Exposure management helps unify the data produced by disparate proactive security functions, including vulnerability management, web application scanning, cloud security, identity security, OT security and attack surface management.

Ultimately, exposure management improves both security and business results. By delivering comprehensive visibility, a unified view of security data and enriched context regarding asset and identity interdependencies and potential impact, exposure management initiatives enhance productivity and efficiency while decreasing overall costs and exposure.

Want to learn more? Browse the posts in the Exposure Management Academy archive. Every week, we release a new post that focuses on how you can make the most of exposure management.

How do I know how advanced we are with exposure management?

Exposure management includes a lot of things your security team is already doing, like vulnerability management, web application security and attack surface management. Based on the work we’ve done to help organizations implement exposure management, Tenable developed an exposure management maturity model that identifies five stages of exposure management maturity:

Stage 1: Ad hoc

This initial stage is characterized by tools and processes, with significant visibility gaps and reactive response..

Stage 2: Defined

At this stage, you have basic tools, processes and frameworks, with siloed visibility and response..

Stage 3: Standardized

With mature tools and processes, you’re beginning to unify data and add business context.

Stage 4: Advanced

You have unified visibility, with rich business context and some technical context.

Stage 5: Optimized

Your organization has aligned views of exposure, with consistent metrics, reporting, prioritization and workflows.

Which stage fits your current situation? If you’re in the early stages, you’re like most organizations. You can use our maturity assessment to see where you stand. If you’ve moved beyond the early stages, we’d love to hear from you — fill out the form below and tell us your story. 

How should I structure my exposure management program?

These are the four fundamental components of exposure management:

• Strategy: Define the problems exposure management can help you solve and the objectives you want to achieve by implementing an exposure management program or platform. Consider the risks you’re trying to mitigate and the cyber threats that are most relevant to your organization. Then evaluate your team's current exposure management maturity (see above) and identify any gaps in capabilities you’ll need to fill.
• Visibility: You’ll need to enhance your ability to identify all preventable risks (i.e., vulnerabilities, misconfigurations and excessive permissions) and discover all assets, identities and applications across your entire attack surface, including cloud, OT, and IoT environments. A key here is using a central inventory to consolidate and standardize all asset and risk data.
• Insight: A consistent scoring methodology across all risk types and attack surfaces is a critical replacement for the disparate scoring you get with individual tools. You’ll enhance your exposure data with technical and business context so you can prioritize remediation based on the potential business impact of exploitation.

Action: Defining necessary roles and allocating cross-functional resources is a central element of the exposure management journey. Here, you’ll integrate, streamline and activate processes and workflows that will help you identify, prioritize and remediate exposures. Plus, you’ll be able to optimize workflows and track program effectiveness through cross-domain analytics and reporting.

Have a question about exposure management you’d like us to tackle?

We’re all ears. Share your question and maybe we’ll feature it in a future post.

 

MktoForms2.loadForm("//info.tenable.com", "934-XQB-568", 14070);

The post We’re Answering Your Exposure Management Questions appeared first on Security Boulevard.

Innovation is not just a buzzword, it’s a critical driver of growth and competitive advantage. Understanding and implementing the right innovation frameworks can help organizations...Read More

The post 17 Innovation Frameworks Every Business Leader Should Know in 2025 appeared first on ISHIR | Software Development India.

The post 17 Innovation Frameworks Every Business Leader Should Know in 2025 appeared first on Security Boulevard.

Open MPIC is an open-source framework designed to help Certificate Authorities (CAs) meet new Multi-Perspective Issuance Corroboration (MPIC) requirements from the CA/Browser Forum. Developed with contributions from Princeton and Sectigo, it helps mitigate BGP hijack risks through globally distributed validation, quorum logic, and flexible deployment options. Open MPIC is a practical, evolving solution that advances the resilience of the WebPKI.

The post Open MPIC: The open-source path to secure Multi-Perspective Issuance Corroboration appeared first on Security Boulevard.

Roblox is accused of secretly tracking the data of children without consent, an activity that the plaintiffs say violates their privacy under federal law. 

The post Tracking Accusations May Have Roblox Back in Court  appeared first on Security Boulevard.

SK Telecom faces a major data breach affecting millions. Learn how to protect your USIM data and stay secure with our comprehensive guide.

The post SK Telecom USIM Data Compromise: Millions of Customers at Risk appeared first on Security Boulevard.