Blog

Leaders from Intel, Microsoft, Forrester Research and NIST Among Presenters at Upcoming Premiere European Cloud Security Event

DUBLIN, IRELAND – April 25, 2016 – The Cloud Security Alliance (CSA), in collaboration withFraunhofer FOKUS and ENISA, today announced the presentations and speaker line up for the upcoming SecureCloud conference. The SecureCloud 2016 conference is scheduled for May 24 – 25 at Aviva Stadium in Dublin, Ireland. SecureCloud is the only European conference focused exclusively on cloud security and aims to provide an opportunity for government experts, industry experts, and corporate decision makers to discuss and exchange ideas about how to shape the future of cloud computing security.

“Even with all the awareness of the benefits of cloud technology, an overwhelming number of companies still have concerns about security, privacy and data management in the cloud and conferences such as this one are an important forum to address, discuss and resolve these concerns,” said Daniele Catteddu, Chief Technology Officer of the CSA. “SecureCloud will bring together some of the cloud industry’s top experts and thought leaders and we expect that it will draw substantial interest from the industry. We anticipate that this year’s event will further grow this body of knowledge and help us achieve a more trusted and secure cloud environment.”

An initial line up of featured speakers include:

• “Securing the Cloud of Tomorrow” by Raj Samani, VP and CTO for Intel Security
• “Privacy & Security in the Cloud: Customer Rights and Governments’ Lawful Access to Data” by John Frank, Vice President, EU Government Affairs at Microsoft
• “Understanding the Crux – Abuse of Cloud Storage Services for Targeted Cyber Attacks” by Aditya K. Sood, Director of Security and Cloud Threat Labs at Elastica.
• “Flying Through a Cloudy Sky” by Michaela Iorga, Senior Security Technical Lead for Cloud Computing at NIST.

Additional featured presentations will also be given by Laura Koetzle, Vice President and General Manager‬, Forrester Research; Vinay Patel, Global Head of Information Security Risk Management at Citi Technology Infrastructure; Dr. Kuan Hon, Senior Researcher at QML, Nathaly Rey, EMEA Trust Manager, Google for Work, EMC and Jim Reavis, Co-founder and CEO of the CSA.

This year’s event will also include a number of key panel presentations focused on some of the most emerging trends and issues in cloud computing including:

• “Cloud Computing Compliance Controls Catalog (C5)” by Information Security Expert Patrick Grete, Clemens Doubrava of Bristish Standards Institute (BSI) and Charles Schulz of Agence nationale de sécurité des systèmes d’information (ANSSI)
• “Financial Services in the Cloud” by Craig Balding of Barclays, Mario Maawad of Caixa Bank and Douglas Taylor of Citi

For more information on SecureCloud 2016, including registration details and schedule, please visithttps://csacongress.org/event/securecloud-2016/

Media Contact

Kari Walker for the CSA
kari@zagcommunications.com
703.928.9996

[Cloud Security Alliance Research News]

Interest in IT governance is increasing due to the changing role and relevance of IT within organizations for supporting, sustaining and expanding business. According to the IT Governance Institute, IT governance is the form of leadership, organizational structures and processes that ensure an organization’s IT sustains and extends the organization’s strategies and objectives. While management’s role in IT governance is imperative, practitioners and academics have also long advocated board involvement in IT governance. However, the literature shows that boards may not be very involved in IT governance. This could be because board members may not have the needed IT expertise to provide direction on important operational and strategic IT-related issues. Boards may also not be very involved because IT does not get put on the board’s agenda or board members simply do not understand their roles regarding IT governance.

Our recent Journal article addresses this issue of the board’s role in IT governance by examining the charters of board-level IT committees. We reviewed the committee charters to analyze the prescribed roles and responsibilities of these committees. If the charters are not clear or complete, board members may misunderstand their roles. We found that only 23 Fortune 500 companies had board-level IT committees at the time of our study. We used content analysis to categorize the documented roles and responsibilities according to the 5 IT governance domains:  strategic alignment, value delivery, resource management, risk management and performance measurement. Our Journal article contains our findings and discusses the opportunities for these committees to improve their governance roles.

A topic that we are interested in beyond the scope of our article is the IT auditor’s role in ensuring the effectiveness of these committees or the board at large in terms of IT governance. During an IT governance audit, the auditor should examine the committee charters to ensure committees are set up to fulfill best practices and COBIT-related IT governance roles. Examining meeting minutes and matching them to the prescribed roles could further ensure these committees are effective in their oversight role. In fact, IT-related issues may be discussed and documented in board meeting minutes regardless of whether the company has a specifically designated board-level IT committee. We hope to explore some of these issues in the future.

Read Nancy Lankton and Jean Price’s recent Journal article:
“Board-level Information Technology Committees,” ISACA Journal, volume 2, 2016.

Nancy Lankton, CISA, CPA, and Jean Price

[ISACA Journal Author Blog]

Time: 15 minutes
Prizes: 10 CCSK Tokens
Closing Date: May 23^rd

Participate Now

Abstract:

Current state of SaaS security – with several years of cloud adoption in many organizations, approaches to security have been evolving rapidly. The purpose of this survey is to look at the specific concerns, policies, and controls that enterprises are using. The goal will be to answer the question, what are today’s enterprises doing to mitigate risk across both sanctioned and unsanctioned cloud applications?

[Cloud Security Alliance Research News]