How CISA is approaching authentication and cloud security in the era of great power competition?
summary
Argues for a safety‑engineering approach to identity and cloud security, saying measured defect rates drive targeted fixes; recommends phishing‑resistant authentication (FIDO, PIV, PKI) which organizations that adopt see credential‑theft attacks largely disappear. Describes the Secure Cloud Business Applications effort: published policy baselines for Microsoft 365/Google Workspace and an open tenant evaluation tool that gathers config state, evaluates it with OPA Rego, and aggregates results across agencies to track progress.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker intro
- 1:06Tale of two security failures
- 3:55Safety mindset in cybersecurity
- 6:40Applying safety engineering to authentication
- 11:13Safety engineering in software development
- 11:35Shared responsibility in cloud security
- 13:01Secure Cloud Business Applications initiative
- 16:33Moving beyond shared responsibility
- 19:04Simplifying security configurations
- 20:09Demand for secure-by-design products
- 22:55Organizational security culture
- 23:17Safety engineering in technology
- 23:59Motivating security improvements
related talks
52mThe Hacker's Guide to Cloud Governance
25mSecurity, Identity - Back to the Drawing Board?
26mCloud Security Lessons
31mThe Product Security Imperative: Lessons from CISA
40mHow CISA Is Charting a Path Toward Defensible Infrastructure
44mCloud Security Essentials
34mDesigning Secure Applications in the Cloud
50mArchitecting a secure cloud framework