FedRAMP Compliance: Beyond the Letter of the Law

When I mention “compliance” to most people, I often get that cringe — the one that says “ugh, what a pain.” I’m empathetic to folks who are just trying to get the job done, and whose only interaction with compliance is being told somewhere along the line that they have got to jump through more hoops. But having lived information security for several years, and having previously had some experience with risk frameworks and compliance efforts, I’ve developed a different viewpoint. My colleagues in security immediately understand and connect with the statement that with compliance, “there is the letter of the…

Data Mapping: A Tricky First Step to GDPR Compliance

Last Thursday, the one year countdown to GDPR compliance officially began. For those of you still wondering what all the fuss is about, new research commissioned by Centrify has revealed that public companies suffer on average a 5% share price drop immediately following disclosure of the breach. The EU General Data Protection Regulation (GDPR) will ensure there’s no room to hide: as of 25 May 2018, if you’ve been breached you must notify the Supervisory Authority within 72 hours of becoming aware, unless particular circumstances apply. To help organisations figure out a plan of action, Centrify is running a monthly…

Five Key Takeaways from AWS re:Invent 2016

I had the honor of attending the Amazon Web Services (AWS) re:Invent 2016 and wanted to highlight some of my key takeaways from the conference. Since Centrify was a sponsor, I was able to talk with many folks with an interest in learning more about Centrify’s announcement, “Centrify Delivers Innovative Capabilities and Best Practices to Streamline and Secure Adoption of Hybrid Cloud.” 1. AWS is Innovative as a Large Company A good proxy for innovation is the number of features and products a company releases. AWS currently has tens of thousands of employees, and AWS announced 24 new products at the AWS Re-Invent show….

Time to Take Cybersecurity Seriously

The recent Institute for Critical Infrastructure Technology (ICIT) White Paper titled “Cybersecurity Show Must Go On: Surpassing Security Theatre and Compliance and Minimal Compliance Regulations,” authored by James Scott, Sr. Fellow, ICIT, and Drew Spaniel, Researcher, ICIT, highlights organizations’ lack of commitment to invest in strong security tools that have real impact to their organization’s security position. Despite the cyber breaches over the last several years that confirm that identities are the root of most breaches, organizations fail to deal with the real problem head on. Organizations leverage technology to increase the productivity of associates that expand the perimeter to…

How Centrify Can Help AWS Customers Comply with New HIPAA CSP Regulations

New HIPAA regulations are driving heightened security around electronic protected health information (ePHI) and Cloud Service Providers (CSP). These regulations detail the types of security for data in the cloud, as you might expect, but they also focus on securing and controlling the access to cloud systems, infrastructure and data. In the simplest terms, this means healthcare companies and their business associates (BA), need to focus on securing and managing resources IN the cloud, as well as securing and managing access TO the cloud. This can be broken down to mean that healthcare companies need to: Ensure cloud resources are…

How To Protect Sales Ops Assets from Data Breach

If you’re a sales operations professional, you sit at the crossroads of user access to vital, proprietary information — to applications (whether on premises or cloud), including all those plugins to your CRM system.  There’s the interface/integration with your finance system, the customer success app, the technical support app, the integration with channel partners, the business intelligence app, the access you provide third party vendors to assist with management of their app…the list goes on. If a bad actor gets access to any one entry point, you’re in trouble.  Compromised credentials are the number one cause of data breaches, according…