The Cloud Security Alliance (CSA) is the world&rsquo;s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, certification, events and products. CSA&rsquo;s activities, knowledge and extensive network benefit the entire community impacted by cloud &mdash; from providers and customers, to governments, entrepreneurs and the assurance industry &mdash; and provide a forum through which diverse parties can work together to create and maintain a trusted cloud ecosystem.

Cloud Security Alliance

Prisma&reg; Cloud is the industry&rsquo;s most comprehensive cloud-native application protection platform (CNAPP) with the broadest security and compliance coverage&mdash;for applications, data, and the entire cloud-native technology stack&mdash;throughout the development lifecycle and across hybrid and multi-cloud environments. Our integrated approach enables security operations and DevOps teams to stay agile, collaborate effectively, and accelerate secure cloud-native application development.

Prisma Cloud

At Elastic, we see endless possibility in a world of endless data.&nbsp; And we use the power of search to help people and organizations turn that possibility into results.&nbsp;
As the leading platform for search-powered solutions, we help everyone &mdash; organizations, their employees, and their customers &mdash; accelerate the results that matter.
With solutions in Enterprise Search, Observability, and Security, we help people find what they need faster, keep mission-critical applications running smoothly, and protect against cyber threats.
Wherever and however our customers put Elastic to work, we then help search, solve, and succeed &mdash; at scale and on a single platform.
That's the power of Elastic.

Elastic

Rapid7 is creating a more secure digital future for all by helping organizations strengthen their security programs in the face of accelerating digital transformation. Our portfolio of best-in-class solutions empowers security professionals to manage risk and eliminate threats across the entire threat landscape from apps to the cloud to traditional infrastructure to the dark web. We foster open source communities and cutting-edge research&ndash;using these insights to optimize our products and arm the global security community with the latest in attacker methodology. Trusted by more than 10,000 customers worldwide, our industry-leading solutions and services help businesses stay ahead of attackers, ahead of the competition, and future-ready for what&rsquo;s next.

Rapid7

Uptycs, the first unified CNAPP and XDR platform, reduces risk by prioritizing your responses to threats, vulnerabilities, misconfigurations, sensitive data exposure, and compliance mandates across your modern attack surface--all from a single UI. This includes the ability to tie together threat activity as it traverses on-prem and cloud boundaries, thus delivering a more cohesive enterprise-wide security posture.&nbsp;
Start with your Detection Cloud, Google-like search, and the attack surface coverage you need today. Be ready for what's next.&nbsp;
Shift up your cybersecurity with <a href="https://www.uptycs.com/">Uptycs</a>.
&nbsp;

Uptycs

We are leaders in data security and privacy. Our breakthrough platform transforms your hybrid-cloud into a high-trust environment where data is always encrypted and code is verified for authenticity. With Anjuna, you maintain data confidentiality anywhere you run your apps and protect against a wide range of security risks, such as insider threats, secret zero exposure and zero day exploits.&nbsp;
Confidential Computing is a new breakthrough technology that shields data during runtime. It uses modern CPUs to create a secure enclave in which data is isolated and encrypted in memory, making it invisible to unauthorized processes and people.   &nbsp;
Anjuna is your EASY BUTTON to a highly secure, high-trust cloud environment with complete data confidentiality. We make your hybrid- cloud the safest place to run even the most sensitive apps.&nbsp;

Anjuna Security

JAMES REAVIS

Welcome

The rise of cloud computing has led to large amounts of our software being utilized as a service. At the same time, the trend towards instrumenting much of the physical world with embedded computing has led to centrally managed code that is deployed pervasively. In this talk, Dan Geer ruminates on the questions of software location, provenance and control and how this might impact cybersecurity in the years to come.

Dan Geer

Whither Software?

Organizations looking to reap the benefits of public cloud economics are still challenged by the risks of data exposure associated with having shared responsibility with the cloud service provider over their infrastructure. The crude reality is that anyone or any process with root access can easily exfiltrate data, code and secrets that sit unencrypted in running processes, regardless of other methods of protection and encryption. These concerns continue to keep many modern organizations from migrating highly sensitive workloads to the cloud, which in many cases stalls their ability to innovate at maximum capacity.
A new innovative technology - Confidential Computing - offers a breakthrough approach to completing the data protection trifecta by encrypting data in-use using hardware-level isolation technologies embedded in modern CPUs, thereby achieving &ldquo;tip-of-the-spear&rdquo; security. As cloud service providers embrace these advancements and make them widely available, enterprises are looking to understand 1. What are the best use cases to begin their Confidential Computing journey, and 2. What are available software tools to adopt and abstract this new hardware-level paradigm in order to minimize complexity, optimize performance, and maximize flexibility to scale in a hybrid cloud world.
Join Mark Bower, VP of Product at Anjuna Security, for this keynote presentation on the fundamentals of Confidential Computing.

Mark Bower

Achieve Tip-of-the-Spear Security with Confidential Computing

As we look back on our time spent endlessly running during the pandemic, we see a lot of common themes when it came to securing infrastructure and addressing concerns when it came to risks. But we are still running and playing catch up. In this panel, we will discuss the Top Threats Pandemic 11 report, and how each of those risks have been organized by our panelists, or what they did to move into the future to ensure security and compliance.&nbsp;

Mandy Andress

Alex S. Getsin

Alon Nachmany

Panel: Playing Catchup Post Pandemic: Organizing the Top Risks and Concerns in Cloud 

CSA's Top Threats report provides multiple risks and threats that thousands of enterprises see daily and continue to struggle with mitigating. In this talk, we will discuss the identification of the most recent top threats and what it means to better manage them from an executive or board level down to the team level.&nbsp;

Sean Heide

What the Flunk? Failing to Identify Risks and Threats to Enable Business Decisions. A Deeper Look at Top Threats. 

Organizations can meet compliance/regulatory responsibilities in the cloud, but still be susceptible to a threat actor escalating privileges, exfiltrating data, targeting you for ransomware. Threat actors today have become cloud experts. Their TTPs are evolving quicker than most want to believe. Therefore it's time we start thinking like them and mimicking detection on their attack behavior.

Taylor Bianchi

Thinking Like an Attacker in the Cloud

ChatGPT has recently taken the world by storm. Quick school projects, coding projects, and other miscellaneous yet difficult tasks have seemingly become easier to produce and at a much quicker pace than it would take a...human. But what does this mean when we discuss security side by side with this growing trend of AI. In this panel, we will analyze an overall discussion on the topic of ChatGPT and its impact on cloud, technology, and the security landscape, and what we have to expect in the future.&nbsp;

John Yeoh

Lars Ruddigkeit

ERIC COHEN

Aaron Bregg

ChatGPT Security Implications 

Closing

Illena Armstrong

How do you know what to invest in next, or whether the time and energy that you&rsquo;re spending on a security technology or program is a good investment? Learn how veteran CSOs think about security investments, and develop your own rubric for evaluating where to best make your next security improvement.

Andy Ellis

How to CISO in the Cloud

Often times organizations know security controls need to be applied, but the order and meaning for doing so is often dissociated to the businesses needs. In this panel, we will dissect the need for knowing your industry, researching and prioritizing specific threat actors to your business, and creating a meaningful process for applying mitigations to them.&nbsp;

Ibrahim Al-Asaker

Shruti Kulkarni

Panel: Managing TTP's and Applying Organizational Structure to their Mitigations 

Threat modeling is a key process for understanding your enterprises most critical systems as well as applying basic scenarios should those systems fall under attack. In this keynote, Jon-Michael Brook will run through such scenarios, and show the impact and importance of gamifying your threat modeling life cycles to create a positive impact on your employees.&nbsp;

Jon-Michael Brook

CSA Keynote: Gamifying the Threat Landscape: A Guide to Enterprise Threat Modeling 

Argo CD empowers the community to adopt GitOps for Kubernetes. Argo CD triggers automated operations for cluster reconciliation by monitoring changes in git for images and artifacts such as Helm Charts. While Argo CD enables hyper-automation for cluster deployment, how can teams ensure they aren't slowed down by requirements such as security, privacy, and compliance? In this talk, Upkar Lidder will discuss how to leverage the power of the Open Policy Agent to automate the delivery of secure, compliant deployments. Argo CD with OPA can ensure that any Helm charts and container images to be deployed are compliant with the established policies. Upkar will also demonstrate a new approach of self-healing GitOps, which leverages OPA's Rego language to remediate risks and violations on the fly.

Agenda

Speakers31 Speakers

Dan Geer

JAMES REAVIS

Illena Armstrong

Hillary Baron

Josh Bressers

Jon-Michael Brook

Josh Buker

Sean Heide

David Linthicum

Kurt Seifried

Jaye Tillson

John Yeoh

Mandy Andress

Alex S. Getsin

Aaron Bregg

Steve Markey

John Spiegel

Alon Nachmany

Martijn Baecke

Andy Ellis

Yaniv Bar-Dayan

Mark Bower

Taylor Bianchi

Ami Luttwak

Shruti Kulkarni

Ibrahim Al-Asaker

Raj Samani

Travis Smith

Upkar Lidder

Lars Ruddigkeit

ERIC COHEN

Booth6 Booth

Cloud Security Alliance

Prisma Cloud

Elastic

Rapid7

Uptycs

Anjuna Security

Agenda

Speakers.css-kpgy8p{margin:0;font-size:1.4rem;font-weight:500;line-height:1.5;color:#474753;font-family:'Poppins',sans-serif;margin-left:0.8rem;}31 Speakers

Dan Geer

JAMES REAVIS

Illena Armstrong

Hillary Baron

Josh Bressers

Jon-Michael Brook

Josh Buker

Sean Heide

David Linthicum

Kurt Seifried

Jaye Tillson

John Yeoh

Mandy Andress

Alex S. Getsin

Aaron Bregg

Steve Markey

John Spiegel

Alon Nachmany

Martijn Baecke

Andy Ellis

Yaniv Bar-Dayan

Mark Bower

Taylor Bianchi

Ami Luttwak

Shruti Kulkarni

Ibrahim Al-Asaker

Raj Samani

Travis Smith

Upkar Lidder

Lars Ruddigkeit

ERIC COHEN

Booth.css-7spp8{margin:0;font-size:1.4rem;font-weight:500;line-height:1.5;color:#474753;font-family:'Poppins',sans-serif;color:#FFFFFF;margin-left:0.8rem;font-weight:400;}6 Booth

Cloud Security Alliance

Prisma Cloud

Elastic

Rapid7

Uptycs

Anjuna Security

Speakers31 Speakers

Booth6 Booth