Understanding the broken links in the software supply chain What is SBOM? Think of a Software Bill of Materials (SBOM) as a shopping list for computer programs. It lists all the things a program is made of, helping to keep it safe and reliable. A Software Bill of Materials (SBOM) is a list…

In this story, we will look at the standards related to the information security metrics, how to establish the information security program metrics, discuss different audiences to consume those metrics, and look at the metrics for operational users and board of directors. What is the Information Security Metric? An information security metric is a measurable way…

Concept of Vendor Lock-in and Lock-out and Importance Vendor Lock-In occurs when a company gets stuck using one specific technology or service from a particular cloud provider. This makes it hard and costly to switch to a different provider or change the technology. …

Concept “Instant-on gaps” security for virtual machines (VMs) refers to the security considerations and potential vulnerabilities that can arise during the time a VM takes to become operational after it’s started or powered on. These gaps represent periods of vulnerability when the VM is not yet fully protected and may be…

Off-hours Policy to automatically turn on and off the cloud resources Your Organization has successfully developed, tested, staged, and deployed the applications using the resources in the public cloud. Due to the fact that the segregation of networks is required between the environments, it is best to create separate AWS…

Tag your cloud resources using auto-tag-user action item Organizations have acknowledged that they have a known problem where resources in the public cloud are not tagged as per the established resource tagging policy. The reason for this includes the developers accidentally forgetting to tag, not taking it seriously, too many…

Understanding the CyberSecurity Risks Related to Supply Chain In the previous story, we looked at some basics of supply chain security risks. …

Understanding the security risk within the supply chain The supply chain security risk is real and it is very important that an organization understands the risks of doing business with the suppliers, vendors, partners, and third parties. In this story, we will understand the concept by taking a simple example. …

Themes and Attributes Themes referred to the controls categorization that is (1) Organizational controls (Clause 5) (2) People controls (Clause 6) (3) Physical controls (Clause 7) and (4) Technological controls (Clause 8). Attributes are basically another view of the controls that is demonstrated in a table format. It consists of 5 values- (1)…