The majority of threats related to the authentication process are associated with passwords and password-based authentication methods. But broken authentication also causes a significant amount of vulnerabilities. Broken authentication occurs when the implementation of the authentication process is flawed. Unfortunately, this is usually hard to discover, and can be more severe than the risks associated with passwords.

For a Cloud Service Provider (CSP) to be FedRAMP accredited, it must complete the following six phases. They are diagnostic assessment, boundary and architecture review, documentation, technical remediation, testing preparation & residual risk, and Final Authorization to Operate.

Just like any compliance or set of regulations, FedRAMP uses many acronyms and key terms to describe processes, standards, and regulations. This article explains key terminology that is used in the FedRAMP framework. You may already be familiar with some of these compliance terms and acronyms from other security frameworks.

A selection of this week’s more interesting vulnerability disclosures and cyber security news. For a daily selection see our twitter feed at #ionCube24. Those movies where they zoom in and sharpen the CCTV footage to absolute clarity is one step closer! (just kidding).

Google adopted its cloud infrastructure, Google Cloud Platform (GCP), to be compliant with FedRAMP. GCP earned a FedRAMP High authorization to operate (ATO) for several cloud products in a handful of locations and has uplifted the current FedRAMP Moderate services to more products and locations. Government agencies can now work with the highest level of classified information using GCP.

The current FedRAMP Authorization process is a struggle. First, you must manage multiple regulatory standards and frameworks, which change over time. Second, regulatory standards and frameworks overlap in scope and can often conflict and be difficult to manage together. And, lastly, information systems continue to increase in size and complexity.