Threat Stack Blog and Cloud Security News

Continuous security monitoring for your cloud.

Travis Wilkins

As Threat Stack’s Director of Product Marketing, Travis has 17 years of experience in technology and security in both the enterprise and consumer markets working at Symantec, Everbridge, and other SaaS technology businesses. With a focus on building go-to-market strategies that support customer needs, Travis has supported verticals including technology, healthcare, finance, and government, amongst others. Having attended St. Lawrence University for his BA and the Claremont Graduate University for his MBA, Travis is based in southern New Hampshire with his wife and two sons.

Recent Posts

Prevention Isn't Enough. Why All Companies Need Detection Too

by Travis Wilkins , posted in Automated Monitoring and Alerting, Cloud-Based Detection, Preventive Security Controls

Prevention Detection Blog Banner.png

How would you know if your prevention methods failed to catch a critical threat? One of two ways: Either a customer, an auditor, or another third party would find out about it (an embarrassing situation for you) or  you could get lucky and find it yourself — which is rare without detection.

Prevention techniques and technologies (e.g., security controls, firewalls, encryption, antivirus), are designed to block an attacker from getting in, and can be critical to your security strategy. However, they can’t be the only defense you have in place. If history is any indicator (and we believe it is), attackers will find a way in. So, as a defender, you also need the ability to detect threats once they are inside your modern cloud infrastructure. That’s why companies are shifting their focus to detection techniques and technologies (e.g., monitoring, alerting).

In this post, we’ll explain what detection does that prevention cannot, what to watch out for if you’re relying on prevention alone, and how you can use them in parallel.

Read More [fa icon=long-arrow-right"]

Aug 15, 2017 9:49:36 AM

[fa icon="comment"] 0 Comments

9 Common Questions About SOC 2 Compliance

by Travis Wilkins , posted in Compliance, SOC 2 Compliance

SOC 2 Compliance Blog Banner.png

SOC 2 compliance is a crucial framework for technology and cloud computing companies today. As with many other compliance mandates, it is not a simple connect-the-dots proposition, but rather a complex set of requirements that must be reviewed and carefully addressed. But it doesn’t have to be overwhelming. Below, we’ll break down nine of the most common basic questions that we hear about SOC 2. Think of it as a 101 on SOC 2.

Read More [fa icon=long-arrow-right"]

Aug 1, 2017 9:53:56 AM

[fa icon="comment"] 0 Comments

Not Ready for Cloud Security? Here Are 5 Things You Can Do in the Meantime

by Travis Wilkins , posted in Cloud Security, Cloud Migration

Not Ready Cloud Security Blog Banner.png

If you are currently running an on-premise or hybrid environment with an eye to eventually making a complete transition to the cloud, you may be feeling a bit overwhelmed by everything that needs to change in order for your security posture to be appropriate for this new environment. In this post, we’re going to explain how you can start where you are, take small but meaningful steps, and still make important progress toward where you want to be — operating securely in the cloud.

Without trying to boil the ocean, here are five key steps you can take to gently kickstart your transition toward a fully secure, all-cloud environment, no matter where you are today.

Read More [fa icon=long-arrow-right"]

Jul 25, 2017 12:29:15 PM

[fa icon="comment"] 0 Comments

5 Principles for Running Securely in a Multi-Cloud Environment

by Travis Wilkins , posted in Cloud Security, AWS, Azure, Google Cloud, Security in Multi-Cloud Environments

Multi-Cloud Blog Banner.png

AWS has long ruled the cloud platform game. But today more and more companies are branching out and using additional providers as well. Often this isn’t a matter of replacing one with another, but of different business requirements (such as managing risk and costs) being suited to different cloud vendors. Other factors for using more than one provider center on the fact that vendors work to price their offerings competitively and continually add new features. Additionally, many organizations that run Windows are offered free Azure credits. So why not take advantage and reduce your overall cloud costs?

There’s nothing wrong with running a multi-cloud environment — in fact doing so may be part of a well-crafted strategy  but when you do so, you want to make sure that you are taking appropriate security precautions. In this post, we’ll cover five principles you should strive for when you make the move to a multi-cloud environment. But first, let’s take a look at the major players.

Read More [fa icon=long-arrow-right"]

Jul 18, 2017 10:45:51 AM

[fa icon="comment"] 0 Comments

5 Considerations for Evaluating a Cloud Security Solution

by Travis Wilkins , posted in Selecting Cloud Security Solutions, Selecting Cloud Security Solution Providers

Cloud Security Solution Blog Banner.png

Many companies today are turning to cloud security solutions — from security monitoring platforms to orchestration tools to alerting systems — in order to manage both strategic and tactical security initiatives. Purpose-built technological solutions — especially if you’re a company with limited in-house expertise and resources — can help you stay on top of security without having to hire more people or add to your already long list of things to do.

Before choosing a cloud security solution, however, you need to take many considerations into account — some that focus on the solution itself, and others that focus more squarely on the provider of the solution (because, ultimately, you can’t separate the solution from the provider). In this post, we’ll cover some of the most important considerations.

Read More [fa icon=long-arrow-right"]

Jul 7, 2017 11:23:36 AM

[fa icon="comment"] 0 Comments

3 Key Points on How Vulnerability Management Can Help You Become Compliant

by Travis Wilkins , posted in Vulnerability Management, Regulatory Compliance

Vuln Management Compliant Blog Banner.png

Two interesting observations:

The average number of days that attackers were present on a victim’s network before being discovered is 146 days. (FireEye)

At Threat Stack, we have observed that a majority of the market is moving toward automated security vulnerability and configuration scanning.


You would be hard pressed to come by a compliance framework that did not require you to have a system to detect and manage vulnerabilities. Vulnerabilities are as old as technology itself, so to call yourself compliant, you first need to demonstrate that you have a sound vulnerability management program in place.

Vulnerability management systems identify common vulnerabilities and exposures (also known as CVEs), alerting you when a server or package is at risk so you can patch it immediately.

Simply by having a vulnerability management program in place, you can often satisfy many other major compliance requirements. In this post, we’ll explain how vulnerability management helps you to become compliant.

Read More [fa icon=long-arrow-right"]

Jun 23, 2017 11:03:51 AM

[fa icon="comment"] 0 Comments

Risk Acceptance & Business Payout

by Travis Wilkins , posted in Risk Management, Cyber Security Awareness, Risk Acceptance, 4 Rs Risk Management Methodology

Gartner Summit 2017 Blog Banner.png

Key Takeaways From the Gartner Security & Risk Management Summit 2017

I just got back from the Gartner Security & Risk Management Summit with three key takeaways that I would like to share. Overall, industry leaders indicate that cybersecurity should be treated as a business function, not as a tax, and to achieve this, we need to base our security approach on:

  1. An attitude and culture of Risk Acceptance
  2. A Risk Management Methodology that enables us to detect and manage risk
  3. Effective alignment with the CEO and BoD by making risk-based decisions focused on business goals

Let’s get into the details.

Read More [fa icon=long-arrow-right"]

Jun 15, 2017 12:31:12 PM

[fa icon="comment"] 0 Comments

How to Prioritize Security Tasks When You Have Limited Resources

by Travis Wilkins , posted in Continuous Security Monitoring, Automation, Cloud Security Maturity Model, AWS Configuration Auditing, Visibility

Security Tasks Blog Banner.png

Many organizations have limited resources (time, personnel, and money) for IT, and oftentimes only a small portion of that is devoted to security. Given the limited resources available to create and execute a best practice security plan, you will need to face up to these constraints and prioritize security tasks.

But how, exactly, should you go about strategically prioritizing your security needs? How can you determine which aspects need to be addressed first and which can be dealt with later? After all, aren’t they all important?

Read More [fa icon=long-arrow-right"]

Jun 7, 2017 11:08:48 AM

[fa icon="comment"] 0 Comments

5 Key Takeaways From DevOpsDays Austin 2017

by Travis Wilkins , posted in Cloud Security, DevOpsDays Austin 2017

DevOpsDays Austin Recap 2017 Blog Banner.png

Once again Threat Stack was pleased to be a sponsor and a participant at DevOpsDays Austin 2017 on May 4 & 5. Right off the bat it’s clear that this vibrant conference is continuing to expand, with its year over year increase in the number of attendees (650) and sponsors (40). Of particular note: The importance that people in the DevOps space are placing on security is definitely continuing to grow — and I put together five key observations about security, compliance, and the way DevOps teams operate. So without further commentary, here’s what I learned at DevOps Days Austin.

Read More [fa icon=long-arrow-right"]

May 15, 2017 11:11:29 AM

[fa icon="comment"] 0 Comments

Subscribe via email:

Posts by Topic

see all