DATA SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY
Businesswire | March 28, 2023
AdaCore, a trusted provider of software development and verification tools, today announced the launch of its new RecordFlux technology, designed to ease the development and security of binary communication protocols. The technology comprises a Domain Specific Language (DSL) to precisely describe complex binary data formats and communication protocols, and a toolset to verify specifications and generate provable SPARK code that can be executed on a target CPU.
Through RecordFlux, users can define and implement complex communication protocols and prove security properties, such as memory safety, at much less cost and effort than would be possible with a manual approach. The precision of the RecordFlux DSL ensures that the specifications are unambiguous, the high-level nature of the DSL makes the specifications easily understandable by domain experts, and the expressive power of the DSL can capture the most complex real-world protocols. And since the RecordFlux code generator produces source code in the formal methods-based SPARK language, users can obtain automated proofs of a wide range of security properties in the resulting software. The net effect is more secure and reliable code, at lower cost.
“Interaction between software components is governed by protocol and format specifications. Unfortunately, most specification documents are complex texts written in English which need to be translated to software implementations manually, leaving room for human error,” said Alex Senier, AdaCore’s RecordFlux Team Lead. “Logic errors and critical flaws are often poorly mitigated by the widespread use of unsafe programming languages, resulting in severe security vulnerabilities. With RecordFlux, we aim to provide a solution that saves time and money by automating provable code generation while ensuring the absence of low-level vulnerabilities like buffer overflows that attackers could exploit.”
About RecordFlux
RecordFlux is a toolset for creating high-assurance implementations of binary data formats and communication protocols. The technology includes a Domain Specific Language, a comprehensive toolset, and customized expert support. By using SPARK Pro, developers can take the SPARK code generated from RecordFlux specifications and automatically prove that the code is free of run-time errors and respects the original specification.
Code generated by RecordFlux is also compatible with GNAT Pro Assurance, AdaCore’s complete solution for projects with the most stringent requirements for reliability, long-term maintenance, or certification. The compiler-hardening options provided by GNAT Pro Assurance can be used to mitigate further attacks on network-facing protocol-handling code.
About AdaCore
Founded in 1994, AdaCore supplies software development and verification tools for mission-critical, safety-critical, and security-critical systems.
Over the years, customers have used AdaCore products to field and maintain a wide range of critical applications in domains such as commercial and military avionics, defense systems, automotive, railway, space, air traffic management/control, medical devices, and financial services.
Read More
DATA SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY
Prnewswire | March 30, 2023
Noname Security, the leading provider of complete API security solutions, today announced major enhancements to its market-leading API security platform to help organisations protect their API ecosystem, secure their applications, and increase cyber resilience. With the fastest, most flexible, and most comprehensive solution on the market, Noname Security continues to define API security.
Noname Enables Secure Growth with API Security Innovation
Today, APIs drive business, delivering value to customers, clients, patients, users, shareholders, and more. However, securing APIs – and all of the critical assets they connect – has become more difficult than ever as APIs attacks have increased exponentially. IBM Security X-Force reported that two-thirds of its analysed incidents were due to unsecure APIs.
"APIs are the connective tissue for the digital world, but the explosion in API use has created new and rapidly growing threats to organisations across the globe. We created the Noname API Security Platform to uniquely address the modern API ecosystem, with discovery, insight, protection, and testing capabilities," said Shay Levi, Co-Founder and CTO at Noname Security. "Doing so means not only securing APIs and their use, but also improving the speed at which our customers can expand their business."
The Noname API Security Platform Continues to Define API Security
Noname's latest major release delivers new capabilities across the entire platform – covering discovery, posture management, runtime protection, pre-production testing, and deployment – to help customers:
Discover More & Strengthen Security Posture
Noname Security's Discovery and Posture Management solutions locate and provide insight to every API in an organisation's ecosystem, uncovering vulnerabilities (including the most recent OWASP API Top Ten), protecting sensitive data, and proactively monitoring for changes, including in OpenAPI and other specifications. New capabilities enable customers to:
Gain complete visibility and detailed insights to protect APIs with customisable discovery, flexible tagging, and datatype assignments – including PII, PCI, PHI, and custom categories – for grouping APIs by application, business unit, and more.
Understand APIs in rich context with visualisations of business logic, physical network infrastructure, and API traffic to understand specific interactions and behaviour patterns.
Secure containerised applications with enhanced discovery and detection for Kubernetes (k8s).
Prioritise resources and eliminate blind spots with extensive infrastructure inventories for AWS and Azure, enabling organisations to find unprotected APIs, map the connections between APIs and infrastructure resources, pinpoint resources that could increase the attack surface, and resolve potential issues with full context.
Stop Attacks with Runtime Protection
Noname Security Runtime Protection detects and blocks API attacks with real-time traffic analysis, out-of-band monitoring, inline remediation options, and workflow integrations to increase SOC effectiveness. New capabilities enable customers to:
Identify business-logic-based attacks immediately with updates to the industry's most advanced anomaly detection engine using artificial intelligence & machine learning (AI/ML), including unsupervised online learning.
Reduce Mean-Time-To-Resolution (MTTR) with more context on issue records, including detailed remediation guidance and tools for deeper investigation.
Fully align with security operations center (SOC) processes with automation, custom workflows, and integrations with existing systems such as ITSM, SIEM, SOAR, and more.
Deliver Secure APIs Faster with Active Testing
Noname Security Active Testing is a purpose-built API security testing solution that helps organisations easily add security into the CI/CD pipeline without sacrificing speed. The newest version of Active Testing enables customers to:
Shift left with integrations into the entire software development lifecycle (SDLC). Teams get dynamic API visibility across multiple states and environments throughout the CI/CD process.
Leave no API untested with a unique ability to find and test every API based on an understanding of the application's business logic.
Empower developers with best-in-class usability such as simple setup & automation, in-line test results, and contextual guidance for request failure mitigation.
Continuously Adapt to Changing Environments
Noname Security offers the most flexible and comprehensive set of deployment and integration options available. New capabilities enable customers to:
Rapidly realise value with simplified step-by-step onboarding and in-app guidance.
Meet any deployment requirement with both agentless and agent-based options, including eBPF, and both out-of-band and inline protection options.
Easily manage complex deployments with automatic updates across cloud-hosted, self-hosted, hybrid, and distributed deployments.
Maintain data residency and reduce overhead with remote engines to aggregate traffic into a centralised console, allowing you to keep data within your control and reducing traffic.
Meet strict public-sector compliance requirements with a new hardened virtual appliance.
See the entire attack surface with additional integrations and improvements to Akamai, AWS ECS, Cloudflare, Oracle Cloud Infrastructure, Citrix, and other connectors.
Staying Ahead of Attackers
Built by the largest team of API security researchers and developers in the industry, the Noname API Security Platform helps organisations proactively find vulnerabilities, stop attacks, reduce the risk of costly incidents, and ensure business continuity.
"Improving security posture and shifting from reactive to proactive does more than reduce risk. It allows the entire enterprise to change its position in the market from follower to leader," said Oz Golan, CEO and Co-Founder of Noname Security.
About Noname Security
Noname Security is the only company taking a complete, proactive approach to API Security. Noname works with 20% of the Fortune 500 and covers the entire API security scope — Discovery, Posture Management, Runtime Protection, and API Security Testing. Noname Security is privately held, remote-first with headquarters in Silicon Valley, California, and offices in Tel Aviv and Amsterdam.
Read More
PLATFORM SECURITY, SOFTWARE SECURITY, WEB SECURITY TOOLS
Prnewswire | March 31, 2023
ReasonLabs, the cybersecurity pioneer equipping families and individuals worldwide with the same level of cyber protection utilized by Fortune 500 companies, today announced the addition of a Dark Web Monitoring feature to its RAV Online Security solution, a web extension that provides real-time, 24/7 protection against a range of malicious online activity. The Dark Web Monitoring feature scans tens of thousands of combination lists, leaked databases, and malware data hidden from the surface net—the publicly accessible internet—for mentions of users' personal data, and instantly notifies users when breaches occur.
The dark web, a part of the internet that can only be accessed via an anonymizing browser and is invisible to search engines, is frequently used by cybercriminals to engage in illicit online activity. Malicious actors use the dark web to find, buy and sell user data. This can include usernames and passwords; financial information including traditional banking data, cryptocurrency wallets, and credit card numbers; and a range of personally identifiable information such as names, phone numbers, emails, social security numbers, locations, and more.
"The dark net is a hotbed of cybercrime where cyberattackers regularly find people's important personal and financial data. It is critical that users be protected at all times, which calls for monitoring the dark web for data breaches and alerting users immediately as and when breaches occur," said Kobi Kalif, CEO of ReasonLabs. "ReasonLabs' Online Security tool, is fully integrated with RAV Endpoint Protection and is now equipped with the Dark Web Monitoring capability, The extension scans both the surface net and dark web around the clock to identify malicious activity impacting our users to ensure they are always protected."
"As technology progresses, our digital presence becomes increasingly important as we store valuable information and financial assets online. Unfortunately, the risk of exposure also increases, making it crucial to promptly detect any leaks and take appropriate action to prevent negative consequences in the real world," said Omri Gabai, VP Security Products at ReasonLabs. "That's why we've made the decision to offer our users a critical tool for monitoring the dark web."
RAV Online Security protects against threats on the surface net such as URLs, phishing, harmful extensions, suspicious downloads, intrusive cookies and trackers, unauthorized notifications, and pop-ups. Dark Web Monitoring scans keep users up-to-date on any data breaches they may be involved with, and users receive an alert once a new breach occurs. RAV Online Security has more than five million users worldwide and is available as a free download.
About ReasonLabs
ReasonLabs is a global pioneer in cybersecurity detection and prevention. Powered by machine learning, ReasonLabs' cutting-edge technology is revolutionizing consumer-focused cybersecurity, bringing enterprise-grade protection into the homes of tens of millions of users worldwide. Its innovative engine scans over 2 billion files in 180 countries a day, delivering fast, comprehensive data while providing 24/7 real-time threat detection. Founded in 2016, ReasonLabs is based in New York and Tel Aviv.
Read More