PLATFORM SECURITY, SOFTWARE SECURITY, API SECURITY
Businesswire | June 06, 2023
Traceable AI, the industry's leading API security company, today announced the release of the industry's first API Security Reference Architecture for Zero Trust. This groundbreaking reference architecture serves as a guide for security leaders as the industry addresses the urgency of integrating API Security into Zero Trust Security initiatives.
Zero Trust, a cybersecurity framework that emphasizes continuous verification and helps to minimize the attack surface, has proven effective in enhancing security for many organizations, from large enterprises, to the US Government. However, traditional Zero Trust approaches have primarily focused on network-level controls and identity access management, neglecting the critical API layer.
Traceable’s API Security Reference Architecture is aligned with the NIST Zero Trust Architecture, a publicly available, vendor-neutral framework widely adopted by government entities such as CISA, DoD, DISA, NSA, GSA and NCCoE, as well as by many leading cybersecurity vendors. By leveraging the NIST framework, Traceable ensures compatibility, interoperability, and adherence to industry standards, making it a reliable and trusted guide for organizations implementing Zero Trust for their APIs.
The extensive reference architecture provides organizations with a prescriptive methodology to operationalize Zero Trust for APIs:
Advanced API Security: The reference architecture gives organizations a way to implement robust security measures specifically designed for APIs, including eliminating implied or persistent trust for APIs, thereby minimizing the risk of API-related vulnerabilities, attacks, and data breaches.
Comprehensive Risk Management: The reference architecture recommends incorporating automatic user authentication and authorization, granular data access policies, and asset risk assessments, can organizations can effectively manage and mitigate risks associated with API access and usage.
Increased Visibility and Control: The architecture explains why organizations should obtain granular visibility, which allows organizations to monitor and record all API transactions, enabling better analysis, threat detection, and incident response capabilities.
Improved Compliance and Data Protection: The automatic identification and classification of sensitive data sets ensure compliance with data protection regulations such as HIPAA, GDPR, and PCI-DSS, reducing the risk of regulatory penalties and reputational damage.
Seamless Automation and Orchestration: The reference architecture recommends integration with XDR, SIEM, and SOAR solutions, so organizations can enhance their overall security posture, automate response actions, and streamline security operations.
Scalability and Flexibility: The architecture offers a flexible distribution model for PEPs and data collection points, allowing organizations to scale their API security infrastructure based on their unique requirements and architecture.
Future-Proofing: By aligning with the NIST Zero Trust Architecture and industry standards, organizations adopting the API Security Reference Architecture can ensure compatibility, interoperability, and the ability to evolve alongside emerging technologies and security best practices.
Traceable’s API Security Reference Architecture for Zero Trust introduces a new approach to secure APIs using Zero Trust concepts, acknowledging their unique security requirements. It provides organizations with a comprehensive framework to implement Zero Trust controls specifically tailored to APIs, ensuring the protection of digital assets and mitigating the risk of data breaches.
Dr. Chase Cunningham weighs in on Traceable’s approach: "APIs provide a new means of applying controls across enterprise applications, " says Dr. Cunningham, “However, the security practices for APIs have not yet matured, leaving a significant gap in the overall attack surface. Traceable has developed their own API Security Reference Architecture to help fill this gap by providing organizations with a methodical way to secure their APIs with Zero Trust principles. By combining Zero Trust strategic concepts with API-specific security measures, Traceable can help organizations protect their digital assets effectively."
Throughout the past year, Traceable has continued to reaffirm its commitment to extending Zero Trust methodologies to API Security. With the addition of Zero Trust creator John Kindervag and Dr. Zero Trust, Chase Cunningham as Traceable advisors, Traceable continues to strengthen its expertise in this space. To date, Traceable has become a valuable partner to a number of large enterprises as the industry turns its eyes toward the importance of API security. With the rollout of their Zero Trust API Access solution alongside this reference architecture, Traceable continues to lead the industry toward the advancement of API security.
This reference architecture is now available for organizations to explore and implement, empowering them to achieve complete API security in a Zero Trust world.
About Traceable
Traceable is the industry’s leading API Security company that helps organizations achieve API protection in a cloud-first, API-driven world. With an API Data Lake at the core of the platform, Traceable is the only intelligent and context-aware solution that powers complete API security – security posture management, threat protection and threat management across the entire Software Development Lifecycle – enabling organizations to minimize risk and maximize the value that APIs bring to their customers. To learn more about how API security can help your business, book a demo with a security expert.
Read More
PLATFORM SECURITY, SOFTWARE SECURITY, CLOUD SECURITY
Prnewswire | June 07, 2023
Lacework, the data-driven security platform, today announced new CIEM functionality that empowers teams to gain observability of all cloud identities, know precisely who can perform what actions, and easily identify which identities pose the greatest risk. Furthermore, Lacework's actionable approach to CIEM provides customers with recommendations on how to reduce their identity risk. By combining these new capabilities with cloud security posture management, attack path analysis, and threat detection into a single platform, Lacework gives customers a clear understanding of their cloud identity landscape, visibility into cloud identity and access management (IAM) misconfigurations and exposed secrets, and continuous discovery of identity threats.
The benefits of public cloud come with complex challenges in managing identity risk. With over 35,000 granular permissions across hyperscale cloud providers, organizations struggle to limit unnecessary access. Most cloud users and instances are granted far more permissions than they actually need, leaving organizations highly exposed to cloud breach, account takeover, and data exfiltration. And the fact that machine identities in the cloud typically outnumber humans by an order of magnitude intensifies the issue.
"Enforcing least privilege and having visibility of identities and entitlements is a top cloud security challenge for IDC clients. With this innovation from Lacework, security teams can automatically see which identities are overly-permissive, and zero in on the ones that pose the greatest risk," said Philip Bues, Research Manager for Cloud Security, at IDC. "Beyond prioritizing risks, this will also allow teams to confidently suggest policy changes and reduce their overall attack surface risk."
Preventing Cloud Identity Risk with New Entitlement Management Technology
Lacework dynamically discovers cloud user, resource, group and role identities and their net-effective permissions and then automatically correlates granted versus used permissions to determine identities with excessive privileges. The platform calculates a risk score for each identity, determines the riskiest identities based on attack path analysis, and auto-generates high-confidence recommendations for right-sizing permissions based on historical observations. This means Lacework not only informs customers of risky identities and entitlements, but also shows those identities that are hardly used or even need entitlements to begin with.
"CIEM is a vital facet of a comprehensive cloud security strategy," said Paolo del Mundo, Director of Application Security, The Motley Fool. "It's encouraging to see Lacework incorporating this into their well-rounded CNAPP solution, potentially providing a robust response to the challenge of managing cloud access permissions effectively."
Combined with Lacework's ability to prioritize risks from an attack path context, as well as detect user and entity behavior anomalies, customers are able to:
Continuously comply with IAM security and regulatory compliance requirements.
Identify cloud user, application and service identities, know exactly what actions each can take, and prioritize the identities that pose the greatest risk.
Limit the blast radius of compromised cloud accounts, achieve least privilege, and establish trust with engineering teams.
Continuously discover risky behavior, including lateral movement and privilege escalation, without needing to write rules or stitching together disparate alerts.
Rapidly detect insider threats associated with malicious or accidental abuse of permissions.
"Our customers need to know what entities are actually doing in their cloud and whether it's malicious or inappropriate, and it can't get in the way of their ability to move fast," said Adam Leftik, Vice President, Product, Lacework. "Now Lacework customers can address both sides of the identity security issue with a single platform that prevents identity risk exposure and detects identity threats at scale, with the context to quickly investigate, prioritize, and respond to identity alerts. It's the latest step in our mission to give enterprises the confidence to rapidly innovate in the cloud and drive their business forward."
About Lacework
Lacework offers the data-driven security platform for the cloud and is the leading cloud-native application protection platform (CNAPP) solution. Only Lacework can collect, analyze, and accurately correlate data — without requiring manually written rules — across an organization's AWS, Azure, Google Cloud, and Kubernetes environments, and narrow it down to the handful of security events that matter. Security and DevOps teams around the world trust Lacework to secure cloud-native applications across the full lifecycle from code to cloud. Get started at www.lacework.com.
Read More
DATA SECURITY, ENTERPRISE SECURITY, SOFTWARE SECURITY
Businesswire | May 12, 2023
Vanta, a leading trust management platform, announced today that it has expanded its partnership with CrowdStrike, a leader in cloud-delivered protection of endpoints, cloud workloads, identity and data, with a new integration that improves compliance and security operations for organizations of all sizes. Vanta also announced three new strategic investors in their previously announced Series B — Atlassian Ventures, HubSpot Ventures and Workday Ventures.
The new integration builds on an existing partnership between Vanta and CrowdStrike. In September 2022, the companies announced that CrowdStrike had made an investment in Vanta via the CrowdStrike Falcon Fund. That investment, along with the newly announced investments today by Atlassian Ventures, HubSpot Ventures and Workday Ventures, not only enable Vanta to continue growing its go-to-market, R&D and global expansion efforts, but provide valuable partnership opportunities via aligned customer and partner bases and industry-leading product innovation.
“As the market’s leading trust management platform, we’re excited to build on our industry-first partnership with CrowdStrike, bringing together our pioneering technologies to automate compliance securely across organizations—from small and midsize businesses to enterprise environments,” said Christina Cacioppo, CEO, Vanta. “As we transform the way companies demonstrate their security, and ultimately, establish and deepen trust, we’re thrilled to welcome new investments by Atlassian Ventures, HubSpot Ventures and Workday Ventures as we work to simplify and centralize security for our 5,000 global customers and beyond."
With cybersecurity threats continuing to increase in volume and complexity, it’s more critical than ever for organizations to prioritize their security posture and build trust with internal and external stakeholders alike. By leveraging the CrowdStrike Falcon® platform, Vanta customers gain visibility into employee agent deployment, allowing them to seamlessly configure and manage cloud monitoring to ensure internal policies are being upheld.
The integration with CrowdStrike increases automation for compliance security operations at scale within Vanta, empowering customers to:
Improve security posture by actively monitoring the status of corporate employee access to the Falcon platform, as well as mitigate potential misuse and insider threats by removing access for offboarded users.
Eliminate security blindspots with additional visibility into CrowdStrike agent installation coverage across relevant endpoints, and workloads for comprehensive protection and control.
Meet compliance standards by certifying CrowdStrike prevention policies by actively performing the relevant checks on the required devices and cloud workloads within the Vanta platform.
"Cybersecurity and compliance are both on similar trajectories of increasing complexity," said Daniel Bernard, Chief Business Officer, CrowdStrike. "Together with Vanta, CrowdStrike is automating continuous security and compliance so organizations of all sizes can elevate protection levels in an efficient manner."
Over the past year, Vanta has nearly doubled its customer base to serve over 5,000 companies across 58 countries, while expanding its global footprint with offices in Australia, Ireland and the U.S. In January, Vanta announced its acquisition of Trustpage to accelerate its enterprise momentum and transform trust into a marketable advantage for companies around the world.
“Developing trust and providing companies with solutions to support them as they grow is essential to our mission to help organizations grow better. Vanta enables companies to strengthen trust with customers by improving security and compliance management, making them a natural partner to HubSpot,” said Eric Richard, CISO and SVP of Engineering Operations, HubSpot. “I’m looking forward to the work Vanta and HubSpot will do together to create more secure digital experiences for companies and their customers.”
To meet demand from its rapidly expanding customer base, in Q1 alone, Vanta added over 50 new integrations, for a total of 125+ across the most essential cloud applications in a company's tech stack. With Vanta’s recently launched Vendor Risk Management (VRM) solution and Questionnaire Automation, customers can evaluate security in the buying process while closing their own deals faster — all in a single platform.
“Teams work in a more connected and collaborative nature than ever before. But with more apps and entry points in every organization’s tech stack, the companies of tomorrow need to ensure they’re secure today,” said Peter Lenke, Head of Atlassian Ventures. “We’re excited to invest in and partner with Vanta as they enable security teams to significantly reduce vendor risk by quickly inventorying vendors, performing security reviews, and remediating issues — all in the same platform they use for security and compliance today. Vanta closes the loop on the security lifecycle from start to finish. With our shared commitment to reimagine and deliver a more secure cloud, we couldn’t be more thrilled to join Vanta in its next phase of growth.”
In addition to its product and partnership acceleration in 2023, Vanta’s innovation has been recognized across a range of rankings and awards including securing the #17 spot in CNBC’s Disruptor 50, Inc’s Best Workplaces and the Fastest Growing Cybersecurity Company by the Cybersecurity Excellence Awards.
“The investment in Vanta reflects our commitment to intelligent automation and sophisticated technology that helps organizations navigate an ever-changing world,” said Michael Magaro, Senior Vice President of Corporate Growth, Workday Ventures. “As the strategic capital arm of Workday, trust and transparency are values that are ingrained in everything we do at Workday Ventures. Vanta is well-positioned to evolve the rapidly changing trust and security industry, and we look forward to partnering with them as they continue their journey to safeguard organizations and consumers everywhere.”
In 2022, Vanta raised $150 million in funding from leading investors Craft Ventures, Sequoia and Y Combinator and security industry pioneers like CrowdStrike, bringing the company’s total amount raised to $203 million at a $1.65 billion valuation.
About Vanta
Vanta is the leading trust management platform that helps simplify and centralize security for organizations of all sizes. Over 5,000 companies including Autodesk, Chili Piper, Flo Health, and Quora rely on Vanta to build, maintain and demonstrate their trust—all in a way that's real-time and transparent. Founded in 2018, Vanta has customers in 58 countries with offices in Dublin, New York, San Francisco and Sydney. For more information, visit www.vanta.com.
Read More