Home > Resources > Articles > What is Data Masking in the cybersecurity landscape? Top platforms to execute it.

What is Data Masking in the cybersecurity landscape? Top platforms to execute it.

Faking data for security sounds unrealistic. However, it is an important strategy across data platforms. Formally known as data masking, it adds functional value to the same set that appears differently. Remember, its market value is marching towards USD 1268 million by 2028, making it a differentiator while picking the best tool. Before I discuss those, let’s understand what it’s all about and the top techniques.

Data masking creates a ‘copy’ of a data set with a similar structure but may vary in value. It is an important technique to protect sensitive data by making it unidentifiable and immutable to unauthorized users.

Data masking is important for ensuring consistency and usability across multiple databases. The purpose behind creating a functional substitute is to use it for QA, user training and demonstrations without revealing the actual values.

Importance of data masking

Emulating data to protect sensitive information and yet achieve a few other things has the following benefits:

• It enables organizations to stay in compliance with GDPR by eliminating the risk of sensitive data exposure. Thus, it offers a competitive edge to others.
• It ensures end-to-end security and makes the data useless even if hackers access it.
• Eliminates the risk of exposure during data sharing with third-party applications.

Moreover, organizations engaging in outsourced partnerships are at continuous risk of exposing their data to a third party. With masking, they can proceed with confidence and without any concerns. Among many, the following are the most common types of data where masking is widely applicable:

• Protected health information
• Personally Identifiable Information
• Payment Card Information
• Intellectual property

Top Data Masking Techniques

While there are many on the list, I am narrowing it down to the most important ones:

Encryption

As the name suggests, this technique uses an encryption algorithm to mask the data. Only an encryption key can be used to decrypt it. The data is secure as long as authorized users only hold the key. In any case, unauthorized access could expose the data.

Scrambling

Scrambling jumbles the characters, numbers and special characters into a new data value that hides the original content.

It’s a simple technique, doesn’t imply to all data types and is not the best of all techniques to mask sensitive data. For example, the employee ID that reads 12345 is masked into 23154; it may not be difficult for hacking algorithms to decipher the original number.

Nulling out

This technique applies a null value to the targeted data column so that actual data stays hidden from any unauthorized user. However, it reduces data integrity and makes QA harder.

Substitution

It masks the data by substituting its original value with a new one; without impacting the original contents and details. The simplistic technique works well across several data types. For example, masking the business partner names with a lookup file. Disguising the original ‘look’ often helps in protecting it from breaches.

Shuffling

Shuffling is a substitution done differently. It shuffles the masking data column with others. For example, shuffling the business partner names across multiple records. The new data looks accurate and yet doesn’t reveal any personal information. The only way to breach this technique would be to hack the shuffling algorithm.

Date Aging

Based on the pre-defined masking policy, this technique alters the data field. This includes increasing or decreasing the values. A simple example would be decreasing the date of the birth field by 100 days. The drawback of this method is that because the same policy applies to all values in a field, the compromise of one value results in the compromise of all values.

Pseudonymisation

Pseudonymisation is a relatively newer term and, thus technique introduced with the GDPR guidelines. It implies that the data can’t be used for personal identification and requires removing direct identifiers and multiple identifiers that, upon combining, could potentially disclose an identity. Encoding identifiers protects user privacy and preserves the credibility of the masked data.

Redaction

Redaction implies using generic values to replace sensitive data that is not required for QA or development purposes. Here, the data has no attributes similar to the original set.

Averaging

Averaging means hiding the individual values except for their aggregate or average. A very simple example would be hiding the salaries in an employee details table and only showcasing their average.

High-performance data platforms

The degree of security by masking data directly depends upon the performance of the data management platform. That is exactly why many data platforms, especially test data management solutions, pitch masking as an integral component.

For example, Oracle’s Data Masking Subsetting solution abbreviates cost by provisioning masked data for testing purposes. It helps in abbreviating IT costs.

Informatica’s dynamic data masking de-identifies the data sets and prevents unauthorized access to production environments such as order management, customer support, etc. It hides user-sensitive data such as name, age, accounts, role etc.

While we are at it, K2View’s data masking is surely the highlight of 2022. The popular data fabric and product platform capture data from fragmented points according to product schemas such as the business entity.

The fabric saves masked data for every business entity in an exclusive micro-database. With such an innovative approach, K2View executes dynamic masking for varied use cases such as test data management, legacy application modernization, pipelining and tokenization.

Other popular names include Delphix, DataProf, IBM Infosphere, CA, etc.

Conclusion


As discussed, data masking techniques are mostly simple yet highly effective in ensuring an end to end security for large data volumes. They enable the real data to be used for alternative functionalities such as testing, demos and training. While the scope of masking goes beyond, the above-mentioned techniques provide starting details. I recommend partnering with the right data product platform that provides integrated components including masking, pipelining, orchestrating, etc.

Spotlight

CSIS Security Group A/S

Founded in 2003, CSIS Security Group is an independent cyber security provider protecting some of the world’s largest enterprise organisations. CSIS mitigates security risk with a range of preventive security products, as well as with incident response and managed security services.

OTHER ARTICLES
Enterprise Identity, Platform Security, Software Security

Protection vs Privilege

Article | August 16, 2023

As of May 2023, 39% percent of workers in the UK work from home at some point during their week. Whilst understandable, the hybrid-working environment continues to pose more risks to organisations and their data. As more devices are accessed beyond the confines of the corporate network, businesses must account for the inherent risks presented by insecure or non-existent endpoint control. As users of these devices have more administrative control, and without the constant presence of IT services, the door is left open for increased phishing, ransomware and malware attacks. A daunting 88% of data breaches are now caused by employee error. Just earlier this month, the genealogy company 23andMe confirmed that its data had been compromised in an attack from hackers who claimed to have accessed millions of data points from accounts by taking advantage of users login credentials. The problem with this is that the users are not the root of the issue. The concern comes not only from employees, but from the number of endpoints being accessed from multiple locations, and the lack of control over the access and privileges that these devices have. A frightening statistic revealed in a study from Forbes, showed that 23% of UK and US small businesses used no form of endpoint security, and that a further 57% simply believe they won’t be targeted by cyber-attacks. The reason this is so concerning is that cybersecurity companies have reported a 20% increase in victims of such attacks just in the last year. These attacks not only put company and customer data at risk but can also result in a strain on IT services and leave users without the systems and tools essential for productivity. Preventing unlimited access One of the ways that attacks break through endpoints and escape into an organisation's network is by exploiting local admin rights on end-users' workstations. Those local admin rights are handy for the user. For example, they can install a new printer driver or update an application plug-in without calling the IT help desk. But they can also be abused to install malware or configure the computer to make an attack easier. It could be easy to remove those local admin rights or the shadow user account on the workstations with those elevated permissions. But that will frustrate end-users and increase the load on the help desk. The key issue here, is the concept of privilege. Users often need the privilege to elevate their devices by running an administrator account in order to gain access to, and update applications. Unfortunately, this greatly increases risk as these elevated administrator accounts are much more attractive to hackers for this exact reason - their access to more lucrative data. It has been reported that 70% of all data breaches are targeted at privileged accounts, which is especially alarming when taking into account the fact that 90% of IT security professionals have said that their organisations’ users have more privilege than is necessary. The issue for many companies arises in finding the balance between the users’ access to local admin rights and their productivity. More open access to the admin rights makes things easier and convenient for the users but opens the door to security risks with more endpoints to target. A study by the Ponemon Institute showed that 73% of organisations believed that threats to their endpoints had significantly increased, and that a staggering 80% of organisations that had been compromised by cyber-attacks did not know what type of attack they had been subjected to. The need for a more effective and efficient security measure is clear. Endpoint privilege management (EPM) oversees and governs the privilege of network devices. It completely removes the need for users to have administrator accounts on the devices they use, whilst still enabling them to have elevated access to certain applications. EPM only elevates approved applications and provides the users with a clear audit list of those which have been approved. Privilege to protect Whilst not a universal fix, the implementation of EPM, for example, can help alleviate the risks and reinforce a culture of security within organisations. It is understandable to be cautious when faced with words and phrases such as “approved applications” or “removing administrator rights”, but EPM is not about limiting your users’ experience or productivity. EPM does not forbid or remove access to applications. The IT team can grant approved users’ permission to run specific applications with elevated permissions for a limited period, to carry out specific actions. Users can then access what they need to, while IT retains visibility over all actions in case activity needs to be stopped, or incidents need to be investigated at a later date. If permissions need to be granted on an individual basis, for each user and application, IT will be buried under an avalanche of requests – so EPM tools will allow rules and policies to be created and then applied at scale. Users can do the work they need with few calls to the Help Desk. IT gets fewer interruptions and can focus on more valuable work. Auditors can see who had access to which applications and logs show the actual users, not an arbitrary administrator account. Endpoint privilege management is vital to any organisation's cybersecurity strategy, not only to manage and control access to sensitive data and resources but minimise the chance of a data breach. EPM also plays a crucial role in ensuring compliance with industry standards and regulations to avoid the legal liabilities that may ensue should a breach occur.

Read More
Software Security

The NIS2 cyber security rules are coming – are you ready?

Article | September 6, 2023

The EU NIS cyber security regulations are evolving for 2024 – and if you’re not currently aware of how they’ll apply to your organisation, now is the time to get up to speed with the likely requirements. Not only is the directive being tightened, but an extended range of healthcare and related organisations will be added to the list of ‘critical entities’ that must comply. These include certain medical device manufacturers, pharmaceutical companies, and organisations that carry out R&D. The Network and Information Systems (NIS) standards were set up in 2016 to protect essential services – such as water, energy, healthcare, transport and digital infrastructure – from online cyberattacks. The updated legislation, NIS2, will have stricter rules and reporting requirements, and higher penalties for non-compliance. They will apply to medium-sized and large businesses that operate within one or more EU countries. Those based only in the UK can’t sit back, however, as the original NIS regulations will still apply as part of British law. What’s more, a UK version of the rules is coming very soon, and it’s likely that the framework will closely resemble the EU’s. What will the requirements cover? There are a number of cyber risk management measures that all organisations that come under the scope of NIS2 will be required to put in place. For instance, they will need to conduct regular security assessments and risk analyses, adopt incident response and handling plans, and appoint a chief information security officer (CISO), among other obligations. The new directive will streamline and strengthen incident reporting requirements. Entities must notify regulators of any incident that has compromised data, or had a significant impact on the provision of their services, for instance by causing severe operational disruption or financial loss. Applying information system security policies and business continuity plans will form part of the obligations, as will conducting cyber security testing, and training for all staff. The use of multi-factor authentication (MFA) and encryption, where appropriate, will also be mandated. There is plenty of focus within the directive on the cornerstones of cyber security best practice – in particular the proper control of administrator-level account credentials, privileged access, and endpoints, all of which are prime targets for attackers. Under NIS2, organisations are being separated into ‘critical’ and ‘important’ entities. It’s important to determine which category yours will fall under, as requirements are different for each. The third party threat will also be addressed in NIS2 through the pulling in of managed service providers (MSPs) to the list of ‘critical entities’, with the aim of keeping digital supply chains secure. MSPs are often granted privileged access to clients’ corporate systems and networks, which creates security risks. What are the consequences of non-compliance? Organisations that come under the regulations’ purview will be subject to random checks, regular security audits, on-site inspections and off-site supervisions. For those found to be in breach, sanctions could include warnings, temporary suspension of certain activities, and temporary prohibition to exercise certain managerial functions. Financial penalties could be as high as 10 million Euros or 2% of an organisation’s global turnover – whichever is higher. What steps should healthcare organisations take now? Organisations should take action to establish whether the EU or UK NIS2 regulations will apply to them and what their responsibilities will be. Having identified any gaps in existing cyber security processes, policies and practices, they must determine what changes need making to address them. As a priority, they must review their incident response plans, and incident management and reporting procedures. It’s also a good idea to begin assessing the security posture of partners and third parties in the supply chain, and incorporating relevant security requirements into contracts. Given the framework’s focus on protecting privileged admin accounts, organisations should implement controls that will limit the number of staff members who hold these powerful credentials. Implementing privileged access management (PAM) will allow IT to control who is granted access to which systems, applications and services, for how long, and what they can do while they’re using them. Preparing for the introduction of the EU NIS2 regulations should be considered as more than just a compliance exercise. By meeting the strengthened requirements, healthcare organisations will be building a foundation of resilience that protects them, their customers, and the essential services they provide.

Read More
Data Security, Platform Security, Software Security

Security by Sector: Improving Quality of Data and Decision-Making a Priority for Credit Industry

Article | August 12, 2022

The subject of how information security impacts different industry sectors is an intriguing one. For example, how does the finance industry fare in terms of information security compared to the health sector, or the entertainment business? Are there some sectors that face greater cyber-threats and risks than others? Do some do a better job of keeping data secure, and if so, how and why?A new study of credit management professionals has revealed that improving the quality of data and decision-making will be a top priority for the credit industry in the next three years. The research, from Equifax Ingnite in collaboration with Coleman Parkes, takes a deep dive into the views of credit management pros across retail, banking, finance and debt management/recovery sectors.

Read More

3 Trends in Data Privacy Breach Laws That Will Carry Over to 2020

Article | February 12, 2020

During 2019, new privacy laws were introduced, and many current laws evolved in the United States and across the global landscape. With the General Data Protection Regulation (GDPR) in full effect, we saw expensive fines levied upon companies that fell victim to data privacy breaches. As we move into a new year, probably the biggest takeaway from 2019 is that being proactive and having a data privacy strategy in place is important to help mitigate the risk of a data privacy breach. The regulatory landscape continues to evolve as states and countries actively pass new expanded requirements for privacy and cybersecurity regulations. While laws in the U.S., like the California Consumer Privacy Act (CCPA), are getting significant attention, many other states and countries are actively amending their breach notification laws to include tighter restrictions.

Read More
Enterprise Identity, Platform Security, Software Security

Beyond Basics: Advanced Strategies for Enhancing Zero Trust Networking

Article | August 16, 2023

As of May 2023, 39% percent of workers in the UK work from home at some point during their week. Whilst understandable, the hybrid-working environment continues to pose more risks to organisations and their data. As more devices are accessed beyond the confines of the corporate network, businesses must account for the inherent risks presented by insecure or non-existent endpoint control. As users of these devices have more administrative control, and without the constant presence of IT services, the door is left open for increased phishing, ransomware and malware attacks. A daunting 88% of data breaches are now caused by employee error. Just earlier this month, the genealogy company 23andMe confirmed that its data had been compromised in an attack from hackers who claimed to have accessed millions of data points from accounts by taking advantage of users login credentials. The problem with this is that the users are not the root of the issue. The concern comes not only from employees, but from the number of endpoints being accessed from multiple locations, and the lack of control over the access and privileges that these devices have. A frightening statistic revealed in a study from Forbes, showed that 23% of UK and US small businesses used no form of endpoint security, and that a further 57% simply believe they won’t be targeted by cyber-attacks. The reason this is so concerning is that cybersecurity companies have reported a 20% increase in victims of such attacks just in the last year. These attacks not only put company and customer data at risk but can also result in a strain on IT services and leave users without the systems and tools essential for productivity. Preventing unlimited access One of the ways that attacks break through endpoints and escape into an organisation's network is by exploiting local admin rights on end-users' workstations. Those local admin rights are handy for the user. For example, they can install a new printer driver or update an application plug-in without calling the IT help desk. But they can also be abused to install malware or configure the computer to make an attack easier. It could be easy to remove those local admin rights or the shadow user account on the workstations with those elevated permissions. But that will frustrate end-users and increase the load on the help desk. The key issue here, is the concept of privilege. Users often need the privilege to elevate their devices by running an administrator account in order to gain access to, and update applications. Unfortunately, this greatly increases risk as these elevated administrator accounts are much more attractive to hackers for this exact reason - their access to more lucrative data. It has been reported that 70% of all data breaches are targeted at privileged accounts, which is especially alarming when taking into account the fact that 90% of IT security professionals have said that their organisations’ users have more privilege than is necessary. The issue for many companies arises in finding the balance between the users’ access to local admin rights and their productivity. More open access to the admin rights makes things easier and convenient for the users but opens the door to security risks with more endpoints to target. A study by the Ponemon Institute showed that 73% of organisations believed that threats to their endpoints had significantly increased, and that a staggering 80% of organisations that had been compromised by cyber-attacks did not know what type of attack they had been subjected to. The need for a more effective and efficient security measure is clear. Endpoint privilege management (EPM) oversees and governs the privilege of network devices. It completely removes the need for users to have administrator accounts on the devices they use, whilst still enabling them to have elevated access to certain applications. EPM only elevates approved applications and provides the users with a clear audit list of those which have been approved. Privilege to protect Whilst not a universal fix, the implementation of EPM, for example, can help alleviate the risks and reinforce a culture of security within organisations. It is understandable to be cautious when faced with words and phrases such as “approved applications” or “removing administrator rights”, but EPM is not about limiting your users’ experience or productivity. EPM does not forbid or remove access to applications. The IT team can grant approved users’ permission to run specific applications with elevated permissions for a limited period, to carry out specific actions. Users can then access what they need to, while IT retains visibility over all actions in case activity needs to be stopped, or incidents need to be investigated at a later date. If permissions need to be granted on an individual basis, for each user and application, IT will be buried under an avalanche of requests – so EPM tools will allow rules and policies to be created and then applied at scale. Users can do the work they need with few calls to the Help Desk. IT gets fewer interruptions and can focus on more valuable work. Auditors can see who had access to which applications and logs show the actual users, not an arbitrary administrator account. Endpoint privilege management is vital to any organisation's cybersecurity strategy, not only to manage and control access to sensitive data and resources but minimise the chance of a data breach. EPM also plays a crucial role in ensuring compliance with industry standards and regulations to avoid the legal liabilities that may ensue should a breach occur.

Read More
Software Security

Leading the Pack: Top 15 Network Security Providers for Businesses

Article | September 6, 2023

The EU NIS cyber security regulations are evolving for 2024 – and if you’re not currently aware of how they’ll apply to your organisation, now is the time to get up to speed with the likely requirements. Not only is the directive being tightened, but an extended range of healthcare and related organisations will be added to the list of ‘critical entities’ that must comply. These include certain medical device manufacturers, pharmaceutical companies, and organisations that carry out R&D. The Network and Information Systems (NIS) standards were set up in 2016 to protect essential services – such as water, energy, healthcare, transport and digital infrastructure – from online cyberattacks. The updated legislation, NIS2, will have stricter rules and reporting requirements, and higher penalties for non-compliance. They will apply to medium-sized and large businesses that operate within one or more EU countries. Those based only in the UK can’t sit back, however, as the original NIS regulations will still apply as part of British law. What’s more, a UK version of the rules is coming very soon, and it’s likely that the framework will closely resemble the EU’s. What will the requirements cover? There are a number of cyber risk management measures that all organisations that come under the scope of NIS2 will be required to put in place. For instance, they will need to conduct regular security assessments and risk analyses, adopt incident response and handling plans, and appoint a chief information security officer (CISO), among other obligations. The new directive will streamline and strengthen incident reporting requirements. Entities must notify regulators of any incident that has compromised data, or had a significant impact on the provision of their services, for instance by causing severe operational disruption or financial loss. Applying information system security policies and business continuity plans will form part of the obligations, as will conducting cyber security testing, and training for all staff. The use of multi-factor authentication (MFA) and encryption, where appropriate, will also be mandated. There is plenty of focus within the directive on the cornerstones of cyber security best practice – in particular the proper control of administrator-level account credentials, privileged access, and endpoints, all of which are prime targets for attackers. Under NIS2, organisations are being separated into ‘critical’ and ‘important’ entities. It’s important to determine which category yours will fall under, as requirements are different for each. The third party threat will also be addressed in NIS2 through the pulling in of managed service providers (MSPs) to the list of ‘critical entities’, with the aim of keeping digital supply chains secure. MSPs are often granted privileged access to clients’ corporate systems and networks, which creates security risks. What are the consequences of non-compliance? Organisations that come under the regulations’ purview will be subject to random checks, regular security audits, on-site inspections and off-site supervisions. For those found to be in breach, sanctions could include warnings, temporary suspension of certain activities, and temporary prohibition to exercise certain managerial functions. Financial penalties could be as high as 10 million Euros or 2% of an organisation’s global turnover – whichever is higher. What steps should healthcare organisations take now? Organisations should take action to establish whether the EU or UK NIS2 regulations will apply to them and what their responsibilities will be. Having identified any gaps in existing cyber security processes, policies and practices, they must determine what changes need making to address them. As a priority, they must review their incident response plans, and incident management and reporting procedures. It’s also a good idea to begin assessing the security posture of partners and third parties in the supply chain, and incorporating relevant security requirements into contracts. Given the framework’s focus on protecting privileged admin accounts, organisations should implement controls that will limit the number of staff members who hold these powerful credentials. Implementing privileged access management (PAM) will allow IT to control who is granted access to which systems, applications and services, for how long, and what they can do while they’re using them. Preparing for the introduction of the EU NIS2 regulations should be considered as more than just a compliance exercise. By meeting the strengthened requirements, healthcare organisations will be building a foundation of resilience that protects them, their customers, and the essential services they provide.

Read More
Data Security, Platform Security, Software Security

Addressing the Threats of Cross-Site Scripting (XSS)

Article | August 12, 2022

The subject of how information security impacts different industry sectors is an intriguing one. For example, how does the finance industry fare in terms of information security compared to the health sector, or the entertainment business? Are there some sectors that face greater cyber-threats and risks than others? Do some do a better job of keeping data secure, and if so, how and why?A new study of credit management professionals has revealed that improving the quality of data and decision-making will be a top priority for the credit industry in the next three years. The research, from Equifax Ingnite in collaboration with Coleman Parkes, takes a deep dive into the views of credit management pros across retail, banking, finance and debt management/recovery sectors.

Read More

3 Trends in Data Privacy Breach Laws That Will Carry Over to 2020

Article | February 12, 2020

During 2019, new privacy laws were introduced, and many current laws evolved in the United States and across the global landscape. With the General Data Protection Regulation (GDPR) in full effect, we saw expensive fines levied upon companies that fell victim to data privacy breaches. As we move into a new year, probably the biggest takeaway from 2019 is that being proactive and having a data privacy strategy in place is important to help mitigate the risk of a data privacy breach. The regulatory landscape continues to evolve as states and countries actively pass new expanded requirements for privacy and cybersecurity regulations. While laws in the U.S., like the California Consumer Privacy Act (CCPA), are getting significant attention, many other states and countries are actively amending their breach notification laws to include tighter restrictions.

Read More
MORE ARTICLES

Spotlight

CSIS Security Group A/S

Founded in 2003, CSIS Security Group is an independent cyber security provider protecting some of the world’s largest enterprise organisations. CSIS mitigates security risk with a range of preventive security products, as well as with incident response and managed security services.

Related News

Software Security

Malwarebytes Announces Consumer Identity Theft Protection Solution to Defend Against Online Fraud and Theft

PR Newswire | October 27, 2023

Malwarebytes, a global leader in real-time cyber protection, today launched an essential new consumer solution, Identity Theft Protection. The new service helps individuals secure their digital identities and defend against identity and online threats. Malwarebytes Identity Theft Protection includes real-time identity monitoring and alerts, robust credit protection and reporting and live agent-supported identity recovery and resolution services – backed by up to a $2 million identity theft insurance policy. The new service, paired with Malwarebytes' award-winning antivirus and VPN software, helps prevent criminals from stealing or using personal information to drain financial accounts, hack or impersonate social media accounts, damage a user's reputation or other online and identity-based attacks. Today's digital life is complex and sometimes deceptive. According to new research from Malwarebytes, identity theft ranks as people's third biggest concern when it comes to online security, just behind fear of financial accounts and personal data being breached – both of which play into identity theft. Of those surveyed 64% agree that identity theft protection is important, but only 13% have it. Consumers are also increasingly fearful of new technology. Malwarebytes gives consumers protection they can trust, alerting them when we see their information has been stolen and providing live agent support to restore their identity and replace lost items. Even as we spend more and more of our lives online, we all know that the internet today can't be trusted, said Mark Beare, GM of Consumer Business Unit, Malwarebytes. Consumers need a tool that not only blocks threats like malware and phishing, but that also monitors and protects their digital identity, be that social media profiles, bank accounts or email. With Malwarebytes Identity Theft Protection, we provide a robust and exhaustive suite of services so individuals and families can rest easy knowing that we are actively working to keep them safe and protect their digital identity. Malwarebytes Identity Theft Protection is available globally through a variety of tiered offerings that provide protection via computers and mobile devices across multiple operating systems including Windows, macOS, Android and iOS. Key features include: Identity Monitoring & Alerts: Continuously scours a multitude of websites and data sources, including the Dark Web, to alert if personal information is being illegally traded or sold. Recommends actions to take to protect yourself. Credit Monitoring and Protection: Ongoing tracking of credit for critical changes, such as new accounts or inquiries and applications for new lines of credit. A credit freeze also can be activated*. Breach IQ: Provides a safety score and alerts if personal information is part of a known breach*. Identity Recovery & Resolution: Assistance in the event of an identity theft incident, including guided steps to report the crime, dispute fraudulent charges, restore identity and recuperate financial losses incurred. Includes up to a $2 million insurance policy. About Malwarebytes Malwarebytes believes that when people and organizations are free from threats, they are free to thrive. Founded in 2008, Malwarebytes CEO Marcin Kleczynski had one mission: to rid the world of malware. Today, Malwarebytes' award-winning endpoint protection, privacy and threat prevention solutions along with a world-class team of threat researchers protect millions of individuals and thousands of businesses across the globe daily. Malwarebytes solutions are consistently recognized by independent tests including AVLAB and AV-TEST. The company is headquartered in California with offices in Europe and Asia. For more information and career opportunities, visit https://www.malwarebytes.com.

Read More

Software Security

Palo Alto Networks Intends to Acquire Talon Cyber Security

Palo Alto Networks | November 08, 2023

Palo Alto Networks plans to acquire Talon Cyber Security to enhance its Secure Access Service Edge (SASE) solution. Talon's Enterprise Browser technology, when integrated with Prisma SASE, will provide secure access to business applications. The acquisition reflects the importance of adapting SASE solutions to ensure consistent security for unmanaged devices. Palo Alto Networks, a global cybersecurity leader, has announced its intent to acquire Talon Cyber Security, an enterprise browser technology pioneer, to enhance its Secure Access Service Edge (SASE) solution and provide comprehensive protection for managed and unmanaged devices. In today's digital landscape, unmanaged devices often connect to enterprise applications without adequate security measures, making them susceptible entry points for attackers seeking to access sensitive information. Lee Klarich, Chief Product Officer of Palo Alto Networks, emphasized the importance of securing all work activity through an Enterprise Browser without compromising device privacy to protect users and applications effectively. He continued that the integration of Talon's technology with Prisma SASE aims to provide consistent security for all users and devices. Anand Oswal, SVP and GM at Palo Alto Networks highlighted the significance of securing unmanaged devices with the same robust security as managed devices, especially in today's dynamic threat landscape. HE further stated that the combination of Prisma SASE and Talon's Enterprise Browser is poised to revolutionize security measures in modern digital environments. Talon Cyber Security's Enterprise Browser technology offers an innovative solution that, when integrated with Prisma SASE, will enable users to securely access business applications from any device, including non-corporate devices, while ensuring a seamless user experience. This strategic move by Palo Alto Networks addresses the evolving security challenges in a connected world. Talon's Co-Founder and CEO, Ofer Ben-Noon, acknowledged the shifting work models and user preferences and the need for powerful last-mile security solutions. Talon's Enterprise Browser is designed to offer familiar user experiences with enterprise-grade protection. Ben emphasized that partnership with Palo Alto Networks is seen as a catalyst to accelerate its mission of delivering superior outcomes for customers. Talon, founded by Ofer Ben-Noon and Ohad Bobrov, secured the RSA Conference's Innovation Sandbox contest in 2022. The co-founders will continue to lead their teams within the Prisma SASE team at Palo Alto Networks upon the completion of the acquisition. Anand Oswal, Senior Vice President and General Manager at Palo Alto Networks, highlighted the advantages and security risks associated with Bring Your Own Device (BYOD) policies. He noted that Talon's Enterprise Browser provided security teams enhanced visibility and control over work-related Software as a Service (SaaS) and web activity across all devices, including personal and unmanaged endpoints. Anand emphasized the need for Secure Access Service Edge (SASE) solutions to adapt in order to secure unmanaged devices with the same consistent security measures applied to managed devices. This would enable users to access business applications securely from any device and location.

Read More

Software Security

SCYTHE Latest Version 4.1 Introduces Enhanced Deployment Flexibility and AI-Driven Productivity Boost

Business Wire | November 02, 2023

SCYTHE, a leading provider of cybersecurity solutions, announces the release of SCYTHE 4.1, the latest evolution in its cutting-edge cyber resilience offering. This release brings new and enhanced features to empower organizations in their continuous efforts to strengthen their cybersecurity posture. SaaS Offering for Unparalleled Flexibility SCYTHE 4.1 introduces its initial Software as a Service (SaaS) offering, providing organizations with newfound deployment flexibility. This SaaS option offers the same robust capabilities as the on-premises version, ensuring that teams can choose the deployment model that best suits their needs without pricing changes. SCYTHE's commitment to flexibility ensures that organizations can secure their infrastructure on their terms. Advanced Agent Support with Scheduling for Continuous Testing To unlock even greater control over security testing, SCYTHE 4.1 introduces advanced agent support with scheduling. This feature allows organizations to perform continuous testing by automating the deployment and execution of security assessments at specified intervals. With the power of scheduling, teams can proactively identify threats, assess controls, and evaluate their readiness to respond to cyber threats. SCYTHE empowers organizations to maintain the highest level of cyber resilience without manual intervention. Cloppy - Your AI-Powered Security Analyst In a significant leap forward, SCYTHE unveils the early access beta release of "Cloppy," its supervised machine learning (ML)-based AI analyst chatbot. Cloppy enhances team productivity, job satisfaction, and cybersecurity capabilities by delivering instant insights and recommendations. This AI-driven assistant will leverage private knowledge base instances, ensuring sensitive information stays secure. Cloppy is poised to become a trusted companion for security professionals, providing real-time guidance and augmenting their decision-making processes. As cyber threats continue to evolve, so must our approach to cybersecurity. SCYTHE 4.1 represents our commitment to innovation and empowering organizations to stay ahead of cyber adversaries, said Marc Brown, Head of Product at SCYTHE. With our SaaS offering, advanced agent support, and the introduction of Cloppy, we're equipping organizations with the tools they need to enhance their cyber resilience while simplifying offensive security. SCYTHE 4.1 Platform is now available for both new and existing customers. For more information on SCYTHE's comprehensive cyber resilience solutions, please visit https://scythe.io. About SCYTHE SCYTHE represents a paradigm shift in cybersecurity risk management, empowering organizations to Attack, Detect, and Respond efficiently. The SCYTHE platform enables collaboration between red, blue, and purple teams to build and emulate real-world adversarial campaigns. SCYTHE's innovative dual-deployment options and comprehensive features ensure a proactive cybersecurity approach. Headquartered in Arlington, VA, SCYTHE is privately funded by distinguished partners dedicated to shaping a more resilient cybersecurity landscape.

Read More

Software Security

Malwarebytes Announces Consumer Identity Theft Protection Solution to Defend Against Online Fraud and Theft

PR Newswire | October 27, 2023

Malwarebytes, a global leader in real-time cyber protection, today launched an essential new consumer solution, Identity Theft Protection. The new service helps individuals secure their digital identities and defend against identity and online threats. Malwarebytes Identity Theft Protection includes real-time identity monitoring and alerts, robust credit protection and reporting and live agent-supported identity recovery and resolution services – backed by up to a $2 million identity theft insurance policy. The new service, paired with Malwarebytes' award-winning antivirus and VPN software, helps prevent criminals from stealing or using personal information to drain financial accounts, hack or impersonate social media accounts, damage a user's reputation or other online and identity-based attacks. Today's digital life is complex and sometimes deceptive. According to new research from Malwarebytes, identity theft ranks as people's third biggest concern when it comes to online security, just behind fear of financial accounts and personal data being breached – both of which play into identity theft. Of those surveyed 64% agree that identity theft protection is important, but only 13% have it. Consumers are also increasingly fearful of new technology. Malwarebytes gives consumers protection they can trust, alerting them when we see their information has been stolen and providing live agent support to restore their identity and replace lost items. Even as we spend more and more of our lives online, we all know that the internet today can't be trusted, said Mark Beare, GM of Consumer Business Unit, Malwarebytes. Consumers need a tool that not only blocks threats like malware and phishing, but that also monitors and protects their digital identity, be that social media profiles, bank accounts or email. With Malwarebytes Identity Theft Protection, we provide a robust and exhaustive suite of services so individuals and families can rest easy knowing that we are actively working to keep them safe and protect their digital identity. Malwarebytes Identity Theft Protection is available globally through a variety of tiered offerings that provide protection via computers and mobile devices across multiple operating systems including Windows, macOS, Android and iOS. Key features include: Identity Monitoring & Alerts: Continuously scours a multitude of websites and data sources, including the Dark Web, to alert if personal information is being illegally traded or sold. Recommends actions to take to protect yourself. Credit Monitoring and Protection: Ongoing tracking of credit for critical changes, such as new accounts or inquiries and applications for new lines of credit. A credit freeze also can be activated*. Breach IQ: Provides a safety score and alerts if personal information is part of a known breach*. Identity Recovery & Resolution: Assistance in the event of an identity theft incident, including guided steps to report the crime, dispute fraudulent charges, restore identity and recuperate financial losses incurred. Includes up to a $2 million insurance policy. About Malwarebytes Malwarebytes believes that when people and organizations are free from threats, they are free to thrive. Founded in 2008, Malwarebytes CEO Marcin Kleczynski had one mission: to rid the world of malware. Today, Malwarebytes' award-winning endpoint protection, privacy and threat prevention solutions along with a world-class team of threat researchers protect millions of individuals and thousands of businesses across the globe daily. Malwarebytes solutions are consistently recognized by independent tests including AVLAB and AV-TEST. The company is headquartered in California with offices in Europe and Asia. For more information and career opportunities, visit https://www.malwarebytes.com.

Read More

Software Security

Palo Alto Networks Intends to Acquire Talon Cyber Security

Palo Alto Networks | November 08, 2023

Palo Alto Networks plans to acquire Talon Cyber Security to enhance its Secure Access Service Edge (SASE) solution. Talon's Enterprise Browser technology, when integrated with Prisma SASE, will provide secure access to business applications. The acquisition reflects the importance of adapting SASE solutions to ensure consistent security for unmanaged devices. Palo Alto Networks, a global cybersecurity leader, has announced its intent to acquire Talon Cyber Security, an enterprise browser technology pioneer, to enhance its Secure Access Service Edge (SASE) solution and provide comprehensive protection for managed and unmanaged devices. In today's digital landscape, unmanaged devices often connect to enterprise applications without adequate security measures, making them susceptible entry points for attackers seeking to access sensitive information. Lee Klarich, Chief Product Officer of Palo Alto Networks, emphasized the importance of securing all work activity through an Enterprise Browser without compromising device privacy to protect users and applications effectively. He continued that the integration of Talon's technology with Prisma SASE aims to provide consistent security for all users and devices. Anand Oswal, SVP and GM at Palo Alto Networks highlighted the significance of securing unmanaged devices with the same robust security as managed devices, especially in today's dynamic threat landscape. HE further stated that the combination of Prisma SASE and Talon's Enterprise Browser is poised to revolutionize security measures in modern digital environments. Talon Cyber Security's Enterprise Browser technology offers an innovative solution that, when integrated with Prisma SASE, will enable users to securely access business applications from any device, including non-corporate devices, while ensuring a seamless user experience. This strategic move by Palo Alto Networks addresses the evolving security challenges in a connected world. Talon's Co-Founder and CEO, Ofer Ben-Noon, acknowledged the shifting work models and user preferences and the need for powerful last-mile security solutions. Talon's Enterprise Browser is designed to offer familiar user experiences with enterprise-grade protection. Ben emphasized that partnership with Palo Alto Networks is seen as a catalyst to accelerate its mission of delivering superior outcomes for customers. Talon, founded by Ofer Ben-Noon and Ohad Bobrov, secured the RSA Conference's Innovation Sandbox contest in 2022. The co-founders will continue to lead their teams within the Prisma SASE team at Palo Alto Networks upon the completion of the acquisition. Anand Oswal, Senior Vice President and General Manager at Palo Alto Networks, highlighted the advantages and security risks associated with Bring Your Own Device (BYOD) policies. He noted that Talon's Enterprise Browser provided security teams enhanced visibility and control over work-related Software as a Service (SaaS) and web activity across all devices, including personal and unmanaged endpoints. Anand emphasized the need for Secure Access Service Edge (SASE) solutions to adapt in order to secure unmanaged devices with the same consistent security measures applied to managed devices. This would enable users to access business applications securely from any device and location.

Read More

Software Security

SCYTHE Latest Version 4.1 Introduces Enhanced Deployment Flexibility and AI-Driven Productivity Boost

Business Wire | November 02, 2023

SCYTHE, a leading provider of cybersecurity solutions, announces the release of SCYTHE 4.1, the latest evolution in its cutting-edge cyber resilience offering. This release brings new and enhanced features to empower organizations in their continuous efforts to strengthen their cybersecurity posture. SaaS Offering for Unparalleled Flexibility SCYTHE 4.1 introduces its initial Software as a Service (SaaS) offering, providing organizations with newfound deployment flexibility. This SaaS option offers the same robust capabilities as the on-premises version, ensuring that teams can choose the deployment model that best suits their needs without pricing changes. SCYTHE's commitment to flexibility ensures that organizations can secure their infrastructure on their terms. Advanced Agent Support with Scheduling for Continuous Testing To unlock even greater control over security testing, SCYTHE 4.1 introduces advanced agent support with scheduling. This feature allows organizations to perform continuous testing by automating the deployment and execution of security assessments at specified intervals. With the power of scheduling, teams can proactively identify threats, assess controls, and evaluate their readiness to respond to cyber threats. SCYTHE empowers organizations to maintain the highest level of cyber resilience without manual intervention. Cloppy - Your AI-Powered Security Analyst In a significant leap forward, SCYTHE unveils the early access beta release of "Cloppy," its supervised machine learning (ML)-based AI analyst chatbot. Cloppy enhances team productivity, job satisfaction, and cybersecurity capabilities by delivering instant insights and recommendations. This AI-driven assistant will leverage private knowledge base instances, ensuring sensitive information stays secure. Cloppy is poised to become a trusted companion for security professionals, providing real-time guidance and augmenting their decision-making processes. As cyber threats continue to evolve, so must our approach to cybersecurity. SCYTHE 4.1 represents our commitment to innovation and empowering organizations to stay ahead of cyber adversaries, said Marc Brown, Head of Product at SCYTHE. With our SaaS offering, advanced agent support, and the introduction of Cloppy, we're equipping organizations with the tools they need to enhance their cyber resilience while simplifying offensive security. SCYTHE 4.1 Platform is now available for both new and existing customers. For more information on SCYTHE's comprehensive cyber resilience solutions, please visit https://scythe.io. About SCYTHE SCYTHE represents a paradigm shift in cybersecurity risk management, empowering organizations to Attack, Detect, and Respond efficiently. The SCYTHE platform enables collaboration between red, blue, and purple teams to build and emulate real-world adversarial campaigns. SCYTHE's innovative dual-deployment options and comprehensive features ensure a proactive cybersecurity approach. Headquartered in Arlington, VA, SCYTHE is privately funded by distinguished partners dedicated to shaping a more resilient cybersecurity landscape.

Read More

Events