DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY
Neosec | November 16, 2022
Neosec, the pioneer in discovering and identifying API threats using behavioral analytics, today announced that it now tokenizes API activity data to enable organizations to fully see and store API data, removing the possibility of keeping sensitive data at-rest.
Today, many organizations are blind to the threats lurking within their API traffic. Even worse, organizations are forced to implement basic logging of its API traffic that doesn't contain the meaningful information about who accessed, what records were accessed or manipulated and how. There exists a justified fear of logging sensitive data or being out of compliance, and with the lack of technology that can perform it at scale, they prefer to log with low fidelity. Those logs tell you that "somebody modified or accessed a record" but typically don't disclose who accessed it, which record, or what action was performed.
This decision also results in a downstream issue of "insufficient logging", which is noted by the Open Web Application Security Project as one of the top security problems in its 2021 OWASP API Top 10. "Insufficient logging" is poor for incident forensics and, in practice, means that you can't detect abuse or investigate a case, even if you know it happened.
Tokenization is the process of substituting a sensitive data element, like a credit card number, for a non-sensitive equivalent that has no intrinsic or exploitable value or meaning. Neosec's automated tokenization is part of its 'privacy by design' philosophy and is already deployed successfully at customers around the world in financial services, insurance and hospitality companies among others.
The process allows retaining tokenized API activity data for the purposes of performing true behavioral analytics over time, ensures that sensitive data is never stored at rest, and enables only the customer to de-tokenize, based on the strictest data privacy practices.
"Solving API security starts with basic visibility and the ability to see how the APIs are used. The problem is that virtually every company logs API activity with low fidelity that doesn't enable this basic visibility. "In order to perform true behavioral analytics and investigate cases you must store and examine historical data. But if this analysis is performed on un-tokenized data you risk storing PII and creating compliance issues. Neosec successfully retains all API activity data, in the highest fidelity, and ensures it meets data privacy standards."
Giora Engel, co-founder and chief executive officer, Neosec
This focus on data and the visibility it brings is what previously defined the creation of the EDR (Endpoint Detection & Response) security space. "Trying to implement API security without enabling basic visibility of activity is like going back to the antivirus age before the advent of EDR. Visibility into API activity allows you to detect threats, understand behavior, investigate and remediate" said Engel.
The Neosec API security solution discovers and maintains an up-to-date inventory of all APIs in use by an organization and then uses machine learning and behavioral analytics on tokenized data to find fraud and abuse by third parties and attackers. Neosec also enables proactive API threat hunting and investigations without storing any sensitive data.
The automated API data tokenization is now a capability of the Neosec platform and is fully available. There is no extra cost for use of this unique capability.
Neosec is re-inventing application security with a powerful platform that unifies security and development teams to protect modern applications from threats. The foundation of the SaaS platform is built on data and analytics to manage security at scale. Neosec prevents threats from abusing the complex network of APIs that connect today's businesses. The platform helps organizations discover every API and audit risk. Neosec has pioneered the use of behavioral analytics to understand normal versus abnormal API usage and delivers powerful threat hunting capabilities together with a team of expert threat hunters. Neosec prevents threats and stops abuse hiding within APIs and brings new intelligence to application security. Neosec is based in Palo Alto, California with R&D in Tel Aviv, Israel.
INFOSEC PROJECT MANAGEMENT,PLATFORM SECURITY,SOFTWARE SECURITY
NowSecure | January 03, 2023
NowSecure, the leader in standards-based mobile app security and privacy software, announced the introduction of its latest solution, NowSecure Mobile Pen Testing as a Service (PTaaS), which will bridge the gap between manual and automated mobile security assessments for continuous security.
NowSecure PTaaS is designed to provide mobile developers and security teams with a more cost-effective and efficient pen testing solution. The solution combines periodic expert manual assessments with continuous automated testing to optimize comprehensive coverage at a higher frequency. With this combination, the all-inclusive portal and service can instantly discover concerns early in the developer pipeline, provide consulting help to repair security issues promptly, and accelerate the release of high-quality software into production.
As organizations struggle with tightening budgets in conjunction with an increased threat of mobile cyber assaults, there is an industry demand for a cost-effective, higher-coverage, higher-frequency, mobile AppSec testing solution.
"According to Coalfire and NowSecure's 4th Annual Penetration Risk Report, 99% of mobile applications pose security or privacy threats."
By integrating NowSecure's latest offering, Mobile PTaaS, CISOs and security leaders can optimize their budget for penetration testing while prioritizing continuous, comprehensive security testing. The NowSecure Mobile PTaaS cloud-based platform, built on tens of thousands of pen tests and over 12 years of mobile application security experience, provides a comprehensive set of automatic, continuous, and manual assessments, including:
Expert pen testing periodically depending on the specific demand and timeline
On-demand and continuous security testing is built into the CD/CI and dev toolchains
Automatic ticket generation with incorporated remedial resources
Consultation with an experienced pen tester on remediation
Optional industry standard(s) certifications and validations
All-in-one SAST, IAST, DAST, APISec, and SBOM
Simple-to-use dedicated SaaS platform
A Chicago-based mobile security company, NowSecure safeguards the worldwide mobile app economy as the leading authority in standards-based mobile application privacy and security automation. The company is trusted by the most demanding enterprises for its comprehensive security testing solution package for DevSecOps, mobile app supply-chain monitoring, Pen Testing as a Service (PTaaS), professional mobile pen testing, and training courseware.
NowSecure actively contributes to and supports the open-source mobile security community, industry standards, and certifications such as ADA MASA, OWASP MASVS, NIAP, ioXt, and others. The firm is SOC 2-certified and has been recognized by Gartner, IDC, TAG Cyber, and Deloitte Fast 500.
ENTERPRISE SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY
Nozomi Networks | January 25, 2023
On January 24, 2023, Nozomi Networks Inc., one of the leaders in OT and IoT security, announced Nozomi ArcTM, the industry's first IoT and OT endpoint security sensor, intended to accelerate time to full operational resilience exponentially. Nozomi Arc is designed to automatically deploy across a large number of locations and devices anywhere a company needs visibility, and it provides vital data and insights about essential assets and network endpoints. This data is utilized to better analyze and prevent attacks, as well as correlate user behavior, without straining existing resources or interrupting mission-critical networks.
Arc is a game-changer in terms of comprehensive asset visibility, deployment speed, and network coverage across complex and remote OT and IT networks. Nozomi Arc is designed to:
Be deployed remotely
Analyze endpoint vulnerabilities
Accelerate monitoring deployments in mission-critical systems; and
Identify compromised hosts
Nozomi Networks Co-founder and CPO, Andrea Carcano, said, "Operational resiliency is the top business priority for critical infrastructure organizations, which can only be achieved by lowering cyber risks and increasing security." He added, "Nozomi Arc accelerates time to resiliency by transforming every computer on the network into an OT security sensor. It quickly extends visibility to attack surfaces and threats inside endpoint hosts and their local networks. With Nozomi Arc, users can quickly corollate more information from more sources for better diagnostics and faster time to response."
(Source – GlobeNewswire)
With Nozomi Arc, users get the following advantages:
Faster time to resiliency: Nozomi Arc removes time, resource, geographic, and internal policy limits from network-based deployments.
Lower cyber risk and increased security: The only OT solution in the market that can identify malicious hardware.
Extended visibility and context: In addition to illuminating additional assets, devices, and possible vulnerabilities, Arc detects process irregularities and questionable user behavior.
Lower operational overhead: Because Arc can be remotely deployed through a software download, Nozomi Arc does not need extensive network adjustments to be implemented anywhere in the world, even in the most remote locations.
About Nozomi Networks
Nozomi Networks, with headquarters in San Francisco, California, accelerates digital transformation by defending the world's critical infrastructure, industrial enterprises, and government enterprises from cyber-attacks. Its technology provides OT and IoT environments with superior network and asset monitoring, threat detection, and analytics. As a result, customers rely on the company's solution to reduce risk and complexity while increasing operational resiliency. In addition, the organization provides zero-trust security by delivering contextual data for policy decisions, such as endpoint posture checks, baseline monitoring, and device role data.