Picus Security | November 10, 2022
Picus Security, the pioneer of Breach and Attack Simulation (BAS), today announced the availability of its next-generation security validation technology. The new Picus Complete Security Validation Platform levels up the company's attack simulation capabilities to remove barriers of entry for security teams. It enables any size organization to automatically validate the performance of security controls, discover high-risk attack paths to critical assets and optimize SOC effectiveness.
"Picus helped create the attack simulation market, and now we're taking it to the next level, By pushing the boundaries of automated security validation and making it simpler to perform, our new platform enables organizations even without large in-house security teams to identify and address security gaps continuously."
-H. Alper Memis, Picus Security CEO and Co-Founder
The all-new-and-improved Picus platform extends Picus's capabilities beyond security control validation to provide a more holistic view of security risks inside and outside corporate networks. It consists of three individually licensable products:
Security Control Validation - simulates ransomware and other real-world cyber threats to help measure and optimize the effectiveness of security controls to prevent and detect attacks.
Attack Path Validation - assesses an organization's security posture from an 'assume breach' perspective by performing lateral movement and other evasive actions to identify high-risk attack paths to critical systems and users.
Detection Rule Validation - analyzes the health and performance of SIEM detection rules to ensure that SOC teams are reliably alerted to threats and can eliminate false positives.
A global cybersecurity workforce gap of 3.4 million professionals∗ means automated security validation is now essential to reduce manual workloads and help security teams respond to threats sooner. Recently, the US's Cybersecurity and Infrastructure Security Agency (CISA) and UK's National Cyber Security Centre (NCSC) published a joint advisory recommending organizations test their defenses continually and at scale against the latest techniques used by attackers.
Insights from point-in-time testing are quickly outdated and do not give security teams a complete view of their security posture, With the Picus platform, security teams benefit from actionable insights to optimize security effectiveness whenever new threats arise, not once a quarter. With our new capabilities, these insights are now deeper and cover even more aspects of organizations' controls and critical infrastructure,said Volkan Erturk, Picus Security CTO and Co-Founder.
About Picus Security
Picus Security is the pioneer of Breach and Attack Simulation (BAS). The Picus Complete Security Validation Platform is trusted by leading organizations worldwide to continuously validate security effectiveness and deliver actionable insights to strengthen resilience 24/7. Picus has offices in North America, Europe and APAC and is supported by a global network of channel and alliance partners. Picus has been named a 'Cool Vendor' by Gartner and is cited by Frost & Sullivan as one of the most innovative players in the BAS market.
DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY
Balbix | December 19, 2022
Balbix, the leader in cybersecurity posture automation, announced its support for Microsoft Azure today. With these new capabilities, Balbix now supports the three top cloud service providers – Microsoft Azure, Amazon Web Services and Google Cloud Platform – as well as traditional environments. Balbix also announced enhanced platform support for the Microsoft ecosystem, including Azure services, Windows, Microsoft Store apps and Azure Active Directory single sign-on.
McKinsey estimates that by 2025, organizations aspire to have 60 percent of their IT environments in the cloud. Yet, according to the Cybersecurity Insiders State of Security Posture Report, 62 percent of organizations lack confidence in their security posture. These findings highlight the growing need for effective cloud security solutions.
Balbix's support for Azure cloud services includes Azure Virtual Machines, Azure Service Bus Messaging, Azure Key Vault, Azure Blob Storage, Azure Cosmos DB, Azure Kubernetes Service (AKS), Azure SQL Database, Azure AKS Deployments, and Azure Functions. A new API-based Balbix Connector for Microsoft Azure and optional sensors for virtual machines capture data from Azure for analysis by the Balbix brain.
Cybersecurity teams can now:
Get comprehensive, real-time visibility of Azure assets, categorized into compute, storage, network, containers, database, security, and identity.
Capture system details for virtual machines, including network, storage, open ports, users, software bill of materials (SBOM) and security controls.
Combine Azure cloud data with data from other tools to map over 400 cybersecurity, IT and business attributes to assets.
Obtain visibility into misconfigurations – the most commonly exploited attack vector in cloud-hosted environments.
Leverage (optional) Balbix host sensors to gain visibility into additional types of vulnerabilities, such as unpatched software vulnerabilities, weak credentials, and trust issues.
Unified Visibility for Multi-Cloud Environments
Balbix's new support for Azure means that organizations now have access to an integrated Cyber Asset Attack Surface Management (CAASM) solution that works across the top three cloud providers, traditional data center and office environments, and mobile employee devices. Cybersecurity practitioners get a single tool to automatically combine data from disparate solutions into a unified view of their assets.
Balbix provides more than just visibility. Unlike other solutions, Balbix combines CAASM with Risk-Based Vulnerability Management (RBVM) and Cyber Risk Qualification (CRQ) capabilities. This tight integration enables maximally automated identification, prioritization and mitigation of security issues. Gaps in security controls are identified and rectified quickly. CISOs and their teams can calculate cyber risk for the entire enterprise, across cloud and non-cloud assets, in dollars, and make cybersecurity decisions, informed by real-time data and insights.
"Multi-cloud deployments have added additional complexity for cybersecurity practitioners. These challenges include fragmented visibility across cloud and non-cloud environments and an inability to prioritize vulnerabilities enterprise-wide," said Ed Amoroso, Founder and CEO of research and advisory firm TAG Cyber. "With support for Microsoft Azure, Balbix now helps users address these challenges across the top three cloud providers."
Broad Support for the Microsoft Ecosystem
Balbix's support for Microsoft Azure also adds to its broader support for the Microsoft ecosystem. These capabilities include security posture automation for assets running Windows and other Microsoft software, and third-party software products running on those assets. For Windows OS, Balbix provides a consolidated view of patch status and compliance across all assets with recommended fixes based on patch precedence.
"I'm very excited to announce our support for Microsoft Azure cloud services. Organizations can manage their cyber risk for Microsoft Azure, multi-cloud and hybrid environments using a single integrated and maximally automated paradigm. "With this software release, we've also enhanced our support for Windows to help Microsoft customers better protect their infrastructure."
Gaurav Banga, Founder and CEO of Balbix
In addition, Balbix now allows security teams to manage the security posture of applications downloaded from the Microsoft Store. Balbix is also announcing a new integration with Microsoft Azure Active Directory single sign-on.
Balbix enables businesses to reduce cyber risk by quickly identifying and mitigating their riskiest cybersecurity issues. Our SaaS platform, the Balbix Security Cloud™, ingests data from businesses' security and IT tools so they can understand every aspect of their cybersecurity posture, build a unified cyber risk model and obtain actionable insights for risk reduction. With Balbix, businesses can automate their cloud and on-premise asset inventory, conduct continuous risk-based vulnerability management and quantify cyber risk in dollars. Executives and operational teams can make cybersecurity decisions based on data, not opinions.
DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY
Legit Security | December 12, 2022
Legit Security, a cyber security company with an enterprise platform that protects an organization's software supply chain from attack and ensures secure application delivery, today announced that it discovered a new class of software supply chain vulnerabilities that leverage artifact poisoning to attack underlying software development pipelines. The vulnerability was found in GitHub Actions, a platform for orchestrating and automating software development pipelines, and the vulnerability was identified in the highly popular programming language Rust. Many other GitHub Action projects remain potentially vulnerable and a technical disclosure blog including information to protect organizations from attack is available on Legit Security’s website.
The discovered pipeline vulnerability could allow any GitHub user to replace legitimate development artifacts with malicious ones, enabling attackers to modify source code, steal secrets and create CodeCov-like wide-reaching software supply chain attacks. Rust, an extremely popular programming language used by millions of developers, acknowledged and fixed the vulnerability after initial disclosure by the Legit Security Research Team.
GitHub Actions is part of the extremely popular GitHub source code management system at the heart of many organization’s software supply chains and used by software developers globally. The vulnerability affects the GitHub Actions artifacts storage mechanism, which is used to store and transfer build artifacts between software development build jobs. Due to a limitation in the cross-workflow artifact communication mechanism, vulnerable workflows cannot distinguish between legitimate project artifacts and artifacts that were created by the project’s forks or copies, allowing any user to create a fork, and then craft a malicious artifact that will be treated as a legitimate one.
“This is a different class of vulnerability that can lead to attacks and modification of the development pipeline itself, not just modification of the code. “A simple analogy could be made to a car assembly line. This is an attack on the assembly line itself that could include stealing sensitive parts, turning off certain steps, or substituting any valid part for a malicious one. It’s a powerful attack vector that gives cyber criminals a lot of options to inflict damage. In this case, the vulnerable targets are software supply chains that use GitHub Action.”
Liav Caspi, co-founder and CTO, Legit Security
The Legit Security Research Team also disclosed the security issue to the GitHub security team. GitHub responded by simply updating their API to include information that could help prevent this vulnerability. It should be noted that GitHub didn’t address the root cause of the issue, thus leaving many other GitHub Action projects vulnerable to the aforementioned software supply chain attacks. Legit Security’s technical disclosure blog includes important information on how to protect organizations from this type of attack. More information about general GitHub security best practices can also be found here.
Legit Security protects an organization's software supply chain from attack and ensures secure application delivery, governance and risk management from code to cloud. The platform’s unified application security control plane and automated SDLC discovery and analysis capabilities provide visibility and security control over rapidly changing environments, and allow security issues to be prioritized based on context and business criticality to improve security team efficiency and effectiveness.