DATA SECURITY

DoControl Integrates with Box to Transform SaaS Data Access Security

DoControl | August 03, 2022 | Read time : 03:00 min

DoControl
DoControl, the automated Software as a Service (SaaS) security company, today announced an expanded integration with Box, the leading Content Cloud, that adds a foundational layer of granular controls to protect sensitive data and provide comprehensive data access security. The solution further secures cross-application, business-critical data, and files accessed by every identity and entity, both internal employees and external collaborators, allowing for content collaboration to be achieved securely.

Recent research found that nearly half of enterprise tech leaders find too much time is spent on manually provisioning and managing apps. In addition, it found other pain points around managing SaaS, including a lack of visibility, data exposure, and unmanageable access. DoControl No-Code SaaS Security Workflows Engine supports organizations in mitigating ongoing risk consistently, with the customization level required to effectively balance security with business enablement.

"By partnering with Box, we will help customers confidently maintain business continuity and mitigate the risk of data breaches, overexposure, and exfiltration. "Security teams can effectively extend least privilege to the SaaS data layer and utilize a risk-based approach in securing their Box instances through the prioritization of identities that present higher levels of risk."

Adam Gavish, CEO and Co-Founder of DoControl

"Organizations today need products that are inherently secure to support employees working from anywhere," said Fred Klein, Vice President of Business and Corporate Development at Box. "At Box, we continuously strive to improve our integrations with third-party apps so that it's easier than ever for customers to use Box alongside best-in-class solutions. With today's integration with DoControl, we are taking that mission one step further to enable our joint customers to have more granular security controls over who has access to their business-critical content."

Key joint solution capabilities include:

  • Comprehensive asset management: Gain full awareness of every entity that is accessing corporate data within Box to identify what needs to be protected;
  • Real-time monitoring and control: Monitor every user activity in real-time, with self-service tooling to detect and respond to immediate threats;
  • Automated remediation: Establish data access control workflows that are future-proofed, consistently enforced, and allow for secure file sharing between all internal and external users.

About DoControl
Founded in 2020 and headquartered in New York, DoControl is an automated data access controls platform for SaaS applications, improving security and operational efficiency with ease for enterprises. DoControl is backed by investors Insight Partners, StageOne Ventures, Cardumen Capital, RTP Global and global cybersecurity leader CrowdStrike's early stage investment fund, the CrowdStrike Falcon Fund. The company's leadership team combines product, engineering and sales experience across cybersecurity, enterprise and SaaS innovators.

Spotlight

The TAC 202 is a freely available security standards framework that can be adapted and applied in many different types of organizations looking for guidance for securing their environment. There are essentially two different variants of the standard. The first is focused on Texas state agencies while the second covers guidance for Texas State Universities. For these two targets, the standard is a requirement. However, it can be applied to a diverse set of environment with a little adaptation. While the TAC 202 would not be considered the definitive security standard for securing your environment unless required, it can represent a great foundation toward building or enhancing your security program.

Spotlight

The TAC 202 is a freely available security standards framework that can be adapted and applied in many different types of organizations looking for guidance for securing their environment. There are essentially two different variants of the standard. The first is focused on Texas state agencies while the second covers guidance for Texas State Universities. For these two targets, the standard is a requirement. However, it can be applied to a diverse set of environment with a little adaptation. While the TAC 202 would not be considered the definitive security standard for securing your environment unless required, it can represent a great foundation toward building or enhancing your security program.

Related News

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Datadog Announces Integration with Amazon Security Lake

Datadog | November 30, 2022

Datadog, Inc., the monitoring and security platform for cloud applications, today announced a new integration with Amazon Security Lake. The integration, announced during AWS re:Invent, makes it easy for Amazon Security Lake users to send cloud security logs to Datadog in a standard format. Building data pipelines in order to aggregate and route security logs to various security analytics solutions can be a cumbersome and time-consuming process. For Amazon Security Lake customers, Datadog's integration provides an easy way to send security logs to Datadog with minimal configuration required. Once security logs are ingested into Datadog, customers can analyze and identify threats through out-of-the-box detection rules or by writing custom security rules. They can also do deeper investigations using Datadog's log management tools. "Amazon Security Lake makes it easier for teams to manage their cloud security data and analyze it with partner solutions of their choice," said Rod Wallace, General Manager for Amazon Security Lake. "Datadog's integration with Amazon Security Lake will allow customers to collect their security logs to improve their cybersecurity posture and send them to Datadog for analysis leveraging an open source schema." "Security threat detection and investigation is dependent on an effective logging strategy that ensures critical logs are being properly analyzed. However, managing dozens of log integrations from cloud-hosted accounts and entities can be cumbersome and lead to gaps in visibility. "Amazon Security Lake and Datadog are working together to provide an easy way to set up and manage important log integrations for Datadog Cloud SIEM, giving customers deep visibility into their most critical infrastructure." Pierre Betouin, SVP of Security Products at Datadog About Datadog Datadog is the monitoring and security platform for cloud applications. Our SaaS platform integrates and automates infrastructure monitoring, application performance monitoring and log management to provide unified, real-time observability of our customers' entire technology stack. Datadog is used by organizations of all sizes and across a wide range of industries to enable digital transformation and cloud migration, drive collaboration among development, operations, security and business teams, accelerate time to market for applications, reduce time to problem resolution, secure applications and infrastructure, understand user behavior and track key business metrics.

Read More

DATA SECURITY, PLATFORM SECURITY, SOFTWARE SECURITY

BlueVoyant Recognized with Microsoft Verified Managed XDR Solution Status

BlueVoyant | October 21, 2022

BlueVoyant, an industry-leading cyber defense company that combines internal and external cybersecurity, today announced it has achieved Microsoft verified Managed Extended Detection and Response (MXDR) solution status. By achieving this status, BlueVoyant has proven its robust MXDR services, which include a Security Operations Center (SOC) with 24x7 year-round proactive hunting, monitoring, and response capabilities, are all built on tight integrations with the Microsoft Security platform. This solution combines expert-trained technology with human-led services and has been verified by Microsoft engineers. "BlueVoyant and Microsoft both recognize that the best cyber defense is advanced technology backed by human-led expertise. "We are honored to be teaming with Microsoft to deliver a Microsoft verified Managed XDR Solution. Earning verified MXDR solution status is among other recent accolades BlueVoyant received from Microsoft. Both companies recognize that cybersecurity is a team sport, and we look forward to continuing to work closely with Microsoft to deliver the very best in cybersecurity to our joint customers." Milan Patel, global head of managed security services (MSS) at BlueVoyant Said Rob Lefferts, corporate vice president, modern protection and SOC, for Microsoft: "With malicious attacks on the rise, we understand security is front and center for our customers. That is why I am excited to congratulate BlueVoyant on achieving Microsoft Verified: Managed Extended Detection and Response solution status. [Its] solution closely integrates with Microsoft 365 Defender and Microsoft Sentinel and has been verified by Microsoft Security engineering to ensure that it provides comprehensive service coverage across the Microsoft Security portfolio." BlueVoyant is a managed security service provider (MSSP) member of the Microsoft Intelligent Security Association (MISA). The company was a finalist in the Microsoft Security Excellence Awards, given by MISA, for Security MSSP of the Year. "The Microsoft Intelligent Security Association is comprised of some of the most reliable and trusted security companies across the globe," said Maria Thomson, Microsoft Intelligent Security Association lead. "Our members share Microsoft's commitment to collaboration within the cybersecurity community to improve our customers' ability to predict, detect, and respond to security threats faster. We're thrilled to recognize and welcome BlueVoyant's MXDR solution to the MISA portfolio." Earning verified MXDR solution status is among a long list of recognition BlueVoyant has received from Microsoft. Earlier this year, BlueVoyant was named the Microsoft Security U.S. Partner of the Year, a finalist in the Microsoft Canada Impact Awards in two categories — Healthcare Impact Award and Security Impact Award — and one of Microsoft's top 150 managed security partners. In 2021, BlueVoyant was named a Microsoft Security 20/20 Partner Awards Winner for Top MDR (Managed Detection and Response) Team. About BlueVoyant BlueVoyant combines internal and external cyber defense capabilities into an outcomes-based platform called BlueVoyant Elements™. Elements is cloud-native and continuously monitors your network, endpoints, attack surface, and supply chain plus the clear, deep, and dark web for vulnerabilities, risks, and threats; and takes action to protect your business, leveraging both machine learning-driven automation and human-led expertise. Elements can be deployed as independent solutions or together as a full-spectrum cyber defense platform. BlueVoyant's approach to cyber defense revolves around three key pillars — technology, telemetry, and talent — that deliver industry-leading cybersecurity to more than 700 clients across the globe.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Neosec Introduces Automated Tokenization to Enable Full API Visibility Without Exposure of Sensitive Data

Neosec | November 16, 2022

Neosec, the pioneer in discovering and identifying API threats using behavioral analytics, today announced that it now tokenizes API activity data to enable organizations to fully see and store API data, removing the possibility of keeping sensitive data at-rest. Today, many organizations are blind to the threats lurking within their API traffic. Even worse, organizations are forced to implement basic logging of its API traffic that doesn't contain the meaningful information about who accessed, what records were accessed or manipulated and how. There exists a justified fear of logging sensitive data or being out of compliance, and with the lack of technology that can perform it at scale, they prefer to log with low fidelity. Those logs tell you that "somebody modified or accessed a record" but typically don't disclose who accessed it, which record, or what action was performed. This decision also results in a downstream issue of "insufficient logging", which is noted by the Open Web Application Security Project as one of the top security problems in its 2021 OWASP API Top 10. "Insufficient logging" is poor for incident forensics and, in practice, means that you can't detect abuse or investigate a case, even if you know it happened. Tokenization is the process of substituting a sensitive data element, like a credit card number, for a non-sensitive equivalent that has no intrinsic or exploitable value or meaning. Neosec's automated tokenization is part of its 'privacy by design' philosophy and is already deployed successfully at customers around the world in financial services, insurance and hospitality companies among others. The process allows retaining tokenized API activity data for the purposes of performing true behavioral analytics over time, ensures that sensitive data is never stored at rest, and enables only the customer to de-tokenize, based on the strictest data privacy practices. "Solving API security starts with basic visibility and the ability to see how the APIs are used. The problem is that virtually every company logs API activity with low fidelity that doesn't enable this basic visibility. "In order to perform true behavioral analytics and investigate cases you must store and examine historical data. But if this analysis is performed on un-tokenized data you risk storing PII and creating compliance issues. Neosec successfully retains all API activity data, in the highest fidelity, and ensures it meets data privacy standards." Giora Engel, co-founder and chief executive officer, Neosec This focus on data and the visibility it brings is what previously defined the creation of the EDR (Endpoint Detection & Response) security space. "Trying to implement API security without enabling basic visibility of activity is like going back to the antivirus age before the advent of EDR. Visibility into API activity allows you to detect threats, understand behavior, investigate and remediate" said Engel. The Neosec API security solution discovers and maintains an up-to-date inventory of all APIs in use by an organization and then uses machine learning and behavioral analytics on tokenized data to find fraud and abuse by third parties and attackers. Neosec also enables proactive API threat hunting and investigations without storing any sensitive data. The automated API data tokenization is now a capability of the Neosec platform and is fully available. There is no extra cost for use of this unique capability. About Neosec Neosec is re-inventing application security with a powerful platform that unifies security and development teams to protect modern applications from threats. The foundation of the SaaS platform is built on data and analytics to manage security at scale. Neosec prevents threats from abusing the complex network of APIs that connect today's businesses. The platform helps organizations discover every API and audit risk. Neosec has pioneered the use of behavioral analytics to understand normal versus abnormal API usage and delivers powerful threat hunting capabilities together with a team of expert threat hunters. Neosec prevents threats and stops abuse hiding within APIs and brings new intelligence to application security. Neosec is based in Palo Alto, California with R&D in Tel Aviv, Israel.

Read More