WEB SECURITY TOOLS

Indusface Enhances its Web Application & API Protection (WAAP) platform AppTrana with Industry's First Risk-Based Protection to APIs

Indusface | May 19, 2022

Indusface
Indusface, a leading application security SaaS company that continually detects security risks, provides real-time protection, and improves the performance of Websites and Applications, today announced that it is adding Risk-Based API Protection to its WAAP platform, AppTrana.

APIs are the lifeline of the digital economy with many companies adopting the API-first approach. However, the growth of APIs is also opening up new risk vectors that they are not aware of. According to Gartner, more than 90% of applications have more attack surface exposed through API than UI and by 2022, API Abuse will move from an infrequent to the most-frequent attack vector, resulting in data breaches for enterprise web applications.

Indusface is revolutionizing the API security space by building on its API Protection capabilities. The company is doing so through the most comprehensive API protection to date by extending its risk-based approach to the same.

"AppTrana's risk-based approach is unique and something that resonates with our customers. What customers are really interested in is knowing how well their application is protected based on the risk posture of their application. Building on this, we are now enhancing our API Protection capabilities by providing a risk-based approach to API security which we believe would revolutionize the market. With this, customers will be able to identify vulnerabilities found in their public APIs and quickly correlate how these are protected through API-specific policies and positive security policies applied in AppTrana providing the most comprehensive protection for APIs."

Ashish Tandon, Founder and CEO, Indusface

As with any security, you can protect only what you know and protection is as strong as the weakest link. The major challenges with APIs are discoverability and the ability to understand the context of APIs so that security can be tailored accordingly. It is to address these challenges that Indusface is enhancing its API protection in AppTrana. Collectively through a multi-step approach, customers get to discover APIs, understand risk posture and ensure comprehensive protection of APIs.

With Indusface AppTrana's Risk-based API Protection, you get:

  • To understand the risk posture of the APIs through unlimited automated API scans including manual tests for identifying business logic vulnerabilities. This enables organization to understand the weakest links of the APIs and get clear visibility around how these links are protected.
  • Visibility into API traffic patterns and discovery of shadow APIs, so that you are no longer blindsided by what you don't know
  • To protect APIs with API-specific rules written specifically to protect against OWASP Top 10 API vulnerabilities
  • Behavioral-based protection against DDoS attacks on APIs by analyzing API traffic pattern
  • Behavioral-based protection against BOT attacks
  • Positive security for APIs through analysis of swagger (OpenAPI 2.0) files and creation of automated positive security policies 
  • Accurate, real-time view of vulnerabilities blocked by API specific rules, positive security policies, custom rules, and those that need fixes in the application

About Indusface
Indusface is a leading application security SaaS company that secures critical Web, Mobile, and API applications of 3000+ global customers using its award-winning fully managed platform that integrates web application scanner, web application firewall, DDoS & BOT Mitigation, CDN, and threat intelligence engine.

Indusface has been funded by Tata Capital Growth Fund II, is the only vendor to be named Gartner Peer Insights™ Customers' Choice' in all the 7 segments for Voice of Customer WAAP (Web Application and API Protection) Report 2022, is a "Great Place to Work" certified SaaS product company, is PCI, ISO27001, SOC 2, GDPR certified, and has been the recipient of many prestigious start-up awards such as the Economic Times Top 25, NASSCOM DSCI Top Security Company, Deloitte Asia Top 100, among others.

Spotlight

Hybrid networks have improved business users' productivity, but they have also radically pushed the limits of conventional security controls and unleashed many new attack vectors that can be exploited. Learn how Riverbed can improve your application security with solutions that are purpose-built with security in mind and based on industry-recognized security standards.

Spotlight

Hybrid networks have improved business users' productivity, but they have also radically pushed the limits of conventional security controls and unleashed many new attack vectors that can be exploited. Learn how Riverbed can improve your application security with solutions that are purpose-built with security in mind and based on industry-recognized security standards.

Related News

DATA SECURITY,ENTERPRISE SECURITY,SOFTWARE SECURITY

Veza Announces Open Authorization API to Extend Identity-First Security Across the Enterprise Data Landscape

Veza | December 02, 2022

Veza today announced that its Open Authorization API (OAA) is now public on GitHub for community collaboration, extending the reach of identity-first security across the enterprise. Developers can now create and share connectors to extend the Veza Authorization Graph to all sensitive data, wherever it lives, including cloud providers, SaaS apps, and custom-built internal apps, accelerating their company’s path to zero trust security. Security professionals espouse the principle of ‘Least Privilege’ to secure enterprise data, but the rush to a multi-cloud, multi-app environment has exploded the complexity and layers of interconnection for which access must be understood, monitored, and constantly remediated to achieve and maintain least privilege. Recent attacks on Okta and Twilio demonstrate that companies are allowing overly-broad access to data via constructs of groups, roles, policies, and system specific permissions. Veza connects the dots of effective permissions across cloud providers, SaaS apps and identity platforms, making it easy to visualize who can view or delete sensitive data. OAA allows organizations and the broader community to create their own integrations with Veza, extending visibility to any resource, including SaaS apps like GitLab and Jira as well as custom-built internal apps. “The vast majority of cybersecurity failures are rooted in issues with the gap that exists between identity, access to data, and permissions,” said Tarun Thakur, co-founder and CEO, Veza. “Since our founding, we have been committed to protecting our customers from threats like ransomware, privilege abuse, and data breaches. With Veza Open Authorization API, we are extending our identity-first security approach broadly in the market and arming organizations with the tools they need to remediate undesirable and unnecessary data access at a granular level, and meet the requirements of access governance for enterprise systems, both on-premises and in the cloud." With Veza's Open Authorization API, customers can translate and visualize authorization metadata from any SaaS app, custom and in-house applications. Users can explore identity-to-data relationships through the Authorization Graph, monitor for least privilege misconfigurations and violations, and conduct comprehensive entitlement reviews for all of their sensitive data. “We specifically chose Veza because their Open Authorization API allowed us to connect to our custom internal applications. We follow the principle of least privilege, but with so many systems to review, we valued Veza’s unique ability to give us a comprehensive view quickly. They made it faster and easier for our team to review all permissions with confidence.” -Riaz Lakhani, CISO of Barracuda Networks. As an open-source project on GitHub, Veza’s Open Authorization API allows customers and partners to learn from, and build upon, each other’s work to create a control plane that reaches all data. By bringing OAA SDK and connectors available on GitHub Community, Veza empowers customers to ingest authorization metadata previously isolated in internal systems and SaaS applications. The OAA community has already created integrations for critical SaaS apps including GitHub, GitLab, Bitbucket, Jira, Zendesk, Slack, Coupa Software, Pagerduty, and Looker. These integrations are available now to all Veza customers. “Veza solves the problem of aligning identities to data,” said Craig Rosen, Chief Security & Trust Officer at ASAPP. “Veza’s Open Authorization Platform helped us extend that visibility to all the apps and data that matter most to us, like GitHub and Jira. Now it is easy for our security professionals to understand (and remediate) who has access to our important intellectual property.” About Veza Veza is the authorization platform for data. Built for hybrid, multi-cloud environments, Veza enables organizations to visualize, remediate, and control who can and should take what action on what data. We empower customers to take an identity-first approach to secure data by addressing critical business needs of streamlining identity and access governance, implementing data lake security, managing cloud entitlements, and modernizing privileged access. Our Authorization Graph connects identities to data across enterprise systems, enabling analysis, monitoring, and certification of end-to-end access. Global enterprises like Blackstone, ASAPP, Barracuda Networks, Choice Hotels, and a number of Fortune 500 and emerging organizations trust Veza to secure their enterprise data. Founded in 2020, Veza is headquartered in Los Gatos, California, and is funded by Accel, Bain Capital, Ballistic Ventures, GV, Norwest Venture Partners, and True Ventures.

Read More

DATA SECURITY, PLATFORM SECURITY

Privacera Expands Google Cloud Capabilities with Latest Release to Dataproc to Provide Enterprise-Grade Data Security Governance

Privacera | October 11, 2022

Privacera, the only open-standards based data security governance leader founded by the creators of Apache Ranger™, today announced native support for Dataproc. This integration allows users to define and enforce fine-grained level access control to Dataproc with Apache Hive, Apache Spark, and Presto. Privacera already natively integrates and supports a number of Google Cloud Platform (GCP) services such as BigQuery and Google Cloud Storage. Privacera helps enterprise data teams protect sensitive data and enable privacy across all on-premise, hybrid and multi-cloud data sources while reducing time to insights by automating outdated, manual governance processes. With the availability of Privacera's native integration to Dataproc, organizations will be able to accelerate their migration to GCP by securely managing data access policies across diverse on-premise and GCP data sources. This will significantly reduce the efforts around data migrations to the cloud through increased automation and consistent policy management, and the ability to ensure compliance through an open, consistent and proven standard. For users of Apache Ranger who are looking to build new secure data applications in the cloud, with Privacera, they can now leverage the same security and governance capabilities that they are familiar with to more sources, at enterprise scale, and greater functionality, since Privacera is based on Apache Ranger open standards. "Expanding the sources that we support and contributing to the Apache Ranger community increases the ability for our customers to leverage their existing investments in secure and consistent data access policies. "Our customers, including a large consumer credit reporting agency that uses GCP and Privacera as part of their modern data stack, can now extend their capabilities to discover and secure sensitive data sets across numerous GCP data services while migrating safely to the cloud." Privacera CEO Balaji Ganesan Privacera offers Dataproc users the following extended privacy and governance capabilities: Centralized management and enforcement of tag-based data access control policies across GCP and other cloud data services Policies for fine-grained access controls for Apache Hive, Apache Spark,and Presto Customizable, out-of-the-box compliance, audit, and governance reports for CCPA, GDPR, LGPD, HIPAA, RTBF, and more Dynamic encryption, decryption, and masking (column masking and row filtering) Broad integrations with identity management systems like corporate AD/LDAP, Okta, and SCIM SOC 2 Type 2 compliant, enterprise-grade SaaS data access governance solution that can be configured in minutes Hardened deployment of Apache Ranger with high-availability About Privacera Founded in 2016 by the creators of Apache Ranger™, Privacera's SaaS-based data security and access governance platform enables data and security teams to simplify data access, security, and privacy for data applications and analytical workloads. The Privacera platform supports compliance with regulations such as GDPR, CCPA, LGPD, and HIPAA. Privacera provides a unified view and control for securing sensitive data across multiple cloud services such as AWS, Azure, Databricks, GCP, Snowflake, and Starburst. The Privacera platform is utilized by Fortune 500 customers across finance, insurance, life sciences, retail, media, and consumer industries, as well as government agencies to automate sensitive data discovery, mask sensitive data, and manage high-fidelity policies at petabyte scale on-premises and in the cloud.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Bitdefender Launches Industry’s First Chat Protection Feature for Mobile-Based Instant Messaging Applications

Bitdefender | November 03, 2022

Bitdefender, a global cybersecurity leader, today unveiled the first real-time chat protection capabilities for mobile-based instant messaging applications. Bitdefender Chat Protection immediately alerts users if malicious links are received or sent during live sessions over the world’s most popular chat applications including WhatsApp, Facebook Messenger, Telegram and Discord. A true industry innovation, the new capabilities help protect users from increased cybercriminal activities targeting mobile devices. Chat Protection is incorporated into Bitdefender Mobile Security for Android through Bitdefender Scam Alert technology, used by consumers worldwide for monitoring, detecting and stopping link-based attacks delivered via messaging applications, notifications, and SMS text messages. Chat Protection continuously monitors chat sessions alerting users of suspicious links that might attempt to steal financial data, credentials and other sensitive information. When malicious links are detected during chat sessions, the user receives a warning along with information about associated risks and a suggested course of action. If warnings are ignored, built-in web protection technologies prevents the user from navigating to the malicious webpage. More than two billion people use WhatsApp and more than one billion use Facebook Messenger globally. At the same time, malware and scams sent via instant messaging apps and SMS text message remain one of the top threats to mobile users in 2022. According to the 2021 Bitdefender Consumer Threat Landscape Report, spam and untrusted domains account for a combined 85% of detected malicious URLs. “Mobile threats continue to increase, and cybercriminals have evolved beyond email-based phishing attacks to include SMS text messages (smishing) and popular instant messaging applications. “With the new capabilities in Bitdefender Mobile Security for Android, users can rest easy and chat safely knowing they have strong, real-time protection against malware, malicious links and scams across their Android devices.” Ciprian Istrate, senior vice president of operations, Consumer Solutions Group at Bitdefender Key Features and Benefits Bitdefender Mobile Security for Android with Chat Protection customers benefit from: Preemptive alerting for financial and data loss risks -- When users receive a suspicious link in messaging applications, notifications or text messages they are notified to prevent accessing or sharing the link. Enhanced protection for friends and family -- If a potentially dangerous link is inadvertently shared, users have the options to recall or delete the message. Detection of sophisticated social engineering -- Phishing attempts that rely on human curiosity, urgency, and impersonation are recognized and flagged by Bitdefender offering users an additional layer of protection. About Bitdefender Bitdefender provides cybersecurity solutions with leading security efficacy, performance, and ease of use to enterprise organizations and consumers. Guided by a vision to be the world’s most trusted cybersecurity solutions provider, Bitdefender is committed to defending organizations and individuals around the globe against cyberattacks to transform and improve their digital experience.

Read More