SOFTWARE SECURITY

McGill and Partners Choose CyberCube for Cyber Risk Analytics

CyberCube | July 14, 2022 | Read time : 3 min

CyberCube
CyberCube, the provider of the world’s leading cyber risk analytics for the insurance industry, today announces that McGill and Partners, the specialist (re)insurance broker, is using its Portfolio Manager and Broking Manager cyber risk analytics platforms.

Launched in 2019 by insurance veteran Steve McGill, McGill and Partners is rapidly growing to become a major force in the insurance and reinsurance market, quickly developing its offering in both cyber reinsurance and insurance. Today the firm has over 430 staff and offices in the UK, US, Bermuda and Ireland. The deal with CyberCube is part of McGill and Partners’ continued development of its cyber (re)insurance strategy.

CyberCube’s Portfolio Manager is a scenario-based data-driven model that enables risk professionals to develop insights for their senior leadership and teams. Portfolio Manager stress tests portfolios of insurance and reinsurance risks against a range of systemic cyber-related scenarios including data breaches, cloud outages, global ransomware attacks and financial fraud.

Broking Manager is the first software-as-a-service application CyberCube has built specifically for the insurance broking community. It offers a streamlined approach to analyzing potential financial exposure impacts arising from cyber events that helps clients make informed decisions on coverages and limits.

“We are excited to be working with the team at McGill and Partners and be part of the company’s cyber (re)insurance growth strategy on both the direct insurance side via Broking Manager and on its reinsurance side via Portfolio Manager.”

Alejandra Donoso, CyberCube’s Principal Client Account Manager

Neil Sharma, Partner – Reinsurance at McGill and Partner, said: “We are looking to bring all stakeholders in the cyber value chain together; collaborating between our insurance and reinsurance teams and partnering with CyberCube’s platforms which help deepen our understanding of the risks allowing us to provide best-in-class solutions to our clients.”

About CyberCube
CyberCube delivers the world’s leading cyber risk analytics for the insurance industry. With best-in-class data access and advanced multi-disciplinary analytics, the company’s cloud-based platform helps insurance organizations make better decisions when placing insurance, underwriting cyber risk and managing cyber risk aggregation.

Spotlight

"For many years the primary focus of network defense concentrated on securing the “edge.”  This concept of the edge or perimeter was a clearly demarcated point on the network.  This security model proved to be effective.  In keeping with the “cat and mouse” game, attackers shifted their focus to target inside machines and users with phishing tactics and zero@day malware.  Once a user’s machine is under the control of an attacker, the edge defenses are usually less effective.  In addition, many organizations lack network segmentation and authorization, allowing the attacker to pivot throughout the network.  The concept of the edge needs to be redefined.  Today’s edge extends well beyond the traditional perimeter into the internal network.  As such a “zero trust” network security model should be adopted.  In order to secure the edge of today, the technology needs to be flexible and capable of following a user no matter the location or device.  Static controls are no longer the answer.  A layer 7 firewall with user@based policies can be utilized to create internal network segmentation. Technologies referenced for implementing this security model will be a Fortinet security appliance, Fortinet’s single sign@on technology, and Microsoft Active Directory. "

Spotlight

"For many years the primary focus of network defense concentrated on securing the “edge.”  This concept of the edge or perimeter was a clearly demarcated point on the network.  This security model proved to be effective.  In keeping with the “cat and mouse” game, attackers shifted their focus to target inside machines and users with phishing tactics and zero@day malware.  Once a user’s machine is under the control of an attacker, the edge defenses are usually less effective.  In addition, many organizations lack network segmentation and authorization, allowing the attacker to pivot throughout the network.  The concept of the edge needs to be redefined.  Today’s edge extends well beyond the traditional perimeter into the internal network.  As such a “zero trust” network security model should be adopted.  In order to secure the edge of today, the technology needs to be flexible and capable of following a user no matter the location or device.  Static controls are no longer the answer.  A layer 7 firewall with user@based policies can be utilized to create internal network segmentation. Technologies referenced for implementing this security model will be a Fortinet security appliance, Fortinet’s single sign@on technology, and Microsoft Active Directory. "

Related News

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

SentinelOne and Perception Point Partner for Unparalleled Advanced Threat Protection and Rapid Remediation Across Principal Attack Vectors

Perception Point | September 30, 2022

Perception Point, a leading provider of advanced threat protection across digital channels, today announced that it has partnered with SentinelOne, an autonomous cybersecurity platform company, to provide customers unparalleled advanced threat detection and rapid remediation across enterprise endpoints, email, and cloud collaboration channels. SentinelOne Singularity XDR unifies prevention, detection, and response into a single platform driven by patented machine learning and intelligent automation. Perception Point isolates, detects and remediates all threats across the organization's main attack vectors, including email and cloud collaboration channels, from a single platform. Perception Point's integration with SentinelOne offers users the unique ability to simplify and consolidate protection across these attack vectors, and rapidly remediate any threat autonomously across them. Joint customers benefit from: Rapid remediation with additional triage from Perception Point's managed Incident Response service Reduced workloads on the SOC team by up to 75%, simplifying and shortening containment time Full visibility into attacks across the endpoint, email, and cloud collaboration apps "The threat landscape is only becoming more complex with attacks threatening organizations across multiple vectors. "We're excited to partner with SentinelOne to protect users from all threat types across their most used communication channels - endpoints, email, cloud collaboration apps, and cloud storage. The integration consolidates and simplifies threat prevention and remediation, boosting our customers' security posture while reducing the SOC team's workloads." Orit Shilvock, VP Sales at Perception Point "SentinelOne is committed to enabling choice and flexibility for our customers with Singularity Marketplace," said Ruby Sharma, Head of Technology Ecosystem, SentinelOne. "Partnering with Perception Point brings together leading detection and response capabilities to address threats across endpoint, email, cloud and collaboration attack surfaces." Perception Point's advanced threat protection solution is now available on the SentinelOne Singularity Marketplace. About Perception Point Perception Point is a Prevention-as-a-Service company for the fastest and most accurate next-generation detection and response to all attacks across email, cloud collaboration channels, and web browsers. The solution's natively integrated incident response service acts as a force multiplier to the SOC team, reducing management overhead, improving user experience and delivering continuous insights; providing proven best protection for all organizations. Deployed in minutes, with no change to the enterprise's infrastructure, the patented, cloud-native and easy-to-use service replaces cumbersome legacy systems to prevent phishing, BEC, spam, malware, Zero-days, ATO, and other advanced attacks well before they reach end-users. Fortune 500 enterprises and organizations across the globe are preventing content-borne attacks across their email and cloud collaboration channels with Perception Point. About SentinelOne SentinelOne is pioneering autonomous cybersecurity to prevent, detect, and respond to cyber attacks faster and with higher accuracy than ever before. Our Singularity XDR platform protects and empowers leading global enterprises with real-time visibility into attack surfaces, cross-platform correlation, and AI-powered response. Achieve more capability with less complexity.

Read More

PLATFORM SECURITY

Deloitte Launches Zero Trust Access, a New Managed Security Service

Deloitte | July 12, 2022

To help organizations adopt zero trust more quickly and efficiently, Deloitte is launching a new managed service – Zero Trust Access— that offers a cloud-native approach to securing communications between users, on any device, and enterprise applications, wherever they may reside. The Zero Trust concept commits to removing implicit trust within an information technology (IT) ecosystem and replacing it with a risk-based approach to accessing organizational resources across identities, workloads, data, networks and devices. This trend is gaining momentum, given legacy approaches to security architecture are no longer suitable to secure the ubiquitous nature of the modern enterprise. Part of the newly expanded Zero Trust by Deloitte, Zero Trust Access facilitates zero trust adoption and the evolving needs of organizations in protecting their applications, infrastructure, and data. Following the integration of recently acquired talent and technology into existing Deloitte services, the Zero Trust Access managed service connects users to applications through a frictionless cloud-native solution that is inherently scalable, resilient, agile, and secure. Further, the managed service is available standalone, integrated with other Deloitte offerings, or as part of a broader solution leveraging technologies from Deloitte's alliances ecosystem. "As perimeter-based approaches are no longer suitable to secure the modern enterprise, many organizations are working to enhance protection for their IT ecosystems via zero trust. "Zero Trust Access was built as a turnkey managed service helping ourselves and our clients accelerate adoption of this transformative security framework. Our goal was to create a cost-effective solution that can be delivered standalone or complementary to a broader ecosystem and ultimately help decrease the burden on IT and security teams who likely need to manage multiple heterogenous solutions to achieve similar outcomes." Andrew Rafla, Deloitte Risk & Financial Advisory's zero trust offering leader and principal, Deloitte & Touche LLP With innovative data protection leveraging device-level secure microcontainer technology, Zero Trust Access helps protect infrastructure while also enabling organizations to protect sensitive enterprise data and enforce least privilege through dynamic access control to enterprise assets. The managed service can replace remote access solutions inclusive of virtual private network (VPN), virtual desktop infrastructure (VDI), and desktop as a service (DaaS), all of which typically require significant capital expenditure for infrastructure, high operating costs, and technology management overhead. Zero Trust Access includes features such as ephemeral connectivity built upon secure peer-to-peer (P2P) communication, conditional access and continuous authorization, as well as robust data protection for data at-rest, in-use, and in-transit are consistently applied to each session, regardless of the type or location of the applications being accessed (e.g., legacy hosted applications, software as a service (SaaS), thick-client, web-based applications). Implementation of Zero Trust Access can help organizations leverage outcome-based solutions that improve business agility, enhance user productivity, and reduce cost and complexity of security operations. "Beginning zero trust adoption isn't simple, fast or easy for most organizations," Deborah Golden, Deloitte Risk & Financial Advisory Cyber and Strategic Risk leader and principal, Deloitte & Touche LLP. "We're launching Zero Trust Access as the first in many adoption-enabling services and solutions to come, so that our clients are better able to modernize their security programs, enable agile operations and confidently advance with emerging technologies and transformative risk management principles that can build more resilient security practices." About Deloitte Deloitte provides industry-leading audit, consulting, tax and advisory services to many of the world's most admired brands, including nearly 90% of the Fortune 500® and more than 7,000 private companies. Our people come together for the greater good and work across the industry sectors that drive and shape today's marketplace — delivering measurable and lasting results that help reinforce public trust in our capital markets, inspire clients to see challenges as opportunities to transform and thrive, and help lead the way toward a stronger economy and a healthier society. Deloitte is proud to be part of the largest global professional services network serving our clients in the markets that are most important to them.

Read More

DATA SECURITY

Veza, the Data Security Platform Built on the Power of Authorization, Announces Partnership with Google Cloud

Veza | July 20, 2022

Veza, the data security platform built on the power of authorization, announces today that the company has entered a partnership with Google Cloud, including product integration that enables Google Cloud customers to harness the capabilities of Veza’s data security platform across their multi-cloud ecosystem. Veza, which recently launched in April 2022 after two years of building in stealth, makes it easy to understand, manage, and control who can and should take what action on what data. With this new integration, Google Cloud customers can now directly access the capabilities of Veza’s authorization-based data security platform integrated with Google Cloud Policy Analyzer to identify, manage, and control external identities and service accounts to Google Cloud services (Looker, BigQuery, and more). This partnership furthers the relationship between Google and Veza, which began in 2021 when GV led the Series B investment in Veza and GV Partner Karim Faris joined Veza Board of Directors. “The cloud is quickly becoming the primary footprint for organizations. By prioritizing and investing in security, Google Cloud has earned a differentiated position in the market,” said Tarun Thakur, Co-founder and CEO, Veza. “The initial product integration between Veza and Google Cloud, publicly demonstrated at the Google Cloud Security Summit in May this year, is a powerful example of how intelligence from Veza’s Authorization Graph can bolster the data security of Google Cloud customers. It shows how identity-to-data relationship insights from the Veza platform can be pulled directly into the Google Cloud Policy Analyzer, allowing customers to secure both Google Cloud data (Looker, BigQuery, Google Storage Buckets, etc.) to which multi-cloud identities (AD, Azure AD, Okta, etc.) have permissions and multi-cloud data (AWS, Snowflake, etc.) that is being accessed by Google Cloud identities.” “Securing cloud environments and data from cybercrime and threats is a key priority of organizations across the globe. “With Veza’s platform now available alongside Google Cloud’s secure and global infrastructure, customers will be able to quickly deploy the solutions they need to better understand, control, and securely take action on their data across their multi-cloud environments.” Sunil Potti, General Manager and Vice President, Cloud Security, Google Cloud Veza’s data security platform aggregates identity information from humans, service accounts, and cloud IAM entities, and authorization data from apps and data systems, giving organizations a centralized, SaaS-based control plane to visualize, manage, and control data access controls through Veza’s Authorization Graph. Veza integrates with cloud identity providers, SaaS and custom apps, and data systems, and translates system-specific entitlements and permissions into a common, human-understandable business language, visualized in the platform as effective permissions. The platform brings a novel approach to data security by enabling organizations to address key data security use cases across access reviews and certifications for SaaS apps and data systems, privileged access management to data and apps, data lake security and governance, management of cloud entitlements, and much more. It delivers prioritized insights, provides access workflows, and actionable recommendations for remediation of over-privileged accounts, enabling security and IT teams to correct anomalies and right-size their organization’s permissions to protect against ransomware and other data breaches. As organizations continue to adapt to the evolving demands of hybrid remote and in-office work, multi-cloud and hybrid-cloud environments — those with multiple providers of disparate data, app, compute, and infrastructure systems — are becoming the norm. According to the Flexera 2022 State of the Cloud Report, 89% of companies surveyed are multi-cloud, with only 2% operating in single private clouds and 9% in single public clouds. This trend is leading to a distributed web of data, relationships, and access points that are changing and difficult to track and secure. Veza and Google Cloud already have a number of joint customers deployed across the industries of SaaS software, marketing technology, and media, including Vox Media. “To support Vox Media’s growth and increasing M&A activity without compromising security, we need to ensure that across all of our brands, the right users have access only to the data they need access to, and that we have full visibility over what they can do with that data,” says Ateeb Ahmad, Senior Director, IT Infrastructure, Vox Media. With Veza and Google Cloud working together, we’ve been able to seamlessly manage access controls over our data for our largest merger to date, and tightly scope identity-to-data permissions even as our footprint with Google Cloud and other technologies grows.” “The greatest gifts of the multi-cloud and the generational architectural shift of the modern data systems are also its greatest risks: securing data, scalability, flexibility, and seamless collaboration,” says Thakur. “When organizations enable workers to reach from one cloud to another to leverage data across their entire multi-cloud ecosystem, they foster growth, enable more intelligence, and promote agility. However, such apps and data systems are also more porous and are at increased risk of cybercrime and ransomware. We purpose-built Veza’s Core Authorization Platform for the multi-cloud so that organizations can implement strong access governance policies - Veza continuously evaluates these policies and enables both automated workflows for access reviews, automated access removal for toxic and stale combinations, and facilitates access grant and request for any app, data, and service.” About Veza Veza is the data security platform built on the power of authorization. Our platform is purpose-built for hybrid multi-cloud environments to help you use and share your data safely. Veza makes it easy to understand, manage, and control who can and should take what action on what data. We organize authorization metadata across identity providers, data systems, cloud service providers, and SaaS applications — all to address the toughest data security challenges of the modern era. Founded in 2020, the company is funded by top-tier investors including Accel, Bain Capital, Ballistic Ventures, Blackstone, GV, Norwest Venture Partners, and True Ventures

Read More