Home > News > Top Stories > Mendix and Software Improvement Group Introduced a New Cybersecurity Solution

Data Security, Platform Security, Software Security

Mendix and Software Improvement Group Introduced a New Cybersecurity Solution

Mendix, a Siemens business and world leader in modern enterprise app development, and Software Improvement Group (SIG), a unique technology and advisory firm for software quality, security, and improvement, have announced the launch of Mendix Quality & Security Management (QSM), a new cybersecurity solution that provides continuous deep-dive insights into security and code quality to address risks and vulnerabilities immediately.

Sigrid®, SIG's software assurance guidance platform, powers Mendix QSM. It delivers a complete perspective on the effect of security findings on business goals by combining more than 20 top-tier security scanning technologies. With Mendix QSM, the users can scan their Mendix apps, including third-party libraries, for security flaws and incorrectly configured security models, rank for compliance with major industry standards such as OWASP, ISO 5055, and PCI, and receive risk mitigation recommendations and clear guidance.

Mendix QSM is based on application model static analysis. SIG experts have mapped Mendix models to the ISO 25010 maintainability model using Mendix model metadata. This enables its applications to be compared against a database of thousands of projects, including open-source initiatives. Mendix QSM also presents a five-star rating of the quality of the software.

About Mendix

Mendix is an industry-leading low-code application development platform for enterprises. With Mendix, you can transform a spreadsheet into an app, establish a portfolio of enterprise-wide apps, and upgrade a core system, among other things. In addition, the platform provides continuous collaboration between software developers and users, speeds up the application development lifecycle, and enables iterative deployment at scale. As a result, businesses can rapidly develop modern, adaptable applications with a tool that maintains the highest levels of security, quality, and governance. The platform has been used by over 4,000 of the world's leading enterprises. Mendix is a division of Siemens.

About Software Improvement Group (SIG)

Software Improvement Group (SIG) assists companies in gaining confidence in the technology they trust. Its mission is to get the software right for a healthier digital world by combining intelligent technology with human expertise. It drills into the build quality of enterprise software and architecture by monitoring, measuring, and benchmarking it against the world's largest software analysis database. As a result, organizations can use software assurance to uncover the variables driving the total cost of ownership of the software and make fact-based decisions to lower costs, reduce risk, improve time to market, and accelerate digital transformation.

Spotlight

11 Ways to Streamline SEC Cybersecurity Compliance

Cyber attacks are increasing in volume, sophistication, and severity, and the federal government has taken notice. Now, they’re taking action — most recently in the form of new cybersecurity rules from the Securities and Exchange Commission. In “11 Ways to Streamline SEC Cybersecurity Compliance with Risk Cloud,” we explore a va

More featured news

Spotlight

11 Ways to Streamline SEC Cybersecurity Compliance

Related News

Software Security

SAIC Announces New Zero Trust Edge Capability

Business Wire | November 03, 2023

Science Applications International Corp. (NYSE: SAIC) today announced new, purpose-built Zero Trust security capabilities, which provide a solution to answer the Zero Trust pillars addressing data, identity, devices, networks, applications and workloads. The new Zero Trust security capabilities have been tested and validated on an AWS Snowball Edge and AWS Snow Family device with on-board storage and compute power for select Amazon Web Services (AWS) capabilities. AWS Snowball Edge can support local processing and edge-computing workloads in addition to transferring data between a user’s local environment and AWS. SAIC has brought together the best-in-class tools to deliver a mission-ready Zero Trust Edge capabilities that provides multi-level secure data processing and analytics and prioritizes data in a DDIL environment to transport back to the cloud, said Lauren Knausenberger, chief innovation officer at SAIC. This provides warfighters with a critical capability to extend their enterprise OCONUS, with the ability to run disconnected ops and rapidly adopt technologies and capabilities needed for mission success. This capability has the potential to be a critical enabler for Combined Joint All-Domain Command and Control (JADC2), with the ability to deploy at forward operating bases, on air platforms and at sea. Through the combined efforts of AWS; SAIC; Koverse, an SAIC company; Okta; CrowdStrike; Zscaler and Splunk, ready-to-install cybersecurity and Zero Trust technologies combine data and provide multi-level security from the edge through the enterprise. This capability meets the challenges of Wide Area Network (WAN) or no WAN connectivity by enabling offline compute capabilities and replicates mission-critical data after connectivity is restored. These components of software and hardware allow the capabilities to address the five pillars of the Zero Trust Maturity Model and therefore help increase cybersecurity posture at the edge. SAIC is an industry leader in cloud and cybersecurity, addressing Zero Trust security capabilities, including the latest capabilities which have been validated and tested on an AWS Snowball Edge device.

Network Threat Detection

Fortinet Expands Its Global SASE Points-of-Presence with Google Cloud

GlobeNewswire | October 18, 2023

Fortinet (NASDAQ: FTNT), the global cybersecurity leader driving the convergence of networking and security, today announced the expansion of its SASE Points-of-Presence (POPs) to new locations through a partnership with Google Cloud. The partnership allows Fortinet to leverage Google Cloud’s global network edge locations closest to their regions of presence, which deliver dedicated interconnect and 99.99% service availability, to accelerate the expansion of Fortinet’s Universal SASE solution. Single-vendor SASE is a critical architecture organizations adopt to connect their hybrid workforces securely. A robust network of SASE POPs that are scalable and globally available is crucial to delivering a superior user experience while enabling a strong security posture. By leveraging Google Cloud, Fortinet Universal SASE is even better positioned to serve a more extensive global footprint, ensuring that customers can seamlessly connect and secure their hybrid workforces to critical applications, said Michael Xie, Founder, President, and Chief Technology Officer of Fortinet. This partnership will expand our global POP resources and accelerate customer adoption of Fortinet’s Universal SASE solution. And because our SD-WAN solution is natively integrated with our SASE offering, Fortinet’s global SD-WAN customers now have an even broader ability to easily adopt integrated cloud-delivered security to implement a comprehensive Universal SASE solution. “Organizations worldwide rely on the Google Cloud for critical networking and access,” said Muninder Sambi, Vice President and GM of Networking at Google Cloud. “Our expanded partnership with Fortinet can enable high uptime for customers looking to support their hybrid workforces with Fortinet’s SASE solution, along with the advantages of using Google Cloud’s Cross-Cloud Network, which include lower costs and improved application experiences.” Converging Networking and Security with Fortinet Universal SASE Fortinet’s Universal SASE solution uniquely converges networking and security to support today’s hybrid workforce, expanding network edges and new microbranches to enable secure access to applications while providing high ROI through consolidation and improved digital user experience. Fortinet’s solution includes an extended portfolio of critical technologies and services that enable organizations to adopt a zero-trust security posture by effectively applying and monitoring context-based policies regardless of the resource a user is accessing. Fortinet Universal SASE offers a high-performance and scalable cloud network with best-in-class AI-powered security, unified management, and end-to-end digital experience monitoring to ensure secure access to web, corporate, and SaaS applications. Fortinet is the pioneer and leader of secure SD-WAN, the foundation of its Universal SASE solution. Universal SASE uses the same FortiOS operating system and AI-powered security services as its secure SD-WAN and cloud-delivered security service edge (SSE) solutions. This unique integrated approach extends secure web gateway (SWG), zero-trust network access (ZTNA), cloud access security broker (CASB), and Firewall-as-a-Service (FWaaS) solutions to its Universal SASE solution, enabling seamless connectivity, consistent end-to-end threat protection, and optimal user experience.

Platform Security

OpenText Cybersecurity Nastiest Malware of 2023 Shows Ransomware-as-a-Service Now Primary Business Model

PR Newswire | October 26, 2023

OpenText (NASDAQ: OTEX), (TSX: OTEX), today announced the Nastiest Malware of 2023, an annual ranking of the year's biggest malware threats. For six consecutive years OpenText Cybersecurity threat intelligence experts have analyzed the threat landscape to determine the most notorious malware trends. Ransomware has been rapidly ascending the ranks, with ransomware-as-a-service (RaaS) now the weapon of choice for cybercriminals. This year four new ransomware gangs, believed to be the next generation of previous big players, topped the list. Newcomer Cl0p takes the prize for this year's nastiest malware after commanding exorbitant ransom demands with its MOVEit campaign. Cl0p's efforts helped skyrocket the average ransom payment which is rapidly approaching three quarters of a million dollars. Black Cat, Akira, Royal, Black Basta also made their debut, joined by the always present, Lockbit. A key finding this year is the RaaS business model is another win for the bad guys. Profit sharing and risk mitigation are top contributors to RaaS success along with the ability to easily evade authorities, said Muhi Majzoub, EVP and Chief Product Officer, OpenText. There is a silver lining as research shows only 29% of businesses pay ransom, an all-time low. These numbers indicate people are taking threats seriously and investing in security to be in a position where they do not need to pay ransom. This year's list highlights the tenacity of cybercriminals as they continue to reinvent themselves, coming back stronger each time (often with new names). Their scrappy mentality allows them to go beyond the norm to find new ways to invade their target. 2023 Nastiest Malware Cl0p, a RaaS platform, became famous following a series of cyberattacks, exploited a zero-day vulnerability in the MOVEit Transfer file software developed by Progress Software. MOVEit victims include such notable organizations as Shell, BBC, and the United States Department of Energy. Black Cat, recognized in our 2021 Nastiest Malware report, believed to be the successor to REvil ransomware group, has built their RaaS platform on the Rust programming language. They made headlines for taking down MGM Casino Resorts. Akira, presumed to be a descendant of Conti, primarily targets small to medium sized businesses due to the ease and turnaround time. Most notably, Akira ransomware targeted Cisco VPN products as an attack vector to breach corporate networks, steal, and eventually encrypt data. Royal, suspected heir to Ryuk, uses Whitehat penetration testing tools to move laterally in an environment to gain control of the entire network. Helping aid in deception is their unique partial encryption approach that allows the threat actor to choose a specific percentage of data in a file to encrypt. Lockbit 3.0, a main stain on the list and last year's winner, continues to wreak havoc. Now in its third epoch, Lockbit 3.0 is more modular and evasive than its predecessors. Black Basta is one of the most active RaaS threat actors and is also considered to be yet another descendant of the Conti ransomware group. They have gained a reputation for targeting all types of industries indiscriminately. To learn more about the findings of this year's Nastiest Malware analysis, visit the OpenText Cybersecurity Community, as well as tune in to our Nastiest Malware Webinar.