ENTERPRISE SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY
Wiz | December 15, 2022
Wiz, the leading cloud security platform that rapidly enables customers to find and remove critical cloud risks, today announced its newest project, The PEACH framework, a tenant isolation framework for cloud applications. This framework will enable industry-wide collaboration and provide cloud customers and cloud application developers with the necessary guidance to build cloud services securely and prevent critical risks in the implementation process.
"Over the past year and a half, Wiz researchers and other members of the cloud security community discovered several cross-tenant vulnerabilities in various multi-tenant cloud applications. "Although these issues have been reported extensively and were dealt with appropriately by the relevant vendors, we've seen little public discussion on how to mitigate such vulnerabilities across the entire industry. This is where we see an opportunity to strengthen the collaboration between members of the security community."
Wiz CEO Assaf Rappaport
Beyond offering a guideline for organizations, PEACH is a starting point for empowering security teams to work together to establish standard transparency and common language when it comes to mitigating cloud threats.
Serving as a step-by-step framework for modeling and improving SaaS and PaaS tenant isolation, PEACH manages the attack surface exposed by user interfaces and provides a clear standard for transparency on tenant isolation assurance. Wiz developed the following parameters based on lessons learned to address the rising cross-tenant vulnerabilities, lack of a standard for transparency, and missing common langue among vendors:
Privilege hardening – ensure tenants and hosts have minimal permissions in the service environment.
Encryption hardening – confirm the data belonging to each tenant is encrypted with a unique key, regardless of where the information is stored.
Authentication hardening – validate that communication between each tenant and the control plane use authentication with a validated key unique to each tenant.
Connectivity hardening – establish that all inter-host connectivity is blocked by default unless explicitly approved by the tenants involved.
Hygiene – verify that unnecessary secrets, software and logs scattered throughout the environment are purged to avoid leaving clues or enabling quick wins for malicious actors.
The second part of the security review process consists of remediation steps to manage the risk of cross-tenant vulnerabilities and improve isolation as necessary. These include reducing interface complexity, enhancing tenant separation, and increasing interface duplication -- all while accounting for operational context such as budget constraints, compliance requirements, and expected use-case characteristics of the service.
This framework was reviewed and collaborated on with cloud security industry experts from AWS, Google, IBM, Netflix and Cisco. Instead of commercializing PEACH though, Wiz will be offering the framework for free.
About Wiz
Wiz secures everything organizations build and run in the cloud. Founded in 2020, Wiz is the fastest-growing software company in the world, scaling from $1M to $100M ARR in 18 months. Wiz enables hundreds of organizations worldwide, including 30 percent of the Fortune 100, to rapidly identify and remove critical risks in cloud environments. Its customers include Salesforce, Slack, Mars, BMW, Avery Dennison, Priceline, Cushman & Wakefield, DocuSign, Plaid, and Agoda, among others. Wiz is backed by Sequoia, Index Ventures, Insight Partners, Salesforce, Blackstone, Advent, Greenoaks and Aglaé.
Read More
ENTERPRISE SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY
Nozomi Networks | January 25, 2023
On January 24, 2023, Nozomi Networks Inc., one of the leaders in OT and IoT security, announced Nozomi ArcTM, the industry's first IoT and OT endpoint security sensor, intended to accelerate time to full operational resilience exponentially. Nozomi Arc is designed to automatically deploy across a large number of locations and devices anywhere a company needs visibility, and it provides vital data and insights about essential assets and network endpoints. This data is utilized to better analyze and prevent attacks, as well as correlate user behavior, without straining existing resources or interrupting mission-critical networks.
Arc is a game-changer in terms of comprehensive asset visibility, deployment speed, and network coverage across complex and remote OT and IT networks. Nozomi Arc is designed to:
Be deployed remotely
Analyze endpoint vulnerabilities
Accelerate monitoring deployments in mission-critical systems; and
Identify compromised hosts
Nozomi Networks Co-founder and CPO, Andrea Carcano, said, "Operational resiliency is the top business priority for critical infrastructure organizations, which can only be achieved by lowering cyber risks and increasing security." He added, "Nozomi Arc accelerates time to resiliency by transforming every computer on the network into an OT security sensor. It quickly extends visibility to attack surfaces and threats inside endpoint hosts and their local networks. With Nozomi Arc, users can quickly corollate more information from more sources for better diagnostics and faster time to response."
(Source – GlobeNewswire)
With Nozomi Arc, users get the following advantages:
Faster time to resiliency: Nozomi Arc removes time, resource, geographic, and internal policy limits from network-based deployments.
Lower cyber risk and increased security: The only OT solution in the market that can identify malicious hardware.
Extended visibility and context: In addition to illuminating additional assets, devices, and possible vulnerabilities, Arc detects process irregularities and questionable user behavior.
Lower operational overhead: Because Arc can be remotely deployed through a software download, Nozomi Arc does not need extensive network adjustments to be implemented anywhere in the world, even in the most remote locations.
About Nozomi Networks
Nozomi Networks, with headquarters in San Francisco, California, accelerates digital transformation by defending the world's critical infrastructure, industrial enterprises, and government enterprises from cyber-attacks. Its technology provides OT and IoT environments with superior network and asset monitoring, threat detection, and analytics. As a result, customers rely on the company's solution to reduce risk and complexity while increasing operational resiliency. In addition, the organization provides zero-trust security by delivering contextual data for policy decisions, such as endpoint posture checks, baseline monitoring, and device role data.
Read More
DATA SECURITY,ENTERPRISE IDENTITY,PLATFORM SECURITY
Wipro | November 28, 2022
Wipro Limited, a leading technology services and consulting company, today announced that it is launching a strategic cybersecurity consulting offering in Europe. The announcement comes on the heels of a series of acquisitions in the consulting space—Edgile, Capco, and Ampion—and is part of the firm’s vision to build a global cybersecurity consulting offering to help clients stay ahead of a dynamic threat and regulatory environment.
“Escalation of cyber threats, compounded by the rapidly changing regulatory environment, is creating brand new challenges for businesses across Europe. "Our extensive experience in cybersecurity, global network of cybersecurists, combined with our expanded consulting capabilities, will help clients stay ahead of emerging threats and adapt to a changing regulatory environment with speed and agility. We are thrilled to be bringing this offering to clients in this market at this critical juncture.”
Tony Buffomante, Senior Vice President & Global Head of Cybersecurity and Risk Services (CRS) at Wipro Limited
The new consulting capability, offered through Wipro CRS Europe, will expand on Wipro’s existing cybersecurity services and enable clients to tap into Wipro’s full set of capabilities—from strategy and implementation to managed services.
Under this new offering, Wipro consultants located in Europe will work with clients to build tailored strategies and solutions that address the unique challenges in this market. Leveraging Wipro’s extensive global network of more than 9000 cybersecurists, Wipro CRS Europe will help clients realize enhanced scale and speed in implementations.
“Our recent acquisitions in the cybersecurity space, as well as our recent strategic hires in Europe, have created an opportunity for us to rethink how we serve our clients in this market,” said John Hermans, Head of Wipro CRS Europe. “This launch will bring together our entire set of cyber capabilities under a single umbrella, allowing us to deliver clients a truly end-to-end offering that leads with strategy but delivers on every single aspect of their cybersecurity needs.”
The new offering will bring all Wipro’s cyber consulting capabilities under one umbrella, CyberTransformSM, and deliver them to clients alongside the company’s managed services capabilities, CyberShieldSM.
CyberTransform is Wipro’s business-aligned strategy-first approach to cybersecurity transformation. It enables business growth through a business-led approach to solve security, risk, cloud, identity, and compliance challenges on a global scale. CyberTransform brings together Wipro’s suite of cybersecurity consulting capabilities and delivers clients a truly holistic, 360 approach designed to help them manage cyber threats and build resilient, future-proof businesses.
CyberShield is Wipro CRS’ industry-leading suite of managed services, which defends business operations through On-Demand cyber resilience management.
About Wipro Limited
Wipro Limited is a leading technology services and consulting company focused on building innovative solutions that address clients’ most complex digital transformation needs. Leveraging our holistic portfolio of capabilities in consulting, design, engineering, and operations, we help clients realize their boldest ambitions and build future-ready, sustainable businesses. With over 250,000 employees and business partners across 66 countries, we deliver on the promise of helping our customers, colleagues, and communities thrive in an ever-changing world.
Read More