Platform Security, Software Security, API Security

Traceable AI Announces the Industry’s First API Security Reference Architecture for a Zero Trust World

Businesswire | June 06, 2023 | Read time : 05:00 min

Traceable AI Announces the Industry’s First API Security

Traceable AI, the industry's leading API security company, today announced the release of the industry's first API Security Reference Architecture for Zero Trust. This groundbreaking reference architecture serves as a guide for security leaders as the industry addresses the urgency of integrating API Security into Zero Trust Security initiatives.

Zero Trust, a cybersecurity framework that emphasizes continuous verification and helps to minimize the attack surface, has proven effective in enhancing security for many organizations, from large enterprises, to the US Government. However, traditional Zero Trust approaches have primarily focused on network-level controls and identity access management, neglecting the critical API layer.

Traceable’s API Security Reference Architecture is aligned with the NIST Zero Trust Architecture, a publicly available, vendor-neutral framework widely adopted by government entities such as CISA, DoD, DISA, NSA, GSA and NCCoE, as well as by many leading cybersecurity vendors. By leveraging the NIST framework, Traceable ensures compatibility, interoperability, and adherence to industry standards, making it a reliable and trusted guide for organizations implementing Zero Trust for their APIs.

The extensive reference architecture provides organizations with a prescriptive methodology to operationalize Zero Trust for APIs:

  • Advanced API Security: The reference architecture gives organizations a way to implement robust security measures specifically designed for APIs, including eliminating implied or persistent trust for APIs, thereby minimizing the risk of API-related vulnerabilities, attacks, and data breaches.
  • Comprehensive Risk Management: The reference architecture recommends incorporating automatic user authentication and authorization, granular data access policies, and asset risk assessments, can organizations can effectively manage and mitigate risks associated with API access and usage.
  • Increased Visibility and Control: The architecture explains why organizations should obtain granular visibility, which allows organizations to monitor and record all API transactions, enabling better analysis, threat detection, and incident response capabilities.
  • Improved Compliance and Data Protection: The automatic identification and classification of sensitive data sets ensure compliance with data protection regulations such as HIPAA, GDPR, and PCI-DSS, reducing the risk of regulatory penalties and reputational damage.
  • Seamless Automation and Orchestration: The reference architecture recommends integration with XDR, SIEM, and SOAR solutions, so organizations can enhance their overall security posture, automate response actions, and streamline security operations.
  • Scalability and Flexibility: The architecture offers a flexible distribution model for PEPs and data collection points, allowing organizations to scale their API security infrastructure based on their unique requirements and architecture.
  • Future-Proofing: By aligning with the NIST Zero Trust Architecture and industry standards, organizations adopting the API Security Reference Architecture can ensure compatibility, interoperability, and the ability to evolve alongside emerging technologies and security best practices.

Traceable’s API Security Reference Architecture for Zero Trust introduces a new approach to secure APIs using Zero Trust concepts, acknowledging their unique security requirements. It provides organizations with a comprehensive framework to implement Zero Trust controls specifically tailored to APIs, ensuring the protection of digital assets and mitigating the risk of data breaches.

Dr. Chase Cunningham weighs in on Traceable’s approach: "APIs provide a new means of applying controls across enterprise applications, " says Dr. Cunningham, “However, the security practices for APIs have not yet matured, leaving a significant gap in the overall attack surface. Traceable has developed their own API Security Reference Architecture to help fill this gap by providing organizations with a methodical way to secure their APIs with Zero Trust principles. By combining Zero Trust strategic concepts with API-specific security measures, Traceable can help organizations protect their digital assets effectively."

Throughout the past year, Traceable has continued to reaffirm its commitment to extending Zero Trust methodologies to API Security. With the addition of Zero Trust creator John Kindervag and Dr. Zero Trust, Chase Cunningham as Traceable advisors, Traceable continues to strengthen its expertise in this space. To date, Traceable has become a valuable partner to a number of large enterprises as the industry turns its eyes toward the importance of API security. With the rollout of their Zero Trust API Access solution alongside this reference architecture, Traceable continues to lead the industry toward the advancement of API security.

This reference architecture is now available for organizations to explore and implement, empowering them to achieve complete API security in a Zero Trust world.

About Traceable

Traceable is the industry’s leading API Security company that helps organizations achieve API protection in a cloud-first, API-driven world. With an API Data Lake at the core of the platform, Traceable is the only intelligent and context-aware solution that powers complete API security – security posture management, threat protection and threat management across the entire Software Development Lifecycle – enabling organizations to minimize risk and maximize the value that APIs bring to their customers. To learn more about how API security can help your business, book a demo with a security expert.

Spotlight

Threat actors are using social media to target enterprises and their customers with fraudulent accounts. The nature of instant sharing on social media means organizations can face swift reputation damage or financial loss if they fall victim to one of the many threat types used on these platforms. In order to effectively protect

Spotlight

Threat actors are using social media to target enterprises and their customers with fraudulent accounts. The nature of instant sharing on social media means organizations can face swift reputation damage or financial loss if they fall victim to one of the many threat types used on these platforms. In order to effectively protect

Related News

Enterprise Security

Netskope Partners with Wipro to Power New Managed Security and Network Services

PRnewswire | July 11, 2023

Netskope, a leader in Secure Access Service Edge (SASE) today announced a new partnership with Wipro Limited to deliver robust cloud-native Managed Secure Access Service Edge (SASE) and Managed Zero Trust Network Access (ZTNA) services to Wipro's extensive global enterprise client portfolio. "As the global work environment transforms, our Security Cloud platform continues to serve as a critical component for remote workforces, and we are well-positioned to continue to support enterprises as their security needs evolve," said Dave Rogers, SVP of Global Alliances and Channel Sales, Netskope. "By pairing Wipro's deep cybersecurity managed services expertise with Netskope's advanced, full-stack SASE platform, this partnership will build on our shared goal of providing customers an efficient and robust integrated managed cloud security offering to secure and accelerate their digital transformation projects." Wipro provides best-in-class, end-to-end transformative cybersecurity solutions. Wipro CyberTransform® delivers cyber resilience to clients through an integrated suite of business-aligned strategy-first cybersecurity advisory and implementation services. Wipro CyberShieldSM offers proactive, on-demand cyber defense and comprehensive managed security services. "Wipro and Netskope support many Fortune 2000 companies that have successfully navigated significant digital transformation journeys," said Tony Buffomante, Senior Vice President and Global Head of Cybersecurity and Risk Services, Wipro Limited. "As our clients move forward, they understand the need to have a strong cloud-based security posture that's smart enough to protect data, applications and users no matter where they are located. That's now possible through this new partnership with Netskope, which extends Wipro CyberTransform® and Wipro CyberShieldSM capabilities." Managed Secure Access Service Edge (SASE) powered by Netskope delivers security services to protect employees and applications in the cloud as well as existing on-premises applications and infrastructure. The solution helps users: • Eliminate blind spots across thousands of cloud services (SaaS and IaaS) and millions of websites • Secure managed cloud services like Microsoft 365, Google Workspace and AWS, as well as unmanaged cloud services, without the need for blocking • Guard sensitive data with award-winning data loss prevention (DLP), including pre-defined profiles for compliance • Stop elusive cloud threats with anti-malware, sandboxing, machine learning (ML) analysis, Cloud Threat Exchange for IOC sharing, plus behavior analytics or targeted remote browser isolation (RBI) The managed SASE package offers clients unparalleled service coverage, performance and resilience, by leveraging Wipro's strategy-first design and Netskope's NewEdge Network, the world's largest, highest-performing security private cloud. Access to key enterprise applications and data must be controlled no matter where the resources are located. Wipro's Managed Zero Trust Network Access (ZTNA) powered by Netskope allows users to retire legacy connections and gain direct access to applications based on user identity and behavioral context, providing: • Superior user experience with consistent and secure policy controls • Application-level access control that reduces threats by eliminating lateral movement within the network • Reduced deployment complexity and higher visibility and control, lowering the risk of data loss associated with multiple vendor solutions • Improved efficiency in security operations leveraging platforms • Simplified security and lower total cost of ownership About Netskope Netskope, a global SASE leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data. Fast and easy to use, the Netskope platform provides optimized access and real-time security for people, devices, and data anywhere they go. Netskope helps customers reduce risk, accelerate performance, and get unrivaled visibility into any cloud, web, and private application activity. Thousands of customers, including more than 25 of the Fortune 100, trust Netskope and its powerful NewEdge network to address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements.

Read More

Network Threat Detection, Platform Security, Software Security

Coro Acquires Network Security Startup Privatise

Businesswire | July 27, 2023

Coro, the modern cybersecurity platform for mid-market organizations, today announced the acquisition of Privatise, an Israeli supplier of network security solutions for in-office and remote work. The acquisition adds critical SASE capabilities to Coro’s all-in-one platform and is part of an aggressive growth strategy, fueled by Coro’s $155M funding over the last 12 months, to expand the capabilities of Coro’s cybersecurity platform both organically and through strategic acquisitions. As the network edge continues to expand, Gartner predicts that by 2025, 80% of enterprises will have adopted a strategy to unify web, cloud services and private application access using a SASE/SSE architecture.** The challenge for mid-market organizations – who have lean IT teams, limited budgets and little to no cybersecurity expertise --is managing the cost and complexity typically associated with SASE implementations. With the Privatise acquisition, Coro now offers a single source of comprehensive security and protection -- all managed through a unified, cloud-based platform -- for any organizational configuration. Coro’s SASE solution includes military grade VPN, Secure RDP, ZTNA, Next Generation Firewall, DNS Filtering, and is fully integrated into Coro’s holistic security architecture, eliminating security gaps caused by siloed approaches to SASE. Whether a company’s assets are cloud first, on-prem, or hybrid, Coro can protect the user, the device they use, the network they connect through, their emails, and the data they access, use and share, all while ensuring compliance with critical supply chain and industry regulations. “Since its founding, Coro has focused on delivering a comprehensive, yet affordable and easy to use cybersecurity solution for mid-market companies,” said Guy Moskowitz, CEO, Coro. “By integrating Privatise’s SASE capabilities into our platform, we offer the industry’s first mid-market solution to deliver cloud-native, seamless and secure access to applications and resources regardless of location or device. We will continue to invest in Coro’s platform, both organically and through acquisition, to help companies strengthen their security posture and improve their operational efficiency.” The Privatise acquisition is the latest milestone in Coro’s growth and momentum. In April, the company announced a $75M funding round from Energy Impact Partners, bringing the total funding raised in the last 12 months to $155M. Coro projects it will grow 300% year-over-year in 2023, extending its extraordinary 300% annual growth record to a 5th year in a row. The Company’s modern approach to cybersecurity – delivering enterprise grade security through a single platform that unifies, simplifies and automates workloads -- has been validated by more than 5000 mid-market customers across every vertical industry. Over the past year, Coro tripled its revenue, customer and employee base, and signed more than 100 new channel partners. About Coro Coro provides modern cybersecurity that unifies comprehensive protection into a single platform. Coro empowers organizations to defend against malware, ransomware, phishing, data leakage, insider threats and email threats across devices, users, and cloud applications. More than 5,000 businesses depend on Coro for protection, unrivaled ease of use, and unmatched affordability. Coro’s cybersecurity platform automatically detects and remediates the many security threats that today's distributed businesses face, without IT teams having to worry, investigate, or fix issues themselves. In addition to Energy Impact Partners, investors in Coro include Balderton Capital, JVP, and Ashton Kutcher’s Sound Ventures.

Read More

Web Security Tools

Laminar Launches Two New Solutions to Become First Full Data Security Platform for Multi-Cloud and SaaS Environments

Businesswire | July 13, 2023

Laminar, the leading agile data security platform provider, today announced new data access governance (DAG) and data detection and response (DDR) functions to its Laminar Data Security Platform, making it the first solution on the market to deliver complete identify, protect, detect, and respond capabilities for multi-cloud and SaaS data security. Laminar is now the only data security provider to integrate all critical data security functions – data landscape intelligence, data security posture management (DSPM), DAG, DDR, and privacy and compliance – in a single, integrated platform. Data security and governance professionals need agile data security solutions that automatically scale with the business to combat the growing divergence between the dynamic and ever-growing activities that contribute to innovation while also fighting the lagging data security efforts intended to protect the business — that are becoming increasingly insufficient. The foundation of agile data security begins with cloud-native data discovery and classification which detects all known and unknown, or “shadow,” data to help organizations understand what data resides where, how sensitive the data is, and who or what has access to it. With this context, security posture can be assessed and appropriately enforced. From there, it's critical to have the ability to continually monitor and protect against emerging threats. The addition of DAG and DDR to the Laminar Data Security Platform provides the following benefits to organizations: Data Access Governance (DAG) reduces exposure and minimizes the blast radius from data leaks by controlling user and machine access to sensitive data and ensuring least privilege. Data Detection and Response (DDR) alerts on data breaches and other anomalies as they occur to quickly contain any active threats and minimize the potential damage for businesses. The new DAG and DDR services complement the following capabilities already existing in the Laminar Data Security Platform: Data Landscape Intelligence: Provides a holistic view of asset and data inventory with contextual intelligence from autonomous discovery and classification of all known and unknown cloud data. Data Security Posture Management (DSPM): Enforces policies and safeguards sensitive data with risk-based prioritization, enabling organizations to focus on what matters most. Privacy & Compliance: Ensures data security practices align with regulations and standards to streamline audits, avoid fines and reduce audit costs. Laminar is the only data security provider to now integrate all five elements of an agile platform architecture for a complete data security solution. This integrated design provides more accurate detection, comprehensively protects data, and streamlines remediation. “Security-in-depth best practices have historically needed the ability to identify, protect, detect, and respond to threats. Cloud data security is no different,” said Amit Shaked, CEO and co-founder, Laminar. “Our new DAG and DDR features make our platform the reference model for achieving agile data security in the cloud. All five components work in conjunction to deliver a unified, streamlined experience.” “Protecting data in the cloud requires different tools than are used to protect on-premises data, and organizations need a purpose-built cloud data security solution. Enterprise Strategy Group recommends organizations explore solutions like Laminar that provide a holistic approach to the entire process of securing data in the cloud and provide unified and integrated data security across multiple clouds,” said Jack Poller, Senior Analyst, Enterprise Strategy Group. About Laminar Laminar is the leading agile data security platform and provides organizations with the visibility and control they need to achieve data security, governance, and privacy in the cloud. Our cloud-native data security solution continuously discovers and classifies all cloud data, structured and unstructured, across managed and self-hosted data stores, including unknown shadow data, without the data ever leaving your environment. It analyzes access, usage patterns, and security posture, and provides actionable, guided remediation for data security risk. Laminar connects to your multi-cloud environment including AWS, Azure, GCP, Snowflake, BigQuery and SaaS applications via APIs and is agentless, asynchronous, and completely autonomous.

Read More