DATA SECURITY

CyberMDX Joins the Microsoft Intelligent Security Association

CyberMDX | April 21, 2021

CyberMDX, a leading healthcare cybersecurity provider that provides visibility and threat prevention for medical devices and clinical networks, announced today that it has joined the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors and managed security service providers that have integrated their security solutions with Microsoft to better defend against a wide range of threats. CyberMDX's leading Healthcare Security Suite has been integrated with Microsoft Defender for Endpoint to provide robust visibility and incident management for medical devices and IoT.

The integration combines CyberMDX's unmanaged network visibility and identification capability with Microsoft Defender for Endpoints' single pane of glass view of the managed network to provide healthcare organizations with unrivaled cross-platform device visibility, classification, and incident response capabilities. The built-in automation allows security teams to go from warning to remediation in minutes and at scale.

Customers will benefit from CyberMDX's ability to automatically identify and label unmanaged clinical assets, such as medical equipment and IoMT, to establish an accurate inventory of all connected devices within the network, in addition to the visibility benefits and identification capabilities.

About CyberMDX

CyberMDX is a medical cybersecurity pioneer and the firm behind the leading IoMT visibility and security solution. CyberMDX identifies, categorizes, and defends wired medical equipment, preserving resiliency, patient protection, and data privacy. Risks are quickly mitigated and assets streamlined with CyberMDX's continuous endpoint discovery and mapping, comprehensive risk management, AI-powered containment & reaction, and operational analytics.CyberMDX is a medical cybersecurity pioneer and the firm behind the leading IoMT visibility and security solution. CyberMDX identifies, categorizes, and defends wired medical equipment, preserving resiliency, patient protection, and data privacy. Risks are quickly mitigated and assets streamlined with CyberMDX's continuous endpoint discovery and mapping, comprehensive risk management, AI-powered containment & reaction, and operational analytics.

Spotlight

"Recent data breaches have seen cybercriminals siphon off millions of records containing personally identifiable information and credit as well as debit card data, which is taking a major toll on company profits and customer loyalty. To identify the gaps in IT security that allow hackers to steal so much data, a joint UBM Tech and Certes Networks survey asked security experts how the protect their sensitive data, and specifically how they ploy segmentation technologies to shrink their attack surfaces and reduce the damage caused by a data breach.Segmentation is commonly understood as the practice of dividing or separating IT resources into their own logical or physical domains, often for the purpose of simplifying traffic management or providing security. The survey and this analysis paper focus primarily on segmentation of networks and enterprise applications that are shared on networks. 
In this report, we examine the role of segmentation in containing breaches and how it can be done more effectively. We explore the possible shortcomings of segmentation that is tied to network infrastructure. Finally, we discuss a ""software-defined"" approach to segmenting applications that decouples security enforcement from the underlying network or infrastructure and enables an enterprise to contain breaches and minimize damage should an attack occur. Download this research report to learn more.


Other News
DATA SECURITY

ControlCase Partners with ConnectWise & FifthWall Solutions to Increase MSP Cybersecurity Maturity & Bridge Access to Cyber Insurance.

ControlCase | July 11, 2022

ControlCase, a leading provider of IT Security Certifications and Continuous Compliance Services announced its recent partnership with ConnectWise and FifthWall Solutions. Under this partnership, Managed Service Providers (MSPs) can now access the ConnectWise MSP+ security best practices framework from the ControlCase Compliance HubTM platform for both self-assessment and verification by ControlCase. This partnership also provides the rate-quote-bind assistance required for procuring insurance. ConnectWise’s MSP+ framework is derived from the NIST CSF framework and aims to help MSPs strengthen their cybersecurity program, increase cybersecurity maturity, and ultimately lower their risk of a data breach. MSP+ provides an affordable compliance framework that can be used as the foundation for an MSPs cybersecurity program. The MSP+ program is split into 3 parts: 1. MSP+ Self Assessment – Allows the MSP to access the framework and start implementing controls and closing gaps at their own pace. 2. MSP+ Advanced – Includes assistance with remediation and final verification by ControlCase. 3. MSP+ Mastery – Demonstrates a mature cybersecurity program and is also verified by ControlCase. “This partnership is a gamechanger for MSPs,” said Mike Jenner, CEO at ControlCase. “Security incidents involving MSPs, and their clients continue to rise. This rise necessitates stringent security controls to be implemented and the MSP+ framework provides a great place for MSPs to start learning about cybersecurity and implementing necessary controls.” Speaking on the achievement, Raffael Marty, General Manager -Cybersecurity at ConnectWise said “Cyber insurance is a critical element to help partners protect their legacy by building a more cyber-resilient business. This partnership will help MSPs increase their cybersecurity maturity, prepare for and procure insurance; eliminating dozens of steps they and their customers would otherwise have to take.” The ControlCase Compliance HubTM platform is integrated with ConnectWise Manage. MSPs can complete their MSP+ assessments without ever leaving their PSA. The MSP+ Advanced and Mastery offerings also include real-time compliance status and vital statistics such as risk rating and security milestone planning. “FifthWall is excited to be the dedicated Cyber Insurance & Risk Management Solution Provider,” said Reid Wellock, President, FifthWall Solutions. “We work with 35+ insurers to limit clients’ cyber exposure and give peace of mind for businesses of any size.” This partnership greatly simplifies MSPs and their clients' access to insurance.” For more information on this partnership and the related offerings, please contact Kimberly Simon at ksimon@controlcase.com About ControlCase ControlCase is a global provider of certification, cybersecurity, and continuous compliance services. ControlCase is committed to empowering organizations to develop and deploy strategic information security and compliance programs that are simplified, cost-effective, and comprehensive in both on-premises and cloud environments. ControlCase offers certifications and a broad spectrum of cyber security services that meet the needs of companies required to certify to PCI DSS, HITRUST, SOC 2 Type II, ISO 27001, PCI PIN, PCI P2PE, PCI TSP, PA DSS, CSA STAR, HIPAA, GDPR, SWIFT, and FedRAMP. About FifthWall Solutions FifthWall works with 35+ carriers to limit your clients’ cyber exposure and give peace of mind for businesses of any size. With our policies, MSPs and their clients are covered from business interruptions, cyber crimes, and several of the consequences that follow. With breach prevention and response tools, MSPs and their clients avoid risk and minimize impact in the event of a security incident.

Read More

SOFTWARE SECURITY

BlackBerry Helps Channel Partners Tap Exploding Managed Security Service Market

BlackBerry | June 09, 2022

BlackBerry Limited today announced a number of enhancements to the BlackBerry Partner Program to help Managed Security Service Providers (MSSPs) capture the exploding demand among small and medium-sized businesses (SMBs) for 24x7x365 Managed Extended Detection and Response (XDR) services, a market which industry experts expect will grow from $22.45 billion in 2020 to $77.01 billion by 2030. BlackBerry's 2022 Threat Report found SMBs experience 11-13 attacks every day. Amidst this growing threat landscape, the company has significantly increased its MSSP focus, launching new marketing incentives, a global hiring campaign to boost partner support and a revamped curriculum of training, tools and enablement resources to aid overall go-to-market efforts. Enhancements include: Greater Cybersecurity Protection for Customers & More to Sell – New products and services now available to MSSPs include CylanceGUARD®, CylancePERSONA™, and CylanceGATEWAY™. This will enable new service opportunities and help MSSPs secure their client environments. Increased Support & Field Seller Alignment – Commitment to significantly increase the size of BlackBerry's channel team, doubling employee headcount in roles such as partner management, customer success and channel enablement to ensure partners have the technical and sales support to compete and win in the crowded EDR/XDR market. BlackBerry has also introduced seller compensation on MSSP deals to encourage field alignment and to embrace MSSPs as a critical route to market. More Comprehensive Training – New BlackBerry Cyber Security Administrator (BCSA) technical training – aimed at MSSPs who will be configuring, managing, and troubleshooting BlackBerry UES products. Representing the next-generation evolution of the popular Cylance Security Professional Certification, the new program includes a blend of videos, instructor-led training, and online assessments on BlackBerry's industry-leading, AI-based, prevention-first solutions focused on preventing breaches before they happen. Lucrative Marketing Incentives – Expanded the generous 'Protect and Earn' partner incentive program that rewards MSSPs for uncovering and closing net-new BlackBerry logos. Partners earn cash-based rewards which are determined by the qualifying closed deal's Total Contract Value, with no limits. New Pricing – New flexible licensing and pricing options built to match the way MSSPs do business with customers. New MSSP-focused aid in partner business development including demand generation & sales support via proposal-based marketing funds, case studies, strategic Go-To-Market engagement and access to inside sales resources. The expanded investment and support for MSSPs comes following last month's joint warning from the Five Eyes Alliance of security authorities from the United Kingdom, Australia, Canada, New Zealand and the United States, highlighting an increase in malicious cyber activity targeting managed service providers (MSPs) and urging them to protect the IT supply chain with a fresh set of cybersecurity measures. "With headline-grabbing hacks and a cybersecurity talent gap showing no signs of letting up, SMBs have never been more under-staffed or ill-prepared to meet the challenges posed by the continuously evolving threat landscape. "Our top 20 MSSPs have grown more than 50 per cent year over year and demand for human threat experts is through the roof. To that end, BlackBerry is doubling down and increasing our focus on our MSSP partners to ensure they're set up for success." Colleen McMillan, VP, Global Channel Sales at BlackBerry About BlackBerry BlackBerry provides intelligent security software and services to enterprises and governments around the world. The company secures more than 500M endpoints including over 195M vehicles. Based in Waterloo, Ontario, the company leverages AI and machine learning to deliver innovative solutions in the areas of cybersecurity, safety and data privacy solutions, and is a leader in the areas of endpoint management, endpoint security, encryption, and embedded systems. BlackBerry's vision is clear - to secure a connected future you can trust.

Read More

DATA SECURITY

DoControl Integrates with Box to Transform SaaS Data Access Security

DoControl | August 03, 2022

DoControl, the automated Software as a Service (SaaS) security company, today announced an expanded integration with Box, the leading Content Cloud, that adds a foundational layer of granular controls to protect sensitive data and provide comprehensive data access security. The solution further secures cross-application, business-critical data, and files accessed by every identity and entity, both internal employees and external collaborators, allowing for content collaboration to be achieved securely. Recent research found that nearly half of enterprise tech leaders find too much time is spent on manually provisioning and managing apps. In addition, it found other pain points around managing SaaS, including a lack of visibility, data exposure, and unmanageable access. DoControl No-Code SaaS Security Workflows Engine supports organizations in mitigating ongoing risk consistently, with the customization level required to effectively balance security with business enablement. "By partnering with Box, we will help customers confidently maintain business continuity and mitigate the risk of data breaches, overexposure, and exfiltration. "Security teams can effectively extend least privilege to the SaaS data layer and utilize a risk-based approach in securing their Box instances through the prioritization of identities that present higher levels of risk." Adam Gavish, CEO and Co-Founder of DoControl "Organizations today need products that are inherently secure to support employees working from anywhere," said Fred Klein, Vice President of Business and Corporate Development at Box. "At Box, we continuously strive to improve our integrations with third-party apps so that it's easier than ever for customers to use Box alongside best-in-class solutions. With today's integration with DoControl, we are taking that mission one step further to enable our joint customers to have more granular security controls over who has access to their business-critical content." Key joint solution capabilities include: Comprehensive asset management: Gain full awareness of every entity that is accessing corporate data within Box to identify what needs to be protected; Real-time monitoring and control: Monitor every user activity in real-time, with self-service tooling to detect and respond to immediate threats; Automated remediation: Establish data access control workflows that are future-proofed, consistently enforced, and allow for secure file sharing between all internal and external users. About DoControl Founded in 2020 and headquartered in New York, DoControl is an automated data access controls platform for SaaS applications, improving security and operational efficiency with ease for enterprises. DoControl is backed by investors Insight Partners, StageOne Ventures, Cardumen Capital, RTP Global and global cybersecurity leader CrowdStrike's early stage investment fund, the CrowdStrike Falcon Fund. The company's leadership team combines product, engineering and sales experience across cybersecurity, enterprise and SaaS innovators.

Read More

PLATFORM SECURITY

QuSecure Launches Industry’s First End-to-End Post-Quantum Cybersecurity Solution to Uniquely Address Current and Future Quantum Computing Threats

QuSecure | May 21, 2022

QuSecure™, Inc., an innovator in post-quantum cybersecurity (PQC), today introduced its quantum orchestration platform, QuProtect™, the industry’s first end-to-end PQC software-based solution uniquely designed to protect encrypted communications and data with quantum-resilience using quantum secure channels. With QuProtect, for the first time organizations can leverage quantum resilient technology to help prevent today’s cyberattacks, while future-proofing networks and preparing for post-quantum cyberthreats. Leading experts, including Arthur Herman, senior fellow and director of the Quantum Alliance Initiative at The Hudson Institute, believe that a Cryptographically Relevant Quantum Computer (CRQC), which is a quantum computer that can break current cryptography and will expose the world’s encrypted communications and data, will be available within the next 3-5 years. Additionally, nation-state attackers are currently stealing encrypted data, using a “Steal Now, Decrypt Later” (SNDL) strategy to collect global encrypted data, which will be retroactively decrypted once a CRQC is available. As a result, on May 4, the White House mandated PQC compliance via the National Security Memorandum “Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems.” Also, the bipartisan Endless Frontiers Act would establish a Technology and Innovation Directorate at the National Science Foundation which would use $100 billion in federal funds over five years to research emerging technologies including quantum computing, and specifically mentions the need for PQC. Organizations will need to follow suit to protect their data and communications from post-quantum cyberthreats. QuProtect provides quantum-resilient cryptography, anytime, anywhere and on any device. QuProtect uses an end-to-end quantum security as a service (QSaaS) architecture that addresses the digital ecosystem’s most vulnerable aspects, uniquely combining zero-trust, next-generation post-quantum-cryptography, quantum-strength keys, high availability, easy deployment, and active defense into a comprehensive and interoperable cybersecurity suite. The end-to-end approach is designed around the entire data lifecycle as data is stored, communicated, and used. “Quantum technologies have the potential to represent a platform shift, and platform shifts don’t come around that often,” said Laura Thomas, former CIA Chief of Base with more than 17 years in various national security and leadership roles and currently VP of Corporate Strategy at ColdQuanta, a quantum computing and sensing company. “When they do, they bring enormous opportunity coupled with the power for intense disruption, in all arenas, to include national security and economic security. Organizations should be evaluating post-quantum encryption solutions now and mapping out the resources and timelines needed to deploy them on their networks. QuSecure is playing a key role in future-proofing our networks from current classical and future quantum attacks.” QuSecure also today announced its formal company launch. See accompanying company launch press release issued by QuSecure today at QuSecure Company Launch. “Enterprises are charged with providing high levels of data security,” said Skip Sanzeri, QuSecure Founder and COO. “We are facing the largest computer upgrade cycle in history as all public key cryptography globally needs to be upgraded to PQC. Our QuProtect solution provides organizations with a first-mover advantage as the industry accelerates toward a quantum future. QuProtect allows organizations and their clients to maintain the highest level of quantum-resilient security to address cyberthreats with minimal disruption to existing systems.” QuProtect protects any node on the network by using National Institute of Standards and Technology (NIST) approved quantum algorithms to create secure quantum communications channels. Its technology enables backwards compatibility and can translate back and forth from PQC to standard Transport Layer Security (TLS), ensuring interoperability with any network. No other company combines QuSecure’s broad-based quantum and post-quantum technologies providing secure, interoperable cybersecurity to protect organizations’ networks from quantum threats. QuProtect’s unique differentiators include (partial list): Post-quantum open-source, end-to-end data protection on all platforms and networks – QuSecure applies post-quantum protections to all systems and devices – from cloud, to server, to laptop, to edge and IoT – protecting communications and data. QuProtect uses Quantum Random Number Generation (QRNG) to create quantum-resilient cryptographic keys which provide entropy throughout the entire network. Network-wide entropy is important because true quantum randomness protects systems from vulnerabilities and attacks such as pattern detection and cryptanalysis. Easy integration and deployment with zero client-side installations supporting most platforms – QuProtect is designed to be simple to deploy, operate and manage for existing devices and systems. Any existing platform that runs cryptography can be upgraded to PQC through QuProtect’s software-upgrade solutions. QuSecure’s solution enables controlled, phased deployment in highest priority segments first, enabling organizations to audit and/or delay endpoints which don’t need immediate upgrade. QuProtect permits instantaneous re-selection of algorithms enabling crypto agility while NIST finalizes the PQC algorithms to be standardized. Continuous monitoring and attack resilience – QuProtect improves security through continuous anomaly monitoring, machine learning-enabled attack detection, and active remediation. QuProtect is the industry’s most advanced PQC solution providing end-to-end quantum-resilience for many of today’s critical use cases, including satellite, network, and IoT communications. QuProtect can be hosted on-premise or via cloud-based orchestration delivering the most compatible solution to the post-quantum problem. An organization can implement PQC across all devices on the network with minimal disruption to existing systems, protecting against current and future classical and quantum attacks which could irreparably disrupt industries and infrastructures across government and commercial sectors. About QuSecure QuSecure is an innovator in post-quantum cybersecurity with a mission to protect enterprise and government data from quantum and classical cybersecurity threats. Its patent-pending, quantum-safe solutions provide an easy transition path to quantum resiliency across any organization. The company’s QuProtect solution is the industry’s first PQC software-based platform uniquely designed to protect encrypted communications and data with quantum-resilience using a quantum secure channel. QuSecure has current customer deployments in banking/finance, healthcare, space/satellite, IT/data enterprises, datacenters and various Department of Defense agencies. QuSecure is investor backed and has offices in Silicon Valley.

Read More

Spotlight

"Recent data breaches have seen cybercriminals siphon off millions of records containing personally identifiable information and credit as well as debit card data, which is taking a major toll on company profits and customer loyalty. To identify the gaps in IT security that allow hackers to steal so much data, a joint UBM Tech and Certes Networks survey asked security experts how the protect their sensitive data, and specifically how they ploy segmentation technologies to shrink their attack surfaces and reduce the damage caused by a data breach.Segmentation is commonly understood as the practice of dividing or separating IT resources into their own logical or physical domains, often for the purpose of simplifying traffic management or providing security. The survey and this analysis paper focus primarily on segmentation of networks and enterprise applications that are shared on networks. 
In this report, we examine the role of segmentation in containing breaches and how it can be done more effectively. We explore the possible shortcomings of segmentation that is tied to network infrastructure. Finally, we discuss a ""software-defined"" approach to segmenting applications that decouples security enforcement from the underlying network or infrastructure and enables an enterprise to contain breaches and minimize damage should an attack occur. Download this research report to learn more.

Resources