SOFTWARE SECURITY

Foresite Cybersecurity Begins XDR & Compliance Platform

Foresite Cybersecurity | June 02, 2022

Foresite Cybersecurity
Foresite Cybersecurity, a leading cybersecurity and compliance provider, announced today that it is transitioning from technical services to a product-led Open XDR SaaS platform. The platform will provide a distinct edge for mid-market enterprises by allowing them to consolidate security data from several sources into a single spot to acquire a holistic view of their security and policy compliance maturity.

"Our strategy is to provide our customers with an open, extensible platform to enable them to understand their risk and compliance posture. The ProVision Open XDR platform will deliver on the single vision of our customers security posture, allowing not only discovery, response, and remediation, but also providing real-time risk and maturity scores."

Matt Gyde, Chairman and CEO of Foresite Cybersecurity

Mid-market organizations have battled for years to achieve adequate cybersecurity due to a lack of in-house experience or funding, with many not understanding where to start. The growing trend of remote employment has only made things more complicated.

Duane Shugars, Foresite Cybersecurity Chief Technology Officer said that "The market demanded an easier, more simplified model to be protected from cyberattacks and compliant to support business supply chain requirements. We are developing our Open XDR platform to easily absorb all log data, use advanced data science techniques, proprietary machine learning and natural language models, and supply chain illumination to simplify cybersecurity, maturity and compliance."

ProVision Open XDR is a cloud-native platform that will be available in Q3 2022 and will employ machine learning to enable insight across the whole IT ecosystem. In the case of an attack, the vendor-agnostic platform allows any cybersecurity technology in the customer's ecosystem, including firewalls, EDR, NDR, and many more, to monitor events, resulting in quicker remediation and reduced economic damage.

Spotlight

Maintain visibility and control with proven security solutions for public, private and hybrid clouds. IBM Security solutions provide layered protection and deep insight across public, private and hybrid cloud environments. They help organizations manage user identities, protect data and applications, and prevent sophisticated attacks with advanced analytics.


Other News
DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Abnormal Security Redefines Cloud Email Security with the Launch of Security Posture Management to Protect Against Email Platform Attacks

Abnormal | November 16, 2022

Abnormal Security, the leading behavioral AI-based security platform, announced today its newest addition to the product portfolio as the company progresses toward delivering the most comprehensive cloud email security in the market. The latest innovation protects customers from emerging email platform attacks that are increasing in volume and severity as attackers find new ways to target organizations. The open, interconnected nature of cloud email platforms creates new entry points for attackers to exploit and manipulate—increasing the need for security tools that protect organizations from attacks beyond those that are delivered through inbound email. While advanced inbound email attacks like business email compromise and credential phishing remain the primary cloud email attack vector, accounting for $43 billion in exposed losses since 2016, this addition to the Abnormal product portfolio expands the capabilities of cloud email security to protect against side-channel attacks that directly target the entire email platform. In recent headlines, cybercriminals have exploited unguarded entry and exit points to carry out sophisticated platform attacks, including: Compromising user and administrator accounts by bypassing MFA policies Exploiting global administrator privileges by setting up tenant-wide email forwarding rules that send company emails to attacker inboxes Tricking employees into installing malicious OAuth applications through consent phishing email links disguised as file-sharing links These examples showcase the need for security tools that can detect changes to the cloud email environment and provide full visibility into the current posture. But because security teams often share responsibility for these platforms alongside IT and messaging teams, it is operationally difficult and manual to understand the full scope of potential configurations across thousands of users, third-party applications and email tenants, and manage them accordingly. “As we’ve spoken to our customers, we’ve heard increasing concerns about this next generation of attacks. Since they have implemented Abnormal to secure the inbound channel against advanced attacks such as BEC, attackers are looking for new ways to access their inboxes and email platforms. “Implementing a solution that can alert security teams to new integrated applications, over-permissioned users, and other potentially risky events will be extremely helpful to security leaders, and Abnormal is excited to evolve our inbound email security platform to provide this capability and better protect our customers from the full spectrum of attacks.” Mike Britton, chief information security officer at Abnormal Security The new Security Posture Management product from Abnormal gives security teams immediate visibility to each of the potential entry and exit points to the cloud email platform. Increased visibility begins with three new Knowledge Bases, in addition to the existing VendorBase, which present comprehensive databases of employees, third-party applications, and email tenants. Each of the three new Knowledge Bases provides the foundational visibility security teams need to understand potentially exposed surface areas in Microsoft 365 and conduct security investigations. AppBase: Provides a running inventory of all of the third-party applications that have access to data within Microsoft 365. It provides a summary of important information about application permissions and data access, as well as an activity timeline of recent events. PeopleBase: Provides a directory of each active user in the environment. It uses contextual, behavioral data to build a dynamic user genome. PeopleBase also provides an activity timeline of recent events, including sign-on patterns, suspicious email activity, and more. TenantBase: Provides a catalog of each of the email tenants Abnormal Security protects and relevant permissions governing access to them. Taking the information derived from these Knowledge Bases, the new Security Posture Management product then monitors each entity for potentially risky configuration changes. Key changes may include the escalation of administrator privileges or the integration of new unverified applications with read-write access to mailboxes. When changes occur, Security Posture Management alerts administrators so they can understand the impact and take appropriate downstream action to protect their cloud email platform from insider threats or attacker infiltration. While the monitoring and alerting capabilities of Security Posture Management are available as an add-on purchase to Inbound Email Security, Abnormal is providing the foundational visibility of its new Knowledge Bases at no cost to all customers with Microsoft 365. New Product Continues to Drive Abnormal Growth in the Email Security Market The posture management offering underscores Abnormal’s commitment to providing its customers with the most effective email security platform on the market. In recent weeks, Abnormal was named to the CNBC Top 25 Startups for the Enterprise list of companies that are best suited to meet the needs of large enterprises, as well as the Madrona Intelligent Applications 40 list for the platform’s superior capabilities in using machine learning to extract useful information from real-time and historical data. These awards highlight the continued success of the company as Abnormal continues to experience more than 2x growth per year, with notable customers including Xerox, Urban Outfitters, Royal Caribbean International, and Groupon. The company maintains a 4.8-star review on Gartner Peer Insights, with 100% recommendation from participating companies. This continued growth is driven by the recent Series C funding round in which Abnormal raised $210 million with backing from Insight Partners, Greylock Partners, and Menlo Ventures. Security Posture Management is the second major product launch in the past six months, with Abnormal releasing the Email Productivity module in August 2022. The Email Productivity add-on uses behavioral AI to filter time-wasting promotional emails away from employee and executive inboxes, automatically personalizing protection to each user based on behavior cues like folder moves. By shielding employees and executives from the growing barrage of promotional emails, including vendor cold calls, newsletters, and marketing promotions, Email Productivity saves enterprises multiple hours per employee per month. Both new products are part of the Abnormal Cloud Email Security platform, which stops the full spectrum of email-borne attacks. About Abnormal Abnormal Security provides the leading behavioral AI-based security platform that leverages machine learning to stop sophisticated inbound email attacks and dangerous email platform attacks that evade traditional solutions. The anomaly detection engine leverages identity and context to analyze the risk of every cloud email event, preventing inbound email attacks, detecting compromised accounts, and remediating emails in milliseconds—all while providing visibility into configuration drifts across your environment. You can deploy Abnormal in minutes with an API integration for Microsoft 365 or Google Workspace and experience the full value of the platform instantly.

Read More

DATA SECURITY, ENTERPRISE SECURITY, SOFTWARE SECURITY

Titan Security Group Announces Acquisition of Prudential Security, Inc.

Titan Security | September 06, 2022

Titan Security Group, LLC , a leading provider of security solutions headquartered in Chicago, IL, announced today that it has completed the acquisition of the security staffing operation of Prudential Security, Inc. ("Prudential"), a security solutions provider based in Taylor, Michigan. Titan is a portfolio company of Quad C Management, Inc. "We are very excited to welcome the Prudential team to the Titan family. "Our organizations are very complementary, with shared values, culture, and focus on providing a high level of service to our clients and team members. Together, we are better positioned to be a leading regional provider of high-end security services." Dave Pack, CEO of Titan Titan's acquisition of Prudential adds over 700 team members to the Titan brand and expands their existing service area to 14 states including Illinois, Michigan, Wisconsin, Indiana, Alabama, Kansas, Mississippi, North Carolina, New York, Ohio, Pennsylvania, South Carolina, Tennessee, and Texas. "This is an exciting collaboration," said Pack. "Our acquisition strategy is to identify like-minded companies, such as Prudential. Applying our combined talent and resources will lead to new opportunities for our clients and team members." Terms of the acquisition were not disclosed. Security ProAdvisors LLC represented Prudential Security Inc. in the transaction. About Titan Security Titan Security is one of the largest security services firms in the U.S. providing security staffing, consulting, and systems integration of enterprise security solutions including video surveillance, electronic access control, turnstiles, biometrics, visitor management, alarm monitoring and other solutions throughout the Chicago metropolitan area, Northern Indiana and Southern Wisconsin. About Prudential Prudential Security is a recognized leader in the security industry, providing a full range of security solutions to its clients in a wide range of industries. Prudential has built its business with a strong foundation of customer service and responsiveness. Prudential's longtime management team responds attentively to client concerns and issues, developing relationships with all clients, and forming a longstanding base of business, allowing Prudential to grow into one of the most sought-after security providers in the country. About Quad-C Founded in 1989 and headquartered in Charlottesville, Virginia, Quad-C is a middle market private equity firm focused on investing in well-established business and consumer services, food & beverage and consumer products, healthcare, industrials, specialty distribution and transportation/logistics companies. In its three-decade history, Quad-C has invested over $4.0 billion of capital in 80 platform companies. The Quad-C team is committed to partnering with entrepreneurs and management teams to accelerate growth and create long-term value.

Read More

DATA SECURITY, SOFTWARE SECURITY, WEB SECURITY TOOLS

Legit Security Discovers and Helps Remediate Software Supply Chain Vulnerabilities in Google Firebase & Apache Open-Source Projects

Legit Security | September 16, 2022

Legit Security, a cyber security company with an enterprise platform to secure an organization’s software supply chain, today announced that it discovered software supply chain attack vulnerabilities in popular open-source projects from Google and Apache. The discovered vulnerability affects GitHub, an extremely popular Source Code Management (SCM) system at the heart of many organization’s software supply chains and used by software developers globally. The Legit Security research team found a new type of CI/CD vulnerability called “GitHub Environment Injection” that allows attackers to take control of the vulnerable project's GitHub Actions CI/CD pipeline. Any GitHub user could exploit this vulnerability to modify the project’s source code, steal secrets, move laterally and attack inside the organization, and ultimately initiate a SolarWinds-like supply chain attack. The vulnerability was found in the Google Firebase project and in a very popular integration framework project from Apache. Both Google and Apache acknowledged and fixed the vulnerabilities after an initial disclosure by Legit Security. Legit Security has published a technical disclosure blog on their website including guidance for organizations to remediate this vulnerability. Legit Security’s Research Team discovered that a specially crafted payload written to a GitHub environment variable called “GITHUB_ENV” could allow an attacker to execute code on the target pipeline and thereby modify the source code or compromise the repository itself. This attack can be initiated by any GitHub user and is very easy to implement just by creating a “pull request” or a proposed change to the source code. The mere act of submitting the pull request will trigger the vulnerable build action and carry out a successful compromise and the attacker does not need to be subjected a code review approval from the source code maintainer for it to take effect. The Legit Security team disclosed these issues to Google and Apache project maintainers, along with remediation guidelines, and verified that these vulnerabilities weren’t exploited by a malicious actor. Both projects have been fixed and are now safe. However, these are not the only projects susceptible to this kind of attack. Since using the GITHUB_ENV file is currently considered the “safe” way to change environment variables in GitHub Actions, many repositories are using workflows that write untrusted data into this file, leaving them exposed to supply chain attacks. “This type of vulnerability joins many other software supply chain vulnerabilities and attacks targeting popular open-source projects, including GitHub, which is the largest and the de facto host of most open-source projects. “We, as a security community, must build the tools and processes to address these threats and allow organizations to trust software and use it safely. Here at Legit Security our mission is to secure every organization’s software supply chain and we are active conducting security research and collaborating on initiatives to achieve this goal." Liav Caspi, CTO and co-founder of Legit Security According to Gartner®, nearly half of organizations worldwide will experience an attack on their software supply chains by 2025, a three-fold increase from 2021. There has been a huge rise in attempts to compromise open-source projects and CI/CD build services, including GitHub Actions, to enable wide ranging attacks through software supply chains. For in-depth analysis of the GitHub Environment Injection vulnerability, along with broader information and guidance on how to protect your organization from software supply chain attacks, please visit the Legit Security website and blog. About Legit Security Legit Security protects software supply chains from attack by automatically discovering and securing the pipelines, infrastructure, code and people so that businesses can stay safe while releasing software fast. Legit provides an easy to implement SaaS platform that supports both cloud and on-premises resources and combines automated discovery and analysis capabilities with hundreds of security policies developed by industry experts with real-world SDLC security experience. This integrated platform keeps your software factory secure and provides continuous assurance that your applications are released without vulnerabilities.

Read More

ENTERPRISE IDENTITY,PLATFORM SECURITY,SOFTWARE SECURITY

Bearer Launches Data-First Security Solution

Bearer | November 15, 2022

Bearer, the data-first security software company, today announced the general availability of the Bearer Data Security Platform. Based on extensive interviews with more than 130 enterprise CISOs at high-growth and global 2,000 companies, Bearer is in beta use across multiple industries with one customer protecting the private data of more than 75 million medical patients. “At Bearer, we strongly believe the best approach for a data-first security approach is to start at the beginning of the journey, following the shift-left security trend. “Data-first security should start in the code. And to be truly effective, it should never impede developers and never allow access to private data itself while still providing ownership context and protecting against vulnerabilities created in the business logic of an application or service.” said Guillaume Montard, CEO and co-founder of Bearer Why Bearer Data Security Platform Now Data security is becoming a top priority for businesses, with customers and governments demanding better data protection driven by the demands of GDPR, CCPA, PDPA and more. Bearer’s detection engine protects PD, PHI, PII and financial data. Cloud native organizations have more complex and fragmented architectures than ever before, making properly-implemented data security risk controls impossible without a proper solution. More than two-thirds of the enterprise 2,000 are focusing on cloud-native applications. DevSecOps is gaining huge traction. 57% of security teams have shifted security left already or are planning to this year, making them ready to use a solution such as Bearer. Bearer has been tested on more than 20,000 open source software projects as well as more than 6,000 data repositories at beta users, partners and early customers. The Bearer Data Security Platform Bearer is a SaaS platform that enables scalable deployments and workflow automation for security management. It discovers sensitive data flows automatically by continuously scanning source code and associated metadata. By monitoring data security risks proactively, it can automatically detect gaps within data security policies during coding and in production. Finally, it can remediate data security issues at a massive scale, giving developers immediate actionable advice on how to mitigate as well as prioritize an issue. Bearer accomplishes these results through three major innovations: Identification of data security risks – Including business logic flaws: Bearer pinpoints data security technical and business logic flaws in code before it’s too late and costly to correct. It then provides actionable context and ownership information to fix issues quickly – in minutes. Before Bearer, pinpointing business logic flaws could only be achieved manually – often left ignored. Frictionless deployment: Bearer is a data security SaaS solution that fits into the development cycles of Global 2000 enterprises without requiring any changes to how software engineering teams work. Additionally, Bearer does not require access to the underlying source code nor the sensitive data itself. Extreme automation: Designed by developers for developers in a world of constant code iterations, Bearer automates the burden of data security compliance for software engineers so they don’t have to become experts on data security regulations across different global markets. Security and compliance teams love how Bearer prioritizes the most critical issues in remediation workflow to allow for speedy resolution between security and development. About Bearer Bearer, the data-first security software company, pioneered a solution for developers to automatically detect sensitive data flow and data security risks while coding. Its policy engine proactively monitors data security policies before releasing code and its unique remediation workflow prioritizes the most critical issues – including business logic flaws – for quick resolution between security and engineering teams. Venture-backed with more than $8 million in seed financing, Bearer is used in markets where privacy protection and data security are business-critical, including eCommerce, financial services, and healthcare.

Read More

Spotlight

Maintain visibility and control with proven security solutions for public, private and hybrid clouds. IBM Security solutions provide layered protection and deep insight across public, private and hybrid cloud environments. They help organizations manage user identities, protect data and applications, and prevent sophisticated attacks with advanced analytics.

Resources