NowSecure | July 06, 2022
NowSecure, the leading standards-based mobile app security and privacy software company, today announced a new GitHub Action for Dependency Graph integration to bring automated mobile app Software Bill of Materials (SBOM) generation to developer workflows directly inside GitHub. Now iOS and Android mobile app developers can gain visibility into the components, third-party libraries and frameworks they use and ensure their proper version, security and privacy as they build them — all to deliver high-quality, secure mobile app releases faster.
GitHub,the leading software development platform for more than 83 million developers, announced new extensions for dependency information in the GitHub Dependency Graph with new GitHub Actions. As a recognized leader in mobile app security, NowSecure has delivered the first automated dynamic mobile app SBOM solution integrated into GitHub Dependency Graph. The NowSecure GitHub Action for Mobile SBOM to populate the GitHub Dependency Graph is now available in early access via the GitHub Marketplace. In addition, the NowSecure Platform can now be purchased through Microsoft Azure Marketplace. As part of the early access program, all GitHub mobile developers can request a free scan for dynamic SBOM generation into GitHub Dependency Graph.
Underlying the urgency of managing software dependencies, software supply-chain attacks in 2021 grew by 650% with major incidents from SolarWinds, Microsoft, Kasaya, log4j and others. White House Cybersecurity Orders in 2021 identified critical risks in the global software supply chain and set out requirements for government agencies to establish standards and policies for securing the software supply chain.
"Developers want to deliver innovative, high-quality mobile applications fast," said NowSecure CEO Alan Snyder. "This means they need a developer-first, easy to use and accurate mobile security solution embedded directly in their dev workflows. While mobile developers depend on third-party code for innovative experiences, complex functionality and time to market, they must ensure the code they use is up to date and secure. We are excited to extend our partnership with GitHub and the community by adding dynamic SBOM generation into GitHub Dependency Graph to help developers protect their software supply chain."
NowSecure offers two GitHub Actions for automated mobile app analysis and mobile app SBOMs. The NowSecure GitHub Action provides automated static and dynamic security analysis of iOS and Android mobile apps built in any language or framework including Swift, Objective-C, Java, Kotlin, Dart, React-Native and more. The NowSecure GitHub Action for Mobile SBOMs generates component detail for visibility into the libraries/frameworks included in all mobile apps, identifying transitive dependencies, pinpointing libraries/frameworks that are using older versions, identifying components that remain but may have previously specified to be removed, and uncovering component license details.
"The NowSecure GitHub Action for Mobile SBOM populates the GitHub Dependency Graph with mobile data so that in the future GitHub Dependabot alerts can update dependencies to the latest and more secure versions of libraries in mobile apps. "Furthermore, comparing SBOMs and dependencies from different versions of a mobile app provides insight into changes made by the developer over time that may require further analysis or help identify technical debt. Overall, we've been very impressed with GitHub's implementation, enabling third-parties to extend the Dependency Graph and Dependabot to support new ecosystems like mobile."
NowSecure CTO David Weinstein
"The software supply chain starts with the developer. Extending automated visibility into your SBOM means developers can significantly reduce their usage of vulnerable software dependencies as well as be confident in shipping new mobile features and products with security built in by design," said Jose Palafox, Director of Business Partnerships at GitHub.
The NowSecure GitHub Action for Mobile SBOM early access program for GitHub Dependabot Graph is part of the world's most comprehensive suite for mobile app security including NowSecure Platform for continuous security testing in the development pipeline for DevSecOps, NowSecure Workstation kit for pen tester productivity, NowSecure Supply Chain Risk Management, NowSecure Pen Testing Services, and NowSecure Academy training courseware for dev and security teams. Built on a foundation of standards and automation, NowSecure empowers organizations to deliver secure mobile apps faster and continuously monitor their mobile app supply chains for risk. Top mobile innovators, global businesses and agencies trust NowSecure to secure their mobile apps including AT&T, Caribou Coffee, Chime, iRobot and Uber.
As the standards-based mobile app security and privacy company, NowSecure protects the Mobile App Economy. The world's most demanding organizations, innovative mobile developers and advanced security teams entrust NowSecure to safeguard millions of mobile app users across banking, insurance, high tech, IoT, retail, hospitality, energy and government sectors. Only NowSecure delivers the full solution suite of continuous security testing for DevSecOps, mobile app supply-chain monitoring, expert mobile pen testing and training courseware with the depth, speed, accuracy, and efficiency to meet modern business demands. Dedicated to the open-source community and standards including OWASP, ioXt and NIAP, NowSecure is SOC 2 certified and recognized by IDC, Gartner, Deloitte Fast 500, and TAG Cyber.
UL | June 07, 2022
UL, a global safety science leader, today announced the latest enhancements to its product security and compliance life cycle management platform, SafeCyber. Launched last year, SafeCyber aims to democratize product security and empower device manufacturers, suppliers and system integrators to take charge of their connected ecosystems and mitigate growing threats from chip to cloud.
Amid an uptick in supply chain attacks, a shortage of security expertise and a dynamic regulatory environment, UL's new SafeCyber dashboard provides users with a comprehensive view of their product security maturity and projects in one place. SafeCyber also provides an easy-to-use portal to help users discover available device life cycle solutions to better manage and secure their ecosystems.
Through this new dashboard, users can view all their product security testing and evaluation activities in a single, central location. The new feature provides visibility on the security maturity of their product lines and certification readiness to industry standards, including ISA/SAE 21434 and IEC 62443 4-1, among others.
Additionally, UL formally announced Binary Check™, a new SafeCyber platform solution. Binary Check allows users to perform continuous, automated binary code analysis to ensure ongoing security and compliance readiness of connected devices and systems. This new solution includes the ability to generate a software bill of materials (SBOM), detect and manage vulnerabilities for faster remediation and obtain compliance readiness analysis.
"The skyrocketing adoption of connected devices creates countless benefits and opportunities but also leads to an increasingly large and attractive attack vector for bad actors. "As devices become progressively connected, it's challenging for businesses to keep up with growing device and security system complexities, making them vulnerable to ransomware and firmware attacks. Hardening security requires a proactive approach. At UL, we are committed to enabling organizations to innovate and bring products to the marketplace safely and securely. With SafeCyber, customers benefit from a 360-degree view of their security governance and processes to better manage and mitigate product security risks."
David Nosibor, platform solutions lead, Identity Management Security and head of UL's SafeCyber project
UL is a global safety science leader. We deliver testing, inspection and certification (TIC), training and advisory services, risk management solutions and essential business insights to help our customers, based in more than 100 countries, achieve their safety, security and sustainability goals. We believe our deep knowledge of products and intelligence across supply chains make us the partner of choice for customers with complex challenges.
TAC Security | June 13, 2022
TAC Security, a Silicon Valley-based Cybersecurity company, announced the launch of their ESOF Prediction Feature. The Prediction feature allows the organizations to forecast the quantity of new vulnerabilities in an asset for the coming month. The results will be based on the vulnerability specifics from anyone’s most recent scan results for each Asset type.
The feature anticipates the ESOF cyber scores of various Asset types present in one’s infrastructure and based on the number, the predicted vulnerabilities are generated. The count of predicted vulnerabilities gets further divided based on severity levels for e.g., Critical, High, Medium and Low.
ESOF predicts the number of vulnerabilities in the coming months and generates a cyber score based on that for the coming months. The platform will predict the following -
Monthly Prediction of Vulnerabilities.
Prediction of ESOF Cyber Score
Prediction of Vulnerabilities that can be patched
Prediction of Type of Vulnerability(s)
ESOF also allows the count of predicted vulnerabilities to be compared to the number of actual vulnerabilities. The representational graphs will contain both the actual count and predictive count of the vulnerabilities for the coming months.
“The prediction feature allows security teams to foresee threats and prepare for them. If the security team needs training or resources, knowing in advance allows them to invest time and resources to improve their security processes. ESOF plays an essential role in allowing teams to discover, prioritize and remediate before situation demands, rather than mass efforts like other tools,” said, Trishneet Arora, Founder and Chief Executive Officer, TAC Security.
“We are thrilled to take the next step to ensure ESOF becomes Cybersecurity's Future. The Prediction feature is a revolutionary contribution by TAC Security to the ever-evolving Risk and Vulnerability Management market. The ability to foresee threats allows not only the security teams and leaders to be prepared. And gives them the chance to communicate with the whole organization, including the Board Members, so they know what to expect. It allows the organization to be well prepared and plan their resources to strengthen their security processes and reduce the chances of a breach remarkably.”
Chris Fisher – CMO, TAC Security
This announcement closely follows TAC Security’s recent launch of another new product, ESOF Product CyberScore. The product provides ability to generate risk scores for each product installed in the system. In addition to an individual product risk score for the product on a single asset, there is also a group score that will be based upon all the assets that have the product installed. With the overall product score, they can easily identify the most vulnerable products present in all the assets and prioritize the top 10 most vulnerable products present in the organization.
The prediction model is a major stepping stone in TAC Security’s mission of ensuring a cyberscore becomes the next credit score system for organizations to be considered compliant. The ability to forecast upcoming vulnerabilities gives organizations an edge over the adversaries and continues to strengthen the risk posture of their overall IT infrastructure.
About TAC Security
TAC Security, headquartered in San Francisco, is a global leader in Vulnerability Management that protects Fortune 500 companies, leading enterprises, and governments around the world.
TAC Security manages 5+ Million vulnerabilities through its Artificial Intelligence (AI) based Vulnerability Management Platform ESOF (Enterprise Security in One Framework). TAC Security has established strategic partnerships with leading cloud providers and managed service providers and consulting organizations including Tech Mahindra, IBM, KDDI Japan, and distributors including Dataguard Technologies LLC and Ingram Micro.
WEB SECURITY TOOLS
Star Atlas | May 25, 2022
Star Atlas, a next-gen metaverse with triple-A game design and Unreal Engine 5 graphics built on the Solana blockchain, today announced an expanded focus on security to ensure consumer protection and digital safety in the metaverse. This multi-pronged initiative includes signing Kudelski Security, the cybersecurity division of the Kudelski Group - the world leader in digital security, and the forefront leader in providing security solutions for major blockchain-based applications, exchanges, and ecosystems - as its security partner. Kudelski Security will perform ongoing audits and analysis to help ensure the integrity of the Star Atlas metaverse is maintained and both partners will work together to explore setting standards for web3 security.
"We are pleased to partner with the team at Kudelski Security to advance the digital security of our fast-expanding metaverse," said Michael Wagner, Co-Founder and CEO of ATMTA, Inc., the principal development studio of Star Atlas. "We understand there is a lot of skepticism when it comes to web3 and security, so we want to be proactive by partnering with one of the top cybersecurity firms to help make sure our community feels safe. Protection of assets is paramount, and we look forward to working with Kudelski Security to establish the best practices for security when it comes to web3 gaming."
As security auditor of record, Kudelski Security will increase the safety and security of the Star Atlas metaverse by testing the protocols and looking for potential vulnerabilities to be addressed. Star Atlas players will have greater assurance that the metaverse has been built securely and tested rigorously, and that Star Atlas has taken the necessary action to become the leader in the web3 space when it comes to security.
The relationship with Kudelski Security goes beyond the hardening of the Star Atlas environment. Star Atlas is looking to expand collaborations with the wider Group to focus on new standards that can help to transition companies and projects into web3, including security standards, tokenization, and best practices in web3 gaming. By developing standard technology and processes that enable safe and secure on-chain gaming, players will be protected from the hacks that currently plague web3 and some of the main barriers to wider stakeholder adoption will be lowered.
"Web3 is growing rapidly, and we are seeing more need for developing a security standard that is adopted across the industry to act as a framework. This is why we are excited to partner with a native web3 leader like Star Atlas and to come together to solve potential security issues before they arise."
Andrew Howard, CEO of Kudelski Security
In addition to Kudelski Security's blockchain and cybersecurity experience, the Kudelski Group is recognized as global leaders in digital security – with specialized expertise in encryption, anti-piracy, watermarking, cryptography, and digital rights management.
Executives from Star Atlas, the Kudelski Group, Kudelski Security, and NAGRA Kudelski are meeting during the World Economic Summit in Davos, Switzerland, to further discuss establishing a framework for securing the web3 ecosystem.
ABOUT STAR ATLAS
Star Atlas is a next-gen gaming metaverse emerging from the confluence of state of the art blockchain, real-time graphics, multiplayer video game, and decentralized financial technologies. Real-time graphics technology using Unreal Engine 5's Nanite allows for cinematic quality video game visuals. Blockchain technology using the Solana protocol establishes a largely serverless and secured gameplay experience. Non-fungible tokens obtained and traded within Star Atlas creates an economy that replicates the tangibility of real world assets and ownership.