Data Security

GM Sectec and SecurityScorecard Bolster Design Partnership

SecurityScorecard
SecurityScorecard, the leader in security ratings, and GM Sectec, a leader in cyber protection laser-focused on the payments industry, today announced a design partnership to expedite the global growth and acceptance of security ratings in more than 55 countries across the globe.

GM Sectec's network of over 50,000 clients and end users across the world now has quick insight into the security posture of suppliers and business partners, as well as the capacity to conduct self-assessments, thanks to the relationship with SecurityScorecard.

COVID-19 has contributed in greater usage of digital tools and data generation, with the World Bank estimating that by the end of the year, yearly total Internet traffic will have climbed by 50% from 2020, reaching 4.8 zettabytes. The article emphasizes how businesses are more interconnected, as well as how rising digitalization has pushed the global population onto a new path of cyber dangers and assaults. In comparison to other insurable risks, the rapid increase in ransomware highlights the speed and scope of cyber risk. Ransomware attacks have climbed by 150% in the last year, with total ransoms paid up by 311% 2. Insurance providers had a record high loss ratio of 67% 3 as a result of the huge increase in frequency and severity.

"Enhancing our existing alliance with SecurityScorecard, supports organizations anywhere in the world in hardening their security posture and achieving the adoption of secure technologies and practices. Organizations need to understand their true cyber risk and be able to respond quickly and efficiently to strengthen their position."

Héctor Guillermo Martínez, president of GM Sectec

SecurityScorecard is the industry's top platform for security evaluations, with thousands of firms using it throughout the world. Vendor risk management, self-monitoring, board reporting, cybersecurity insurance underwriting, and M&A due diligence have all seen increased use cases as the firm has grown.

Aleksandr Yampolskiy, CEO and co-founder of SecurityScorecard said that "Organizations look to SecurityScorecard to transform the way they understand, mitigate, and communicate cybersecurity risk. Partnering with GM Sectec delivers value to organizations around the world by providing clearer visibility to their cyber postures and dramatically improving their ability to communicate, mitigate and respond to risks."

GM Sectec has over 50,000 clients and users throughout the globe, as well as four Critical Incident Response and Replication Centers (CIRRCs), three in the US and one in Mexico, that provide managed detection and security services to its customers 24 hours a day, seven days a week, 365 days a year. SOC 2 Type 2 Service Organization, TMA Certified, authorized to use CERT, PCI Qualified Security Assessor, PCI Approved Scanning Vendor, PCI Point-to-Point-Encryption (P2PE), PCI PIN, PCI PFI, UL Listed, Visa Preferred Partner in Cybersecurity, and FIRST Incident Response team member are just a few of the certifications the company has received.

Spotlight

Cyber attacks are increasing in volume, sophistication, and severity, and the federal government has taken notice. Now, they’re taking action — most recently in the form of new cybersecurity rules from the Securities and Exchange Commission. In “11 Ways to Streamline SEC Cybersecurity Compliance with Risk Cloud,” we explore a va


Other News
API Security

Salt Security, CrowdStrike Expands Partnership with New Integration

Salt Security | September 20, 2023

Salt Security, a prominent API security company, has announced the expansion of its partnership with CrowdStrike, a leading cybersecurity technology company providing cloud workload and endpoint security, cyberattack response, and threat intelligence services. This expansion involves the integration of the Salt Security API Protection Platform with the widely recognized CrowdStrike Falcon Platform. Roey Eliyahu, Co-founder and CEO of Salt Security, stated, Protecting against API threats requires deep visibility and robust runtime protection. We’re excited to bring our unique strengths in API security to the CrowdStrike customer base with this new integration. Together with CrowdStrike, Salt can provide organizations with extended runtime protections and posture management across the cloud and application landscapes. [Source – Cision PR Newswire] Through this integration, customers gain access to a comprehensive 360-degree view of API security risks, particularly focusing on the application-layer attack surface. This integration is accessible via the CrowdStrike Marketplace and provides valuable API threat intelligence. It also enhances cross-organization API security capabilities by streamlining and enhancing the workflows related to API auditing, monitoring, and enforcement. The partnership between Salt Security, offering top-notch API runtime monitoring and AI-driven insights, and CrowdStrike, renowned for its award-winning AI-powered protection, provides organizations with complete visibility into their API attack surface. This integration also offers valuable context regarding the severity of threats in relation to business-critical aspects. With this partnership, customers benefit from: API vulnerability and threat context API threat mitigation API threat management automation The patented Salt API security platform stands out for its utilization of cloud-scale big data, artificial intelligence (AI), and machine learning (ML). These technologies work in tandem to automate the process of discovering and cataloging an organization's entire set of APIs. Salt plays a crucial role in pinpointing areas where APIs might expose sensitive data. This proactive approach aids enterprises in recognizing and mitigating potential API threats while also reinforcing their overall API security. Gur Talpaz, Head of Falcon Fund and Vice President of Corporate Development at CrowdStrike, said, With APIs now a prime target for malicious actors, securing them requires a comprehensive and diligent approach. Through this joint integration, we can harness the mature AI-driven intelligence of the Salt API security platform with our widely deployed Falcon platform, giving organizations complete visibility into their application-layer attack surface and a detailed understanding of their application threat landscape. [Source – Cision PR Newswire] About Salt Security Salt Security is a leading API security company that safeguards the APIs at the core of all modern applications. Its API Protection Platform is the sole API security solution that integrates the power of cloud-scale big data with time-tested machine learning and artificial intelligence to detect and prevent API attacks. Salt provides extensive context, real-time analysis, and continuous insights for API discovery, hardening APIs, and attack prevention by correlating the activities of millions of APIs and users over time.

Read More

Software Security

Lacework and Snowflake Expand Their Alliance to Secure Cloud Business

Lacework | September 15, 2023

Lacework, a company specializing in data-driven cloud security, and Snowflake, a prominent Data Cloud company, have jointly announced an expanded partnership. This partnership aims to propel the evolution of cloud infrastructure while enhancing cloud security automation at scale. Through this extended collaboration, security teams gain direct access to their Lacework cloud security data using Snowflake's secure data sharing, thus enabling unified visibility and tailored automation. Ulfar Erlingsson, Chief Architect, Lacework, said, Snowflake has been a dedicated platform partner as Lacework has scaled our business to support over 900 customers — ranging from small, early-stage startups to some of the most sophisticated enterprises running in the cloud space today — whose operations result in tremendous volume, variety, and velocity of security-relevant data. [Source – Cision PR Newswire] Erlingsson mentioned that, over the past seven years, Lacework had successfully conducted timely and efficient data processing by utilizing the Snowflake Data Cloud, even among a highly skewed set of customers. He further explained that their extended partnership with Snowflake would enhance their ability to serve joint customers at a cloud scale. This would apply whether customers needed them to handle only a small amount of security data or data processing at rates as high as 10s of gigabytes per second. As generative AI advances and becomes more accessible across various industries, the frequency and severity of cybersecurity threats are on the rise. This trend is driven by businesses accelerating their development processes and increasing cloud data generation. Addressing this new era of cloud security necessitates a fundamentally fresh approach, and Lacework's platform is designed to efficiently manage the substantial volume of data within an organization's cloud ecosystem. This includes data related to code, identities, containers, and multi-cloud infrastructure, with Snowflake serving as a critical platform partner. Through the combined capabilities of Lacework's security platform and Snowflake's Data Cloud, customers gain the ability to extend the value of cloud security data throughout their organization. This enables organizations to thoroughly assess their security and compliance status. Head of Cybersecurity Strategy at Snowflake, Omer Singer, said, Among the many potential advantages of generative AI is the ability for enterprises to deploy new applications faster, which places even more emphasis on the need to have scalable infrastructure and solutions. The combination of Snowflake and Lacework will continue to assist organizations scale their cloud businesses securely in the new era. [Source – Cision PR Newswire] About Lacework Lacework protects organizations in the cloud, enabling them to innovate with greater speed and assurance. Lacework's platform is designed to scale with the variety, volume, and velocity of cloud data across an organization's cloud environment, including code, containers, identities, and multi-cloud infrastructure. Only Lacework provides Security and Development teams with a connected and prioritized end-to-end view that identifies the most significant hazards and security events. About Snowflake The Snowflake enables all organizations to mobilize their data with its Data Cloud. Customers utilize the Data Cloud to integrate disparate data sources, power data applications, discover and securely share data, and implement a variety of AI/ML and analytic workloads. Snowflake provides a singular data experience that transcends multiple clouds and geographies, regardless of where data or users reside. Snowflake Data Cloud is used by thousands of customers across numerous industries, including 639 of the 2023 Forbes Global 2000 as of July 31, 2023.

Read More

Cloud Security

Tigera Boosts Calico for Enhanced Security & Performance

Tigera | November 07, 2023

Tigera, a provider of an active security platform for containers and Kubernetes, has announced significant upgrades to its Calico Open Source and Calico Cloud. These improvements focus on enhancing the security, scalability, and performance of Kubernetes deployments for enterprises, providing a comprehensive solution for containerized environments. Given the increased utilization of Windows containers in production, Tigera has introduced the Calico Open Source Windows HostProcess Container feature. It streamlines node pool deployment, eliminating the need for manual node initialization and enhancing Kubernetes administrators' ability to manage Windows container-based applications efficiently. Calico Cloud now introduces a Security Score and Recommended Actions feature, addressing the paramount importance of security in Kubernetes clusters. This feature offers administrators an at-a-glance view of their organization's security posture by monitoring historical trends and risks by namespace. Moreover, it provides actionable recommendations tailored to each workload, fortifying the security of individual workloads and the entire cluster. It supports IPv6 for the eBPF dataplane, meeting the demands of enterprise-class applications by providing scalable, high-performance networking. This innovation ensures optimal performance for latency-sensitive applications and addresses IP shortages. Multi-cluster Kubernetes deployments over VxLAN are on the rise, requiring enhanced application layer observability and security. Calico introduces Kubernetes Cluster Mesh for VxLAN, offering a scalable solution for workload communication and security policy enforcement across Kubernetes clusters. This simplifies complex multi-cluster environments and ensures enterprise infrastructure can run efficiently, securely, and compliantly. These Calico enhancements redefine container networking and security, enabling enterprises to secure, scale, and optimize their Kubernetes clusters with unparalleled confidence. Tigera's Chief Product Officer, Amit Gupta, emphasized the importance of these updates, stating that Calico provides the industry's most complete solution for securing and observing Kubernetes environments. About Tigera Tigera provides the industry's sole active security platform, complemented by comprehensive observability capabilities tailored for containers and Kubernetes. The company's platform operates on a multifaceted front, effectively thwarting, identifying, troubleshooting, and autonomously mitigating potential security breach risks. It offers its platform through two distinct avenues: a fully managed SaaS solution, Calico Cloud, or a self-managed service, Calico Enterprise. Its open-source offering, Calico Open Source, is the most widely adopted solution for container networking and security, shaping the landscape of secure container environments.

Read More

Software Security

ZeroFox Unveils New Anti-Phishing Features to Stop Attacks at Source

ZeroFox | September 22, 2023

ZeroFox, an industry-leading provider of enterprise software-as-a-service for external cybersecurity, has announced the unveiling of multiple anti-phishing product enhancements. These updates solidify ZeroFox's position as the world leader in digital risk protection. Developed using cutting-edge AI/ML technologies and designed by a team of top-tier security experts, these new anti-phishing features boost escalated alert volume, reduce the occurrence of false positives, and expedite the process from threat identification to initial disruption and successful takedowns for all our customers. The importance of these new features cannot be overstated, especially given the rising threat landscape. In the first half of 2023, ZeroFox Intelligence has recorded a substantial increase in the volume and complexity of phishing attacks, including a 30% surge in domain takedowns compared to the first half of 2022. New ZeroFox phishing trend research also highlights the adoption of evasion techniques like cloaking alongside emerging tactics such as SEO poisoning and phishing-as-a-service. These developments underscore the critical role of these new capabilities in safeguarding against evolving cyber threats. Continuous and Complete Protection Against Domain-based Threats ZeroFox adopts a unique approach to phishing compared to email security and conventional anti-phishing providers. Its strategy revolves around the identification, disruption, and elimination of the domains necessary for launching phishing campaigns. With daily monitoring of over 65 million domains, ZeroFox combats various threats like typo squats, subdomain spoofs, homoglyphs, and other malicious domain and URL-based attacks, effectively shielding customers and preventing any disruptions to business operations. Incorporate advanced domain protection capabilities to enhance their cybersecurity measures, aiming to achieve substantial and measurable business outcomes: Reduce Phishing Risks with Anti-Cloaking Capabilities: Strengthen Compliance and Trust with SSL Monitoring Secure Brand Identity with Favicon Search Improve Operational Efficiency with Enhanced Subdomain Coverage Enhance User Experience (UX) with Weblog Monitoring Mike Price, Chief Technology Officer of ZeroFox, said, ZeroFox has been detecting and disrupting phishing attacks for the last decade, constantly enhancing our solution to protect our customers from changing phishing techniques used by threat actors, including the widespread use of malicious cloaking and subdomains techniques. [Source – Globe Newswire] Price stated that the enhanced capabilities being announced represented their ongoing commitment to tackling the increasing phishing challenge encountered by security teams. He emphasized that as phishing continued to evolve, ZeroFox would remain a trusted anti-phishing partner dedicated to safeguarding customers from both current and future phishing techniques. About ZeroFox ZeroFox, a prominent enterprise software-as-a-service provider in the field of external cybersecurity, has revolutionized security beyond the corporate perimeter on the internet, where businesses conduct their operations and threat actors are active. Their platform seamlessly integrates cutting-edge AI analytics, digital risk and privacy protection, full-spectrum threat intelligence, and a robust set of breach, incident, and takedown response tools. This enables them to uncover and disrupt various threats, including phishing and fraud campaigns, botnet exposures, impersonations, credential theft, data breaches, and physical threats that target domains, brands, personnel, and assets.

Read More

Spotlight

Cyber attacks are increasing in volume, sophistication, and severity, and the federal government has taken notice. Now, they’re taking action — most recently in the form of new cybersecurity rules from the Securities and Exchange Commission. In “11 Ways to Streamline SEC Cybersecurity Compliance with Risk Cloud,” we explore a va

Resources