SOFTWARE SECURITY

Involta Partners With Tech Startup HacWare to Expand Enterprise Cybersecurity Awareness Services

Involta | August 08, 2022 | Read time : 03:00 min

Involta
Involta, an award-winning data center, hybrid IT, and cloud-forward consulting firm, announces today a partnership with HacWare, an AI-driven cybersecurity awareness and training SaaS (Software-as-a-Service) product that combines threat intelligence with user behavior to help lean IT teams combat today's most advanced phishing attacks.

"Today, email phishing attacks remain the number one source of security breaches, causing over 90% of data breaches," states Tiffany Ricks, Founder and CEO of HacWare, Inc. "The average employee is vulnerable because they spend 1,500 hours a year using email, and many are unaware of email security best practices. Partnering with Involta gives us the opportunity to help businesses improve their email security awareness and build up their first line of defense against cyberattacks."

HacWare's internal risk assessment provides real-time threat intelligence to show internal vulnerabilities. HacWare learns from the intelligence to provide personalized phishing simulations and training. The phishing technology leverages behavioral psychology best practices to improve cyber posture, saving businesses up to 40% in labor costs.

"At Involta, we know the two most important things our customers can do to protect themselves from a phishing attack is awareness and education," comments Mark Cooley, Involta VP of Security and Compliance. "Making sure that your company's employees understand the prevalence and sophistication of these attacks is crucial. HacWare's security awareness technology combines open-source data and data science to show employees how to avoid scams while significantly saving on traditional security training and awareness labor costs. The automated, easy-to-use platform is the perfect addition to our robust security solution suite."

Ricks' motivation comes from an entrepreneurial spirit and the desire to help people. She has led HacWare, Inc. to be widely recognized by leading publications such as The Wall Street Journal, Dark Reading, TechCrunch, Forbes and Women's Business Council.

"We are thrilled to partner with Tiffany and her team at HacWare to bring her expertise and innovative solutions to our customers and prospects. "Not only is her product both superior and necessary in today's security landscape, but she is also a true role model for our industry's next generation of female leaders. As more women continue to enter into the world of security and digital infrastructure, it's critical to align with them and help bolster their positions while working alongside them to close the gender gap."

Jim Buie, Involta President and CEO

Involta's commitment to supporting women in tech and empowering girls to explore STEM fields includes a partnership with Girls, Inc. of Pinellas County, Florida, where they recently introduced digital infrastructure as a potential career path.

About Involta
Involta is an award-winning hybrid IT and cloud-forward consulting firm orchestrating digital transformation for the nation's leading enterprises. Involta's ongoing mission is rooted in partnership. Its personalized approach identifies customers' requirements while earning their trust to ultimately deliver Superior Infrastructure and Services, Operational Excellence and People Who Deliver, keeping with the Involta brand promise.

Spotlight

TechConnect West Virginia has been the driving force behind the West Virginia Cybersecurity Workforce Strategic Initiative. TCWV is a non-profit coalition committed to the advancement of the innovation economy in West Virginia, focused on four technology sectors: advanced energy, chemicals and advanced materials, biosciences, and biometrics. With broad representation from private industry, the public sector, and higher education, TechConnectWV seeks to diversify the state’s economy, promote economic prosperity and create high-paying jobs.


Other News
DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

SaaS Alerts Secures $22M Investment from Insight Partners to Scale SaaS Security Monitoring and Response Platform

SaaS Alerts | September 12, 2022

SaaS Alerts, the cybersecurity company purpose-built for Managed Service Providers (MSPs) to protect and monetize their customers' core business SaaS applications, announced today that it has secured a $22 million growth investment from global software investor Insight Partners to accelerate the growth of its SaaS Security monitoring and response platform. The accelerated rate of SaaS Application adoption by businesses, driven by the need to provide collaboration and productivity tools to remote workforces and for more centralized and tightly controlled business data resources, has elevated awareness and critical concern for major threat vectors and security gaps that exist in SaaS Application security. These security concerns present opportunities for MSPs to better safeguard their clients while offering SaaS security services that drive profitable new revenue streams. SaaS Alerts was designed to help MSPs monitor and protect their customers' usage of today's most popular SaaS applications such as Microsoft 365, Google Workspace, Salesforce, Dropbox and more – and to safeguard against security threats to a business' SaaS environment such as data theft, data that's at risk due to unintentional employee mishaps and actions taken by bad actors. "We couldn't be more excited to partner with Insight Partners and we see their investment in SaaS Alerts as a monumental endorsement for what we have built and what we intend to build as we collaborate going forward. "I'm very proud of our team for reaching this milestone and look forward to working with Insight to continue to build value for our MSP partners and stakeholders." Jim Lippie, CEO of SaaS Alerts "SaaS applications have become essential for businesses of every size and MSPs need the ability to better protect those applications on behalf of their customers. SaaS Alerts has pioneered SaaS security for MSPs and has a clear vision for how detecting and correlating abnormal user behavior can greatly impact the MSP industry," said Philine Huizing, Principal at Insight Partners. "We're excited to partner with SaaS Alerts as the company scales to address this unique opportunity." About SaaS Alerts SaaS Alerts is the cybersecurity company purpose-built for MSPs to protect and monetize customers' core SaaS business applications. SaaS Alerts offers a unified, real-time monitoring platform for MSPs to protect against: data theft, data at risk and bad actors and integrates with the most popular SaaS Applications. Learn more at www.saasalerts.com. About Insight Partners Insight Partners is a global software investor partnering with high-growth technology, software, and Internet startup and ScaleUp companies that are driving transformative change in their industries. As of June 30, 2022, the firm has over $80B in regulatory assets under management. Insight Partners has invested in more than 700 companies worldwide and has seen over 55 portfolio companies achieve an IPO. Headquartered in New York City, Insight has offices in London, Tel Aviv, and Palo Alto. Insight's mission is to find, fund, and work successfully with visionary executives, providing them with practical, hands-on software expertise to foster long-term success. Insight Partners meets great software leaders where they are in their growth journey, from their first investment to IPO.

Read More

DATA SECURITY,SOFTWARE SECURITY

Accenture Named a Leader in European Managed Security Service Providers by Independent Analyst Firm

Accenture | September 13, 2022

Accenture has been named a Leader in the latest Forrester Research report on European managed security service (MSS) providers, which notes that Accenture sets itself apart from the rest of the market by the way in which it develops assets that are embedded in its services for the benefit of clients. The report — "The Forrester Wave™: European Managed Security Service Providers, Q3 2022" — includes a comprehensive 39-criteria assessment of the top 10 cybersecurity consulting providers across three high-level categories: “Current Offering”; “Strategy”; and “Market Presence.” Client references and buyer feedback were also factored into each criterion evaluated in the report. Accenture received the highest score in the Current Offering category among competitors evaluated, with the highest possible score in twelve criteria, including: data sovereignty and European service delivery; managed application security; business and technical value; product vision; execution roadmap; innovation roadmap; and partner ecosystem. The report says that: Accenture stands out for its vision roadmap, with several planned items focusing on emerging CISO [chief information service officer] needs for managed services providers. Accenture also continues to set the standard for strong partnerships to drive unique technology and services IP. When noting how Accenture sets itself apart by developing assets that are embedded in services for clients, the report said that one particularly strong example of this was its Intelligent Application Security Platform (IASP), which delivers significant value for developers within its application security services. Reference customers praise the flexible personnel, highly competent technical staff, and strong partnership approach. Accenture is a good match for customers who want end-to-end security capabilities that deliver a wide array of managed services. “We’re on a mission to make cybersecurity a priority for business leaders in Europe, and our managed security services team can help clients navigate the challenges. “It’s an honor to be recognized for our work helping clients build better defenses and strengthen their cybersecurity capabilities. Because cyber risk is a constantly moving target, we help our clients identify not only existing threats but also emerging threats to their enterprises.” Jacky Fox, who leads Accenture Security in Europe In addition to being named a Leader among European MSS providers by Forrester, Accenture was recently named the No. 1 cybersecurity service provider by HFS Research and positioned as a Leader in the latest IDC MarketScape analysis of managed security services (MSS) providers in Europe. In 2021, Accenture was positioned as a Leader in two Forrester reports on cybersecurity: The Forrester Wave™: Global Cybersecurity Consulting Providers, Q4 2021 and The Forrester Wave™: European Cybersecurity Consulting Providers, Q3 2021. More information on Accenture in “The Forrester Wave™: European Managed Security Service Providers, Q3 2022” report can be found here. About Accenture Accenture is a global professional services company with leading capabilities in digital, cloud and security. Combining unmatched experience and specialized skills across more than 40 industries, we offer Strategy and Consulting, Technology and Operations services and Accenture Song — all powered by the world’s largest network of Advanced Technology and Intelligent Operations centers. Our 710,000 people deliver on the promise of technology and human ingenuity every day, serving clients in more than 120 countries. We embrace the power of change to create value and shared success for our clients, people, shareholders, partners and communities.

Read More

DATA SECURITY,PLATFORM SECURITY,SOFTWARE SECURITY

Sealing Technologies Inc. Awarded $168.5M to Provide USMC Cyber Defense Support

Sealing Technologies Inc. | August 30, 2022

Sealing Technologies, Inc. (SealingTech), a Veteran Owned Small Business (VOSB) that provides innovative cybersecurity solutions, was recently awarded a $168.5 million task order to assist the U.S. Marine Corps (USMC) with their Defensive Cyber Weapons System (DCWS). SealingTech will support the Marine Corps Cyber Protection teams by building a holistic cyber defense solution comprised of SealingTech fly away kits and a suite of tools to analyze vulnerabilities, map key cyber terrain and respond to incidents. "The DCWS system is an important enabler of cyberspace maneuver across the Department of Defense's (DoD) key terrain. "We are both humbled and excited that the USMC has trusted SealingTech with this critical mission and we are hitting the ground running to ensure its success." Ed Sealing, Founder and CEO of SealingTech With this contract award, and their support to the Army, Navy, and US Air Force cyber teams, SealingTech continues to posture the DoD cyber operators with a standard defensive cyber operating platform in preparation for a Joint Cyber Warfighting Architecture. As an industry partner, SealingTech is ideally positioned to work across all DoD services and agencies to identify best practices and enable the most effective and efficient joint solution. About Sealing Technologies Inc. SealingTech is a Veteran Owned Small Business (VOSB) that rapidly delivers innovative cybersecurity solutions that modernize, protect, and defend the networks and systems of the Federal Government and private industries. SealingTech's vast cyberspace experience and knowledge provides cutting-edge research, engineering and integration services that support the United States and their allies.

Read More

DATA SECURITY,SOFTWARE SECURITY,WEB SECURITY TOOLS

Legit Security Discovers and Helps Remediate Software Supply Chain Vulnerabilities in Google Firebase & Apache Open-Source Projects

Legit Security | September 16, 2022

Legit Security, a cyber security company with an enterprise platform to secure an organization’s software supply chain, today announced that it discovered software supply chain attack vulnerabilities in popular open-source projects from Google and Apache. The discovered vulnerability affects GitHub, an extremely popular Source Code Management (SCM) system at the heart of many organization’s software supply chains and used by software developers globally. The Legit Security research team found a new type of CI/CD vulnerability called “GitHub Environment Injection” that allows attackers to take control of the vulnerable project's GitHub Actions CI/CD pipeline. Any GitHub user could exploit this vulnerability to modify the project’s source code, steal secrets, move laterally and attack inside the organization, and ultimately initiate a SolarWinds-like supply chain attack. The vulnerability was found in the Google Firebase project and in a very popular integration framework project from Apache. Both Google and Apache acknowledged and fixed the vulnerabilities after an initial disclosure by Legit Security. Legit Security has published a technical disclosure blog on their website including guidance for organizations to remediate this vulnerability. Legit Security’s Research Team discovered that a specially crafted payload written to a GitHub environment variable called “GITHUB_ENV” could allow an attacker to execute code on the target pipeline and thereby modify the source code or compromise the repository itself. This attack can be initiated by any GitHub user and is very easy to implement just by creating a “pull request” or a proposed change to the source code. The mere act of submitting the pull request will trigger the vulnerable build action and carry out a successful compromise and the attacker does not need to be subjected a code review approval from the source code maintainer for it to take effect. The Legit Security team disclosed these issues to Google and Apache project maintainers, along with remediation guidelines, and verified that these vulnerabilities weren’t exploited by a malicious actor. Both projects have been fixed and are now safe. However, these are not the only projects susceptible to this kind of attack. Since using the GITHUB_ENV file is currently considered the “safe” way to change environment variables in GitHub Actions, many repositories are using workflows that write untrusted data into this file, leaving them exposed to supply chain attacks. “This type of vulnerability joins many other software supply chain vulnerabilities and attacks targeting popular open-source projects, including GitHub, which is the largest and the de facto host of most open-source projects. “We, as a security community, must build the tools and processes to address these threats and allow organizations to trust software and use it safely. Here at Legit Security our mission is to secure every organization’s software supply chain and we are active conducting security research and collaborating on initiatives to achieve this goal." Liav Caspi, CTO and co-founder of Legit Security According to Gartner®, nearly half of organizations worldwide will experience an attack on their software supply chains by 2025, a three-fold increase from 2021. There has been a huge rise in attempts to compromise open-source projects and CI/CD build services, including GitHub Actions, to enable wide ranging attacks through software supply chains. For in-depth analysis of the GitHub Environment Injection vulnerability, along with broader information and guidance on how to protect your organization from software supply chain attacks, please visit the Legit Security website and blog. About Legit Security Legit Security protects software supply chains from attack by automatically discovering and securing the pipelines, infrastructure, code and people so that businesses can stay safe while releasing software fast. Legit provides an easy to implement SaaS platform that supports both cloud and on-premises resources and combines automated discovery and analysis capabilities with hundreds of security policies developed by industry experts with real-world SDLC security experience. This integrated platform keeps your software factory secure and provides continuous assurance that your applications are released without vulnerabilities.

Read More

Spotlight

TechConnect West Virginia has been the driving force behind the West Virginia Cybersecurity Workforce Strategic Initiative. TCWV is a non-profit coalition committed to the advancement of the innovation economy in West Virginia, focused on four technology sectors: advanced energy, chemicals and advanced materials, biosciences, and biometrics. With broad representation from private industry, the public sector, and higher education, TechConnectWV seeks to diversify the state’s economy, promote economic prosperity and create high-paying jobs.

Resources