OCA Releases 'OpenDXL Ontology' To Drive Greater Interoperability

Helpnetsecurity | February 24, 2020

  • The release marks a major milestone in the OCA’s mission to drive greater interoperability across the security industry.

  • The OpenDXL Ontology offers a single, common language for these notifications, information and actions across security products.

  • This common language will facilitate a wide variety of interoperability uses case, from sharing threat intelligence to triggering remediation between tools.


The Open Cybersecurity Alliance (OCA) has announced the first open source language for connecting cybersecurity tools through a common messaging framework called 'OpenDXL Ontology'.


With open source code freely available to the security community, enables any tool to automatically gain the ability to communicate and interoperate with all other technologies using this language.

- Open Cybersecurity Alliance (OCA)


The release marks a major milestone in the OCA’s mission to drive greater interoperability across the security industry by eliminating the need for custom integrations between individual products.



The Open Data Exchange Layer (OpenDXL)


The OpenDXL Ontology offers a single, common language for these notifications, information and actions across security products that any vendor can adopt in order to communicate in a standard way with all other tools under this umbrella. This provides companies with a set of tooling that can be applied once and automatically reused everywhere across all product categories, while also eliminating the need to update integrations as product versions and functionalities change.


For example, if a certain tool detects a compromised device, it could automatically notify all other tools and even quarantine that device using a standard message format readable by all. While previously this was only possible with custom integrations between individual products, it will now be automatically enabled between all tools that adopt OpenDXL Ontology. Through continued development by the community, this common language will facilitate a wide variety of interoperability uses case, from sharing threat intelligence to triggering remediation between tools, such as isolating a device or updating a policy.



With the adoption of public cloud and explosion of connected devices, the ability for enterprises to quickly respond to threats across ever-changing technologies, and even beyond perimeters, is critical. OCA is driving an industrial shift in interoperability with the OpenDXL Ontology to support security at scale.

- Brian Rexroad, Vice President of Security Platforms, AT&T)

Over 4,100 vendors and enterprises already utilize the Open Data Exchange Layer (OpenDXL) to develop and share integrations with other tools. The adoption of OpenDXL Ontology will help create a stronger, united front to defend and protect across all types of security tools, while reducing the burden of point integrations between individual products.


READ MORE: Cyberthreats hovering over the impending tax season


The Open Cybersecurity Alliance (OCA)


The Open Cybersecurity Alliance (OCA) brings together vendors and end users to create an open cybersecurity ecosystem where products can freely exchange information, insights, analytics, and orchestrated response. OCA supports commonly developed code and tooling and the use of mutually agreed upon technologies, data standards, and procedures. The OCA is governed under the auspices of OASIS, which offers projects a path to standardization and de jure approval for reference in international policy and procurement.


Since launching five months ago, the OCA has expanded to include more than 25 partner organizations, with the following new members joining: Armis, Center for Internet Security, CyberNB, Cydarm, Gigamon, Raytheon, Recorded Future, sFractal Consulting, and Tripwire. The full list of members can be found here.


The OCA community is currently collaborating on GitHub and Slack to further new open-source code and use-cases for cybersecurity industry interoperability. In addition to the development of OpenDXL Ontology for a common, open-source language between tools, the OCA is also continuing to build out capabilities for STIX-Shifter, a universal, out-of-the box search capability for security products of all types. Since bringing STIX Shifter to the open-source community, hundreds of visitors have accessed this technology on GitHub, with dozens of users initiating new project forks for development on top of the primary STIX Shifter code.


The OCA will continue development for both STIX Shifter and OpenDXL Ontology, and is actively seeking additional contributors from across the security industry to help guide and drive innovative new use cases for these open source projects.


READ MORE: Intensifying cyberattacks are a hindrance to business innovations

Spotlight

Cloud computing is an emerging technology that gives a tremendous changes in IT industry. It has ultimate features like multi-tenancy, elasticity, pay-per-use, self-provision, etc. But the customers are still hesitant to adopt cloud computing due to security and privacy. In this paper, the authors propose a trust model which secures client's information from both insiders and outsiders. In this model calculation of trust is based on their compliance report which has been promised in service level agreement.


Other News
DATA SECURITY

HackNotice Releases First-Ever Combined Security and Threat Awareness Service for Free

HackNotice | February 07, 2022

HackNotice, the world's leading threat awareness company, announced the first-ever security and threat awareness combined service, accessible to new and existing users. The added security awareness training course enables individuals to deepen their understanding of good cyber hygiene practices. The course offers 50 training videos, a security exam, and a certification. Cybersecurity training is mostly offered to company employees, often costing hundreds of thousands of dollars for intensive, week-long seminars and lectures. However, having good security awareness is vital for any individual. The newly released self-paced course ensures that anyone online can learn good cyber practices. "What makes the combined service great is that our threat modeling and security awareness course work together. When someone faces a large amount of personal information exposure, we recommend more phishing training. When someone has several passwords stolen, we have them focus on our password training. Now, users can receive the critical training that they need instantly, tailored to their specific risks," Steve Thomas, CEO, and Co-Founder of HackNotice For customers of HackNotice Teams, HackNotice's security and threat awareness service, the new course is an excellent addition for companies looking to strengthen their enterprises' security programs. Quick, in-the-moment, lessons are a perfect way to engage employees and business departments within the organization. Clients can also access dynamic reports to see user and departmental progress, and areas of improvement. About HackNotice Hacknotice is the only company-wide threat awareness platform, making employees more cautious online. Users monitor, review, and take swift actions against their real cyber-threats. The platform focuses on bridging the gap between security teams and other employees through real-time alerts, around-the-clock monitoring, recovery recommendations, and additional education. HackNotice's mission is to make all employees threat aware, creating a resilient culture of security.

Read More

SOFTWARE SECURITY

Thrive Integrates SOAR Technology into their Security Operations to Enhance Real-Time Cyber Threat Detection

Thrive | May 20, 2022

Thrive, one of the leading Managed Security Services Providers (MSSPs) in the world, has made a significant investment to upgrade their 24x7x365 eyes-on-glass Security Operation Center (SOC) by integrating a Security Orchestration, Automation, and Response (SOAR) engine. The SOAR capabilities will enable the Thrive global security team to better navigate today's complex, risk-laden environment for clients via tool aggregation and coordinated response, unified operations, reduced alert fatigue, and Artificial Intelligence (AI). This will result in a significant reduction of incident response times for client threats and provide higher quality information for the Thrive SOC to combat intricate cyber risks in real time. By 2025, the amount lost to cyber theft is expected to reach $10.5 trillion annually, which is the single greatest transfer of wealth in history, according to a report from AT&T. These glaring statistics indicate why cybersecurity has become imperative in the world of commerce. "Cybersecurity threats and vulnerabilities are constantly multiplying, due to not only more sophisticated social engineering but also a rise in micro-ransomware incidents, That means vigilance against attacks of all kinds must also evolve. Incorporating a SOAR into our robust global security operations unit will allow Thrive clients to have a stronger defense system in place against cybersecurity attacks and enable our team to respond more expeditiously to any issues should they arise." Mike Gray, CTO of Thrive Thrive's integrated managed cybersecurity solutions provide a proactive and expert approach to security management for identifying and remediating security issues. Powered by next-gen technology, proven frameworks and service-driven experts, Thrive's unified cybersecurity platform enables Thrive's 24x7x365 SOC to automatically address critical security issues without client intervention. By creating a stress-free experience that solves for the technical complexity and talent shortage mid-market enterprises face, Thrive's cybersecurity solutions fortify the digital transformation initiatives that propel business growth. About Thrive Thrive is a leading provider of NextGen managed services designed to drive business outcomes through application enablement and optimization. The company's Thrive5 Methodology utilizes a unique combination of its Application Performance Platform and strategic services to ensure each business application achieves peak performance, scale, uptime, and the highest level of security.

Read More

NETWORK THREAT DETECTION

SecurityScorecard Ignites European Adoption of Security Ratings Through Partnership with Exclusive Networks

SecurityScorecard | April 07, 2022

SecurityScorecard, the global leader in cybersecurity ratings, today announced a Pan-European exclusive distribution agreement with Exclusive Networks, a global cybersecurity specialist for digital infrastructure, to accelerate adoption of security ratings throughout Europe. The partnership, with Exclusive Networks owned specialist value-added distributor Ignition Technology, enables European organisations to instantly rate, analyze and continuously monitor their security risk, to harden their security postures. "The evolving geopolitical landscape is causing CISOs throughout Europe to reevaluate their cybersecurity postures, requiring them to have greater visibility across their attack surface than ever before. As the threat landscape expands, Exclusive Networks' expertise in helping disruptive cybersecurity solutions like SecurityScorecard breakthrough in EMEA will dramatically scale the number of European organizations that will be able to instantly improve their security postures through much needed data, visibility and insights." Jan Bau, VP, EMEA Sales, at SecurityScorecard SecurityScorecard provides comprehensive security ratings, automated assessments, and guidance from industry experts, providing easy-to-understand A-F graded scorecards for improved communication, effective compliance reporting and more informed decision making. The solution allows organisations to automate and accelerate questionnaire exchange with over 20 compliance survey templates and questionnaires at scale. "Exclusive Networks is focused on meeting customer and partner demand across Europe for the most impactful cybersecurity solutions on the market today," said Sean Remnant, Chief Strategy Officer, Exclusive Networks. "SecurityScorecard provides our network of customers and partners with instant visibility into their security postures and that of their vendors and business partners, to fully understand their true cyber risk." Exclusive Networks is a global trusted cybersecurity specialist for digital infrastructure driving the transition to a totally trusted digital future for all people and organisations. Located in 43 countries, with the ability to service customers in over 170 countries across five continents, Exclusive Networks has a unique 'local sale, global scale' model, combining the extreme focus and value of local independents with the scale and service delivery of a single worldwide distribution powerhouse. About SecurityScorecard Funded by world-class investors including Evolution Equity Partners, Silver Lake Waterman, Sequoia Capital, GV, Riverwood Capital, and others, SecurityScorecard is the global leader in cybersecurity ratings with more than 12 million companies continuously rated. Founded in 2013 by security and risk experts Dr. Aleksandr Yampolskiy and Sam Kassoumeh, SecurityScorecard's patented rating technology is used by over 30,000 organizations for enterprise risk management, third-party risk management, board reporting, due diligence, cyber insurance underwriting, and regulatory oversight. SecurityScorecard is the first cybersecurity ratings company to offer digital forensics and incident response services, providing a 360-degree approach to security prevention and response for its worldwide customer and partner base. SecurityScorecard continues to make the world a safer place by transforming the way companies understand, improve and communicate cybersecurity risk to their boards, employees and vendors.

Read More

DATA SECURITY

Wipro to Acquire Edgile to Strengthen its Leadership in Strategic Cybersecurity Services

Edgile | December 24, 2021

Wipro Limited, a leading global information technology, consulting and business process services company, today announced it has signed an agreement to acquire Austin, Texas headquartered Edgile, a transformational cybersecurity consulting provider that focuses on risk and compliance, information and cloud security, and digital identity. Edgile is recognized by security and risk leaders for its unique business-aligned cybersecurity capability, deep understanding of the changing regulatory environment and enabling cloud transformations that help secure the modern enterprise. In addition, the company’s “strategy-first” approach and “Quick Start” solutions will allow the combined entity to deliver enhanced value in strategic cybersecurity services. Together, Wipro and Edgile will develop Wipro CyberTransform™, an integrated suite that will help enterprises enhance boardroom governance of cybersecurity risk, invest in robust cyber strategies, and reap the value of practical security in action. In collaboration with an extensive roster of alliance partners from Wipro and Edgile, Wipro CyberTransform™ will enable organizations to accelerate their digital transformation and operate in virtual, digital supply chains all in a highly secure manner. “Adding Edgile’s strategic consulting capabilities and launching Wipro CyberTransform™ are significant milestones on our journey to becoming the trusted partner to security leaders and boardroom stakeholders. I see the team blending very well with Wipro’s CyberSecurists to deliver transformational cybersecurity on a global scale.” Tony Buffomante, Senior Vice President & Global Head – Cybersecurity & Risk Services, Wipro Don Elledge, Chief Executive Officer, Edgile, said, “We are immensely thrilled to join Wipro, a company we admire for its values and deep technology capabilities. Our collective full spectrum of cybersecurity risk consulting and security management capabilities will help our global customers to continue to securely embrace their digital transformation journey and sustain their on-going risk management priorities.” Earlier this year, Wipro strengthened its cybersecurity business by acquiring Ampion, a leading provider of cybersecurity services in Australia, and the cybersecurity practice at Capco, a leading consultancy in the BFSI sector in Europe and the US. Additionally, through its Wipro Ventures arm, the company continues to invest in innovative cybersecurity start-ups, demonstrating the firm’s strong commitment towards providing industry leading cybersecurity solutions across sectors and regions. Abry Partners, a minority private equity investor in Edgile, will fully exit its investment in Edgile as a result of this transaction. Piper Sandler acted as financial advisor to Edgile and Stone Key Partners LLC acted as financial advisor to Wipro for the transaction. About Wipro Limited Wipro Limited (NYSE: WIT, BSE: 507685, NSE: WIPRO) is a leading global information technology, consulting and business process services company. We harness the power of cognitive computing, hyper-automation, robotics, cloud, analytics and emerging technologies to help our clients adapt to the digital world and make them successful. A company recognized globally for its comprehensive portfolio of services, strong commitment to sustainability and good corporate citizenship, we have over 220,000 dedicated employees serving clients across six continents. Together, we discover ideas and connect the dots to build a better and a bold new future. About Edgile Edgile is the trusted leader in cybersecurity transformation and risk services partnering with the world’s leading organizations, including 31% of the Fortune 100 and 20% of the Fortune 500. Our strategy-first model optimizes today’s enterprise journey to the cloud and modernizes identity and security programs through a risk lens and expert compliance knowledge. We secure the modern enterprise by transforming risk into opportunity with solutions that increase business agility and create a competitive advantage for our clients.

Read More

Spotlight

Cloud computing is an emerging technology that gives a tremendous changes in IT industry. It has ultimate features like multi-tenancy, elasticity, pay-per-use, self-provision, etc. But the customers are still hesitant to adopt cloud computing due to security and privacy. In this paper, the authors propose a trust model which secures client's information from both insiders and outsiders. In this model calculation of trust is based on their compliance report which has been promised in service level agreement.

Resources