DATA SECURITY

Synack launches an app store experience for more flexible, smarter cybersecurity solutions

Synack | October 20, 2021

Synack, the premier crowdsourced platform for on-demand security expertise, today is giving customers the easiest, most flexible and most innovative approach for deploying critical cybersecurity solutions to defend against today's digital threats.

Synack Campaigns  empowers organizations with on-demand access to a community of 1,500 skilled and trusted ethical hackers to perform a range of tasks, from targeted security checks to cloud configuration assessments. Customers can take advantage of Campaigns through the Synack Catalog, which provides customers with an app store-like experience, to deploy Security Operations activities.

These additions complement Synack's market-leading approach to crowdsourced cybersecurity with unparalleled abilities to integrate penetration testing — and other key security tasks — into organizations' security operations. This expansion lets customers extract more value from the Synack Platform and the Synack Red Team (SRT), Synack's network of the world's most skilled and trusted ethical hackers.

This is a game changer,Cybersecurity shouldn't ever be a one-size-fits-all solution. We're expanding our platform to make it truly customizable, on-demand and seamless. Some customers need vigorous penetration testing while others may want a hacker to perform an emergency assessment. Now, they can do all of that on one easy-to-use platform.

Jay Kaplan, Synack CEO

SYNACK CAMPAIGNS
Synack Campaigns  give customers on-demand access to the SRT to meet specific needs and solve unique security issues. Campaigns deliver actionable security intelligence for application security, compliance, vulnerability management and more. Each Campaign consists of a group of Missions, or security tasks, which researchers perform. These can range from checking for OWASP Top 10 vulnerabilities, to cloud configuration checks, to get a hacker's perspective on an asset.

SYNACK CATALOG
The Synack Catalog allows customers to browse, launch and track Campaigns directly in the Synack Portal. It also enables organizations to take full advantage of SRT talent through the Synack Platform and gain critical security insights and knowledge to improve security across the entire enterprise.

SYNACK CREDITS
With Synack Credits, customers will have more flexibility than ever to purchase Campaigns that best suit their testing needs and take advantage of new and existing offerings at any given time. The options built into this approach mean organizations can utilize Synack's integrated and controlled platform as needed to supplement their own teams and technologies.

"It's a simple, smarter, more agile and manageable approach to security," said Peter Blanks, Chief Product Officer at Synack. "We looked at what customers needed, and we delivered. This is a better approach to cybersecurity that's the most adaptable and accessible. We'll continuously innovate at the scale and speed our clients require to accommodate the dynamic threat landscape. Ultimately, this will make organizations more secure and, as a result, improve cybersecurity for everyone."

ABOUT SYNACK:
Synack is the premier crowdsourced platform for on-demand security expertise. The Synack Platform delivers 24/7 penetration testing, vulnerability management, and vulnerability assessment from a global network of trusted researchers, enabled by smart technology, to accelerate global organizations' critical cybersecurity missions. Headquartered in Silicon Valley with regional teams around the world, Synack protects leading global banks, federal agencies, DoD classified assets, and more than $6 trillion in Fortune 500 and Global 2000 revenue. A 4-time CNBC Disruptor 50 company, Synack was founded in 2013 by former NSA security experts Jay Kaplan, CEO, and Dr. Mark Kuhr, CTO.

Spotlight

Security information and event management (SIEM) tools offer more than just security. In fact, many organizations overlook some of the most useful aspects of SIEM technology, including fraud prevention and operations management.


Other News
DATA SECURITY

Netskope Revolutionizes Data Protection with Patented Lightweight, Cloud-Powered Endpoint Data Loss Prevention

Netskope | May 24, 2022

Netskope, the leader in Security Service Edge (SSE) and zero trust,announced a key expansion of data protection capabilities to endpoint devices and private apps. The introduction of a patented endpoint data loss prevention (DLP) solution will enable Netskope Intelligent SSE customers to protect data everywhere it moves across the hybrid enterprise. Zero trust principles are critical to SSE, which describes the security stack needed to enable a modern Secure Access Service Edge (SASE) architecture. Data protection is of utmost importance throughout a SASE architecture—specifically, the need for security to move with data wherever it is accessed, and apply zero trust to determine the right level of access. Additionally, legacy and endpoint DLP offerings have failed enterprises by being siloed, complicated, and intrusive, hindering user productivity. Netskope has been consistently recognized by top industry analysts for its advanced data protection capabilities. With today's continued expansion of the Netskope Intelligent SSE platform, Netskope customers will be able to protect data across SaaS, IaaS, private applications, web, e-mail, and endpoint devices from a single converged data protection solution, leveraging machine learning, user and entity behavior analytics (UEBA), and insider threat mitigation capabilities to improve security efficacy, efficiency, and agility. Notable features of Endpoint DLP include: Context-aware, zero trust data protection on local peripherals and devices, such as USB drives and printers Unified data classification, policy enforcement, and incident management for DLP across SaaS, IaaS, private apps, web, e-mail, and endpoint devices A patented lightweight endpoint agent with cloud-based inspection and contextual data protection policies that enhance the user experience Machine learning and Advanced Analytics to help simplify data classification and policy definition, lowering operational overhead UEBA, which makes it possible to identify and stop complex data loss scenarios such as insider risk, where users are unintentionally or even maliciously abusing their access to data "No SASE or zero trust journey will be successful without data protection capabilities that can address all critical use cases in a way that is easy to deploy and doesn't slow down users, The introduction of Endpoint DLP extends Netskope's award-winning data protection capabilities that much further, to critical use cases with endpoint devices. While some competitors may offer unified policy and management or provide data protection for certain vectors, Netskope is the only vendor that can provide truly converged data protection across the full IT environment. We are very excited to deliver Endpoint DLP to customers as another Netskope game-changer." John Martin, Chief Product Officer, Netskope "With Netskope's new eDLP, we can now offer single-pass data protection —across all vectors, from the cloud to the endpoint —with unified policies, within a single management console," said Mick Coady, Global Vice President CyberSecurity Solutions, World Wide Technology. "As a Platinum Partner in Netskope's Evolve partner program, we're seeing the huge growth opportunity that Netskope's Intelligent SSE approach represents. This new addition will accelerate that growth." A work-from-anywhere, or "hybrid," environment makes it increasingly difficult to maintain security models based on implicit trust in any entity that wants to connect. Zero trust principles enable organizations to govern access to data based on behavior by users, devices, networks, and applications— increasing confidence in policy enforcement everywhere. By evaluating several contextual elements—user identity, device identity and security posture, time of day, geolocation, business role, sensitivity level of the data, and more—the resource itself can determine an appropriate level of confidence, or trust, only for that specific interaction and only for that specific resource. Using Netskope Intelligent SSE with zero trust principles applied throughout the environment, businesses become more agile, reduce risk, and streamline solution deployment and maintenance. "DLP has been extremely complicated and cumbersome, and that's before you factor in cloud, web, email, private apps, and endpoints," said Frank Dickson, IDC Group Vice President, Security & Trust. "Netskope looks to address complexity with integration, providing a unified cloud delivered solution. Compared to old school network and endpoint-based DLP solutions, having DLP in this integrated solution makes it dramatically easier to protect data wherever it may be and in a manner that is frictionless for end users. It is a win-win." About Netskope Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data. The Netskope Intelligent Security Service Edge (SSE) platform is fast, easy to use, and secures people, devices, and data anywhere they go. Netskope helps customers reduce risk, accelerate performance, and get unrivaled visibility into any cloud, web, and private application activity. Thousands of customers, including more than 25 of the Fortune 100, trust Netskope to address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements.

Read More

DATA SECURITY

Futurex Announces Support for Google Cloud External Key Manager

Futurex | October 12, 2021

Futurex’s key management technology and Google Cloud EKM give customers more control over encryption keys to maximize data security, privacy, and compliance BULVERDE, Texas, October 12, 2021 — Futurex, a leader in hardened, enterprise-class data security solutions, today announced support for Google Cloud External Key Manager (EKM), giving customers more control over encryption keys. Google Cloud EKM gives users full separation between their data and encryption keys, enabling users to create, store, and manage their encryption keys in a third-party key management service (KMS) — such as Futurex’s key management servers (KMES). Users can turn to Futurex KMES Series 3, a FIPS 140-2 Level 3-validated key management enterprise server, or Futurex's VirtuCrypt cloud service to handle all cryptographic key lifecycle management to maximize data security, privacy, and compliance. “We continue to add security and flexibility for Google Cloud users, giving them full control of the location, distribution, and access of their externally-managed keys,” said Bahul Harikumar, Head of Infrastructure Security Partnerships at Google Cloud. “Google Cloud EKM and Futurex give users more security options and more control.” Futurex’s robust key management platform is globally available and highly scalable, providing a versatile, external key service using fully-validated HSM and cloud technology. In addition to solutions for Google Cloud External Key Manager, Futurex’s KMES Series 3 offers: Cloud key management Data protection Public key infrastructure (PKI) Certificate Authority (CA) Code signing Vaultless tokenization Integration with numerous 3rd-party applications and services “Google Cloud’s commitment to encryption is evidenced by its support for external key management partners and we are thrilled to support Google Cloud EKM with our FIPS 140-2 Level 3-validated systems,” said Ryan Smith, vice president, global business development, at Futurex. “Futurex’s centralized encryption makes everything easier by fulfilling multiple key management use cases in a single platform.” Futurex’s Google Cloud EKM can be deployed via Futurex on-premises key management servers, Futurex’s VirtuCrypt Cloud, or an on-premises/cloud hybrid. For more information on Futurex’s support for Google Cloud EKM, visit futurex.com. Google Cloud will be showcasing its Cloud EKM at its Google Cloud Next ‘21 conference, taking place October 12-14, 2021. About Futurex For more than 40 years, Futurex has been a trusted provider of hardened, enterprise-class data security solutions. More than 15,000 organizations worldwide, including financial services providers and corporate enterprises, have used Futurex’s innovative hardware security modules, key management servers, and enterprise-class cloud solutions to address their mission-critical systems, data security, and cryptographic needs. This includes the secure encryption, storage, transmission, and certification of sensitive data. For more information, please visit futurex.com.

Read More

WEB SECURITY TOOLS

Indusface Enhances its Web Application & API Protection (WAAP) platform AppTrana with Industry's First Risk-Based Protection to APIs

Indusface | May 19, 2022

Indusface, a leading application security SaaS company that continually detects security risks, provides real-time protection, and improves the performance of Websites and Applications, today announced that it is adding Risk-Based API Protection to its WAAP platform, AppTrana. APIs are the lifeline of the digital economy with many companies adopting the API-first approach. However, the growth of APIs is also opening up new risk vectors that they are not aware of. According to Gartner, more than 90% of applications have more attack surface exposed through API than UI and by 2022, API Abuse will move from an infrequent to the most-frequent attack vector, resulting in data breaches for enterprise web applications. Indusface is revolutionizing the API security space by building on its API Protection capabilities. The company is doing so through the most comprehensive API protection to date by extending its risk-based approach to the same. "AppTrana's risk-based approach is unique and something that resonates with our customers. What customers are really interested in is knowing how well their application is protected based on the risk posture of their application. Building on this, we are now enhancing our API Protection capabilities by providing a risk-based approach to API security which we believe would revolutionize the market. With this, customers will be able to identify vulnerabilities found in their public APIs and quickly correlate how these are protected through API-specific policies and positive security policies applied in AppTrana providing the most comprehensive protection for APIs." Ashish Tandon, Founder and CEO, Indusface As with any security, you can protect only what you know and protection is as strong as the weakest link. The major challenges with APIs are discoverability and the ability to understand the context of APIs so that security can be tailored accordingly. It is to address these challenges that Indusface is enhancing its API protection in AppTrana. Collectively through a multi-step approach, customers get to discover APIs, understand risk posture and ensure comprehensive protection of APIs. With Indusface AppTrana's Risk-based API Protection, you get: To understand the risk posture of the APIs through unlimited automated API scans including manual tests for identifying business logic vulnerabilities. This enables organization to understand the weakest links of the APIs and get clear visibility around how these links are protected. Visibility into API traffic patterns and discovery of shadow APIs, so that you are no longer blindsided by what you don't know To protect APIs with API-specific rules written specifically to protect against OWASP Top 10 API vulnerabilities Behavioral-based protection against DDoS attacks on APIs by analyzing API traffic pattern Behavioral-based protection against BOT attacks Positive security for APIs through analysis of swagger (OpenAPI 2.0) files and creation of automated positive security policies Accurate, real-time view of vulnerabilities blocked by API specific rules, positive security policies, custom rules, and those that need fixes in the application About Indusface Indusface is a leading application security SaaS company that secures critical Web, Mobile, and API applications of 3000+ global customers using its award-winning fully managed platform that integrates web application scanner, web application firewall, DDoS & BOT Mitigation, CDN, and threat intelligence engine. Indusface has been funded by Tata Capital Growth Fund II, is the only vendor to be named Gartner Peer Insights™ Customers' Choice' in all the 7 segments for Voice of Customer WAAP (Web Application and API Protection) Report 2022, is a "Great Place to Work" certified SaaS product company, is PCI, ISO27001, SOC 2, GDPR certified, and has been the recipient of many prestigious start-up awards such as the Economic Times Top 25, NASSCOM DSCI Top Security Company, Deloitte Asia Top 100, among others.

Read More

SOFTWARE SECURITY

ColorTokens Launches Xcloud, Autonomous Cloud Security Protection for All Enterprise Environments

ColorTokens | April 06, 2022

ColorTokens Inc., a leading innovator in autonomous Zero Trust cybersecurity solutions, announced the launch of its new product, Xcloud. Xcloud's agentless, automated, and deep scanning technology finds the most elusive threats across cloud and container environments fast and without disruption. Xcloud combines vulnerability management, malware detection, and compliance monitoring all in one platform, saving time, resources, and cost. Customers worldwide can now gain access to Xcloud directly from AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS). Today's enterprises are leveraging cloud technologies at a hyper-scale. According to the Gartner® Hype Cycle™ for Cloud Security, 2021, "By 2023, 70% of all enterprise workloads will be deployed in cloud infrastructure and platform services, up from 40% in 2020. By 2025, more than 99% of cloud breaches will have a root cause of preventable misconfigurations or mistakes by end-users." To address the unique challenges of cloud security — shortages of skilled staff, tools not designed for the cloud, limited or no visibility, and the inability to control cloud security — enterprises need simple, fast, agentless, and autonomous tools to provide the support they need. "In today's cloud era, it is widely embraced that cloud environments require agentless tools. But current tools for cloud security follow a fragmented approach, and these siloed point security tools cannot deliver end-to-end visibility on the comprehensive security posture of the enterprise business," says Rajesh Khazanchi, chief executive officer of ColorTokens. "ColorTokens now uniquely solves enterprise cloud security challenges, combining Xcloud with our comprehensive platform to bring unparalleled risk visibility, essential insights, and automation into the risks that threaten cloud and container environments." With nothing to install, deploy, or configure, Xcloud keeps you secure automatically. Xcloud uniquely allows security teams to find and fix the deepest risks in their cloud: Uncover more critical risks. Xcloud's ShadowScan™ dives deeper into workloads and containers at the OS level to detect vulnerabilities and risky configuration issues that are often missed. ShadowScan™ creates and scans a complete replica of workloads to eliminate disruptions, downtime, and impact to applications. Prevent supply chain attacks. Xcloud's ChainScan™ uncovers hidden vulnerabilities in critical application libraries and scans container and cloud workloads for all software dependencies. This allows enterprises to identify the risks introduced in third-party packages throughout their entire application software supply chain. Detect the latest threats. Xcloud automatically tracks the latest vulnerabilities and malware from multiple threat intelligence and vulnerability sources. Every security scan of environments uses a real-time database to find the latest threats so businesses can continuously detect and remediate new threats. "When compared to the two other leading solutions in the cloud security market, ColorTokens' Xcloud uniquely delivers brilliant ease of use and unmatched deep visibility into the cloud," says Harish Akali, CTO of ColorTokens. "As a result of Xcloud's automated, agentless, customer-obsessed approach, combined with its availability in AWS Marketplace, Xcloud delivers instantaneous onboarding and results and without any disruption." Ravi Pattabhi, VP of cloud security at ColorTokens To access Xcloud today, visit ColorTokens in AWS Marketplace. ABOUT COLORTOKENS ColorTokens Inc. is a leading innovator in SaaS-based Zero Trust cybersecurity solutions that provides global enterprises with a unique set of products and services for securing applications, data, and users across cloud and hybrid environments. Through its award-winning Xtended ZeroTrust™ Platform and context-aware machine learning-powered technologies, ColorTokens helps businesses accurately assess and improve their security posture dynamically.

Read More

Spotlight

Security information and event management (SIEM) tools offer more than just security. In fact, many organizations overlook some of the most useful aspects of SIEM technology, including fraud prevention and operations management.

Resources