Jack Naglieri

API keys are essential to connect applications, services, or data lakes together. Yet, they can also be a security risk. Imagine Alice sets up an API key to give her team or a vendor access to sensitive data—many times these keys are long-lived and often shared across different workloads. If the group uses federation, actions taken by Alice or others occur using a shared credential/role in the environment. This means logs would only show the credential conducting that activity, which again, gets shared with others who have access to the role. Alice's coworker, Bob, has their legitimate cloud credentials compromised. The threat actor uses Bob's credentials to federate into a shared credential/role in the environment. The threat actor exploits native features/functions of the cloud to appear as Bob, thereby blending their activity in to avoid detection. Most security teams today won't spot Bob's impersonator fast enough or at all. Trying to make sense of cloud logs is a real challenge, especially when it's happening in real-time. It can take hours or even days to piece together what happened. And by then, detection and response are delayed and the damage might already be done. What can you do? Security teams can start by keeping a detailed record of all identities, keys, tokens, certificates, and credentials they've provisioned and used, services accounts they have access to, what roles they assume. Then, security teams can set up what's considered "normal" access and behavior. Once the team understands “normal” behavior, they can develop rules and alerts from logs to try to detect and respond to access and behavioral anomalies. At Permiso, we have developed an identity-centric approach to cloud threat detection and response. Our solution can help security teams detect and respond to access and behavioral anomalies in the environments faster and with greater confidence from having the full session access and activity. Want to learn more? DM me or visit https://lnkd.in/gC4DUJ9j to learn about our approach to solving the challenge of detecting and responding to threats in and across IaaS, SaaS, CI-CD, IDP environments.

11

With vulnerabilities being exploited faster than ever, staying ahead of threats has become crucial. That’s where Horizon3.ai's Rapid Response service steps in! It's designed to alert you when your organization is at risk, allowing you to swiftly tackle N-day and zero-day vulnerabilities. Want to see how it works? Visit our site to learn how we can help you find, fix, and verify vulnerabilities before they're exploited — or come see the team at #RSAC2024 booth 4505 N!

1

You probably heard about BeyondTrust acquiring Entitle for ~$150 million. Here's the part you may not have heard: Co-founder Ron Nissim called his shot about IGA converging with PAM just over a year ago. I had the opportunity to interview Ron last year right before Entitle came out of stealth. One of the topics we talked about was the convergence of IGA and PAM use cases. At the time, he had a theory: "I have a theory that IGA and PAM are converging in the cloud. What's essentially been happening to us is that we've been solving a lot of [PAM] use cases. We can provide a lot of the things that customers need from PAM, like just-in-time, temporary access management." He may not have fully realized it then, but his theory was totally right. This early insight ended up being one of the main strategic drivers for BeyondTrust's acquisition of Entitle. Congratulations to the Entitle team! ___ Thanks again to Elizabeth Safran and Dean Pe’er for making this interview happen. The full discussion from February 2023 is available on my website if you want to revisit Entitle's journey from launch to acquisition.

109

17 Comments

Interesting case of Identity deprovisioning failure leading to $600k worth of stated loss suggested as human error. While there is generally claim to fame of automation getting heavily adopted across industry, this is the unfortunate brutal reality on ground. What’s the cost for reputational damage here for NCS? There could be so many basics to get this avoided: 1. Reinforce confidentiality 2. Access Reviews 3. Automate Offboarding Talk to us to know more and #stay #securred #ncs #hrworkflows #iam #integrations #identitybreach #priviledgedaccess https://lnkd.in/gKZGpJr5

6

[2-min Tech Talk] Secure Agentless BYOD Access via #CloudBrowser ➡ Providing VDI-like view (SaaS & Pvt Web apps w/ protected storage)  💪 with VDI++ controls (clipboard, watermarking etc. + DLP engine) 👉 but without requiring any addl agent   💲 and at a fraction of the cost of VDI ✨ while enabling Day-1 Access

81

Often, we get asked about when MFA Auth Methods are changed and where that is logged and what is updated. Great detailed article. https://lnkd.in/g_hP_GTA

10

🚨 PSA – BEC Tradecraft We have seen an uptick in adversaries using “,” or “.” as malicious inbox rule name then forwarding to the RSS Feeds folder. I’m not 100% sure why, but it may be a way to interfere with SIEM queries or manual data queries. It could also be some new script everyone is pulling from GitHub. Another tactic is the use of IPv6 addresses, likely to bypass IPv4 lookups. If anyone suspects they might have a BEC compromise, I highly recommend this excellent tool to dump forensic CSVs. Focus on the inbox rules output CSV: https://lnkd.in/ehha5hBP #cybersecurity #cloudsecurity #m365 #compromise #security #infosec #riskmanagement #incidentresponse

30

4 Comments

🚨 Aqua Security has uncovered a significant risk in Git-based Source Code Management (SCM) systems like GitHub, GitLab, and Bitbucket. Deleted or updated secrets—like API tokens and credentials—can persist in these systems, creating "phantom secrets." 🚨 Why This Matters To You Even if developers overwrite or delete these secrets, they can remain accessible. This vulnerability has led to major exposures, notably in high-profile projects like Mozilla and Cisco Meraki. Here's the scoop: when developers commit hard-coded secrets in SCMs and then overwrite or delete them, these secrets can still persist in the repository versions. This makes them easy prey for malicious actors, especially in open-source projects or public repositories. The Scanner Shortfall Most secrets scanners today can't effectively scan these buried files. They typically use the git clone command to snapshot and scan repositories, missing some files deep in the file system. However, attackers who know what to look for can find them. The Takeaway Developers should never commit code with hard-coded secrets. Regularly rotate secrets and view secrets management as a full SDLC challenge. At Akeyless, we focus on making secrets management seamless and secure for developers from day one. Our solution not only secures your development lifecycle but also simplifies it and massively reduces costs by removing the burden of servers and maintenance. Protect your enterprise from the hidden risks of phantom secrets. Learn how Akeyless can help you secure your development lifecycle from start to finish like our Fortune 500 clients. Read this compelling research today. #DevOps #DevSecOps #GitHub #GitLab #Bitbucket

12

Amplify detection capabilities with Recorded Future's Validated Sigma Rules, crafted by our research team to minimize false positives. Watch to see how to easily search, implement, and configure Sigma Rules without ever leaving Splunk.

2

I've said it for many years. Cyber maturity is simply a function of the talent and tenure of your team. All the maturity models, assessments, tools, and services in the world can't make up for the inability to attract and retain great cyber practitioners. Maturity starts from within.

71

7 Comments

The SoCal CISO Summit is only 3 weeks away! Don't miss this all-star lineup with Emily O'Carroll, Jonathan Chow, and Arthur Lessard, discussing "The Imperatives of PAM" on May 21st. Organizations have suffered relentlessly from cyberattacks, each week it seems there are new headlines highlighting ransomware attacks or data breaches. With the sensitivity of privileged accounts, unpatched vulnerabilities, and an extensive remote workforce, privileged access management (PAM) is essential to securing your most critical systems and data. Join this panel session to discuss: -Why PAM plays a crucial role in mitigating cyberattacks -Gaining executive buy-in on effective solutions -Having a proactive approach to implementation and configuration Qualified InfoSec leaders, register below! #evantaciso #socalciso #informationsecurity

54

4 Comments

Are you coming to RSA Conference? If so, join us at SCW Coffee Shop! Bluestone Lane SOMA Coffee Shop 55 2nd St, San Francisco, CA 94103 On May 6th | 12:30PM PST. Join Secure Code Warrior CTO & Co-Founder, Dr. Matias Madou, Jeffrey Martin from Mendio, John B. Dickson from Lasithi Security, and Viswanath S C. from Thales Digital Identity and Security to learn about: Incredible techniques for winning over developers and helping them prioritize security The challenges in measuring security skill development, and how to overcome them Why a developer-centric ‘Trust Score’ could be the missing piece of the compliance puzzle for every top organization and can unlock the benchmarks needed to reach new levels of risk reduction in code. https://lnkd.in/gMzG2WuJ

12

Software or application infrastructure is drowning in technology and security debt. The volume of those with significant debt for critical business or core operational functions is a challenge at many organizations. The challenges span confidentiality, integrity and availability.

2

🎤 Feature launch alert 🚀 🎉 You can now view all API calls across environments, apps and endpoints with user context in one space within the Levo.ai platform. You don't need to navigate multiple pages and applications to monitor API activity. Developers and security professionals waste precious time examining APIs scattered across all SDLC environments. More than a quarter of surveyed engineers reported spending 20+ hours working on APIs, much of which was dedicated to API debugging, inspection and monitoring activities. Similarly, cybersecurity professionals spend considerable time performing repetitive tasks needed to monitor APIs, detracting from their ability to drive business initiatives forward. That's why we've developed the Trace Explorer feature. It provides a single view into all API calls across environments, allowing developers and security professionals to focus on what truly matters. With Trace Explorer, API calls can be filtered based on: - API Methods - Application - API Paths - End-user context - Status codes, etc This makes it easier for security teams to identify, remediate, and prioritize API-related issues. Developers can also track active, dormant, and shadow APIs through status codes, ensuring that API sprawl doesn’t take root. #featurelaunch #cybersecurity #apisecurity #devsecops #startups

54

2 Comments

There are a lot more security data fabric startups than I realized! I wrote a post about this market in March and highlighted six companies who had raised capital or been acquired. I figured I was missing a few, but I had no idea how many. Over 100 comments later, my list of companies had nearly *doubled.* I wanted to do a follow-up post to include more companies since there is so much interest. Here's a quick summary of the companies I should have included the first time around: – Auguria is a security knowledge layer that automates the cleanup, classification, and ranking of security events and alerts to accelerate incident response and threat hunting. – Dassana was highlighted in Snowflake's Startup Spotlight series for its work as a partner building on Snowflake's Data Cloud. – DataBahn is a security data fabric and observability platform built by early Securonix team members, and the founding team's cybersecurity experience shows. The product has the full stack of security data focused features — from data observability to posture management — with pre-built security content. Their new AI features are going to set the standard for what's possible in this space. – DataBee is an internal startup in Comcast's Technology Solutions business unit. They've built a data transformation and content engine with use cases across security operations, GRC, vulnerability management, and more. – Paladin Cloud is a risk and prioritization focused solution that uses AI-powered risk scoring to identify threats from data collected across their security fabric. – Tenzir is an open source solution that gives security teams building blocks to create their own data pipelines. --- The security data fabric market has quickly become one of the most important and relevant new markets in cybersecurity. I'm planning a series of posts to dive in deeper, so more to come soon! ___ Note: I tightened up my definition of "security data fabric" a little more this time based on feedback from the last post. Cribl and Onum both get honorable mention here as relevant products in the space, just not 100% focused on security use cases. Avalor is a security data fabric company recently acquired by Zscaler. I only included non-acquired startups this time. I also miscategorized Synqly last time, but I still think it's an interesting product in the overall picture of security integrations.

174

60 Comments

For the last 6 months or so, I have been struggling with market definitions in identity and access management. I used to understand markets such as identity governance and administration and access management; I understood what the feature boundaries were; I could map vendors to those markets. But honestly, lately, I feel like those maps and those boundaries aren’t as accurate as they once were. So, in some regards, this post is my attempt to work through ways of defining what IAM looks like in the modern era, what parts should enterprises be willing to pay for, which are table stakes, and where is this all going. There is change in the air; people are willing to consider new solutions and new architectures. What follows is a reframing of the enterprise identity space, one not based on "classical" market definitions, instead one based on capabilities, and it starts with identifying the four major components to new world of identity: * Policy * Orchestration * Execution * Data Read the rest at Weave Identity https://lnkd.in/eu78FS5d

113

48 Comments

People are pretty good at finding vulnerabilities, but they're far too expensive to be spending their time hunting for TLS weaknesses and HTTP header misconfigurations 💵 What are some of the other vulnerabilities that we're better off leaving to automation? And what vulnerabilities do we still need a person to help find?

9

Join is for the next #CiNPA Security SIG meeting at Intrust IT this Thursday, June 20th, 2024 at 6:30 PM! CiNPA Security SIG is the #Cincinnati Networking Professionals Association Security Special Interest Group. Meetings typically consist of one or two main topics featuring live presentations or demonstrations promoting open and interactive group discussions. I'll be presenting "Software Security: The Critical Role of Software Bill of Materials (SBOM)" Get the details and register at the link below. I hope to see you Thursday night! #software #softwaresecurity #softwarebillofmaterials #infosec #cybersecurity #cybercrime #cyberwar

1

1 Comment

Today Oso is launching Distributed Authorization. WTH is that? Since starting Oso, we’ve seen massive demand from companies like Wayfair, Intercom, Productboard, Chief, and thousands of others who want to abstract authorization out of their applications. The problem is: that’s hard, because you can’t just pull out all the data you need for authorization and set it aside…you need it for the rest of your app to function, too. This is especially hard when you have multiple services or microservices. To date, the best option available has been to sync all that data to an authorization service. This is the Google Zanzibar model. That’s even what we did with the first version of Oso Cloud 🙈 But that was always a stepping stone for us – an intermediary state while we continued to harden the Oso service and build towards something better. Today we’re launching that something better, which we call Distributed Authorization. Distributed Authorization in Oso means you can now centralize shared permissions data in Oso Cloud and leave the rest of your data in your application databases. Oso then stitches this data together by integrating directly with your application database, starting with Postgres. You get the benefits of authorization as a service – abstracted, testable, observable, debuggable – without syncing all your data. Companies like Headway and Jasper are already taking advantage. Read our blog post for more detail: https://lnkd.in/ehqMwr9A

220

41 Comments