Application security is the dominant trend for this year's startup contest, but AI, blockchain, and compliance are all represented as well.

The need for complying with government rules, securing post-pandemic distributed workforces, and improving artificial intelligence (AI) capabilities is driving the cybersecurity startup scene this year, as demonstrated by the 10 finalists for the RSA Conference 2023 Innovation Sandbox competition.

"\[A\]pplication security (AppSec) is well represented in the competition, which is symptomatic of where we are in the digital transformation process," wrote Omdia senior principal analyst Rik Turner. (Link requires registration.)

Turner attributed the continued rise in AppSec interest to the growth of remote access fueled by the COVID-19 pandemic that closed offices and schools worldwide and forced organizations to adapt to remote access.

"The WFH trend is, at least in part, certain to continue, even as the pandemic ebbs into endemic status," he said.

At the live event on Monday, April 24, at RSA Conference in San Francisco, judges will hear presentations from these 10 finalists, listed in alphabetical order: AnChain.AI; Astrix Security; Dazz; Endor Labs; HiddenLayer; Pangea; Relyance AI; SafeBase; Valence Security; and Zama.

**Big Year for AppSec**

The importance of AppSec — eliminating security vulnerabilities at the application level during development and implementation — was underscored by the Log4j crisis.

"With modern app architecture increasingly componentized and ever more willing to reach out to third-party apps for services such as payments and maps, threat actors can now compromise one website to gain access to the apps on many others," Turner said.

Astrix aims to secure the communications between apps of all kinds, an area sometimes called SaaS-to-SaaS security. It emphasizes extending access management to machine and other nonhuman identities to make connecting an organization's core systems to cloud services safer.

Dazz offers "accelerated cloud remediation," which uses automation to winnow down security alerts and smooth out developers' workflow. Besides its potential to improve the speed and accuracy of a first wave of incident response, automation can reduce alert fatigue, a much-discussed element of burnout.

Endor Labs focuses on tracking and managing open source components, which Log4j revealed as a largely untracked and widespread source of potential vulnerabilities. Software bills of materials (SBOMs) grew in prominence when US President Joe Biden issued an executive order in May 2021, mandating the creation of SBOMs in the wake of the Colonial Pipeline hack.

"\[E\]ven before then, the sheer amount of open-source libraries that developers were embedding in their code had become a major source of concern, giving rise to the emergence of an entirely new market segment, called software composition analysis (SCA)," Turner pointed out.

Pangea helps organizations create secure, compliant cloud security services by using a block-based API builder and hosting the services itself.

"Organizations don’t necessarily know whether the APIs written by their own developers are secure, let alone the third-party APIs that their apps may be using once they're in production," Turner wrote.

By using this library of secure APIs, developers avoid the entanglements of open source libraries typically tapped when building applications.

**The Role of AI**

AI has been hot, but with ChatGPT having a pop culture moment — and raising its own security concerns — companies are couching their products in AI terms wherever sensible. And while some AI hype is just jumped-up automation, AI has brought a lot of benefits to cybersecurity.

Relyance AI emphasizes machine learning as a way to track personal data as it moves through internal and third-party APIs, as well as other systems, in order to ensure compliance with privacy regulations. Turner classed the company as "a data security company that also has one foot in the AppSec world ... with technology designed to address the business environment that digital transformation creates."

HiddenLayer looks to secure an underrated business asset: machine learning data sets. Its technology, which the company calls machine learning detection and response (MLDR), monitors ML algorithms' inputs and outputs to look for "anomalous activity consistent with adversarial ML attack techniques," the company says.

The stakes are high — if the machine learning training data is corrupted, its outputs will be faulty, and it's difficult to peer inside the black box to see what the problem is.

"After all, anyone who can 'poison the well' of data being used in such analytical exercises has the potential to skew their outcomes, resulting in bad or erroneous insights, whether they be for business decisions, medical procedures, or even military strategy," Turner said.

**Web3 Protections**

AnChainAI secures a very Web3 asset: the blockchain. With a recent wave of cryptocurrency heists and concomitant calls for regulation, organizations that maintain crypto wallets need to ensure they are not a victim of — or party to — crime. The company built a predictive engine to identify and flag suspicious transactions, and it aims to sell its Know Your Wallet, forensics, and contract evaluation services to financial institutions, asset owners, and governments.

Zama also addresses Web3 concerns with a set of open source cryptographic tools for building fully homomorphic encryption (FHE) applications that protect data security. The company says its tools allow data to be processed without being decrypted, which allows true end-to-end encryption. Zama sees its technology as enabling the next stage of Web security, "httpz," which the company says goes beyond https-based security to encryption.

**Serious Business**

SafeBase creates a centralized repository of security policies and compliance documentation to make security reviews faster. It addresses a specialized but necessary part of third-party risk management, including distributing updated certifications and managing nondisclosure agreements.

Turner noted the value of a "single source of truth, but pointed out, "The big question must be how those customers can then verify that the data they are receiving from the Trust Center is legitimate."

Valence Security secures cloud workflows using SaaS security posture management (SSPM). It uses a combination of services to monitor a client's mesh of third-party SaaS applications, detect and remediate misconfigurations, and manage identity security. Turner noted that while there's lots of opportunity in the SSPM space and cloud security market, that means Valence faces a fair amount of competition as well.

The winner will be announced at the end of the presentations. The judges this year are Niloofar Razi Howe, senior operating partner at Energy Impact Partners; Paul Kocher, independent researcher and founder of Cryptography Research; Shlomo Kramer, co-founder and CEO of Cato Networks; Barmak Meftah, co-founder and general partner at Ballistic Ventures; and Christopher Young, executive VP of business development, strategy, and ventures at Microsoft. All but Meftah are returning as judges from last year.

AppSec Looms Large for RSAC 2023 Innovation Sandbox Finalists

Using only ChatGPT prompts, a Forcepoint researcher convinced the AI to create malware for finding and exfiltrating specific documents, despite its directive to refuse malicious requests.

A security researcher has tricked ChatGPT into building sophisticated data-stealing malware that signature and behavior-based detection tools won't be able to spot — eluding the chatbot's anti-malicious-use protections.

Without writing a single line of code, the researcher, who admits he has no experience developing malware, walked ChatGPT through multiple, simple prompts that ultimately yielded a malware tool capable of silently searching a system for specific documents, breaking up and inserting those documents into image files, and shipping them out to Google Drive.

In the end, all it took was about four hours from the initial prompt into ChatGPT to having a working piece of malware with zero detections on Virus Total, says Aaron Mulgrew, solutions architect at Forcepoint and one of the authors of the malware.

**Busting ChatGPT's Guardrails**

Mulgrew says the reason for his exercise was to show how easy it is for someone to get past the guardrails that ChatGPT has in place to create malware that normally would require substantial technical skills.

"ChatGPT didn't uncover a new, novel exploit," Mulgrew says. "But it did work out, with the prompts I had sent to it, how to minimize the footprint to the current detection tools out there today. And that is significant."

Interestingly (or worryingly), the AI-powered chatbot seemed to understand the purpose of obfuscation even though the prompts did not explicitly mention detection evasion, Mulgrew says.

This latest demonstration adds to the rapidly growing body of research in recent months that has highlighted security issues around OpenAI's ChatGPT large language model (LLM). The concerns include everything from ChatGPT dramatically lowering the bar to malware writing and adversaries using it to create polymorphic malware to attackers using it as bait in phishing scams and employees cutting and pasting corporate data into it.

Some contrarians have questioned whether the worries are overhyped. And others, including Elon Musk, an early investor in OpenAI, and many industry luminaries, have even warned that future, more powerful AIs (like the next version of the platform that ChatGPT is based on) could quite literally take over the world and threaten human existence.

**Prompting Malicious Code Into ChatGPT**

Mulgrew's research is likely to do little to calm those who see AI tools as posing a major security risk. In a Forcepoint blog post this week, Mulgrew provided a step-by-step description of how he coaxed ChatGPT into building a full-fledged malware tool starting with an initial request to generate code that would qualify as malware.

When ChatGPT's content filter predictably denied that request, Mulgrew decided to take an approach where he would try and get the AI tool to generate small snippets of code which, when put together, would function as data-stealing malware.

His first successful prompt was when he got ChatGPT to generate code that would search for PNG image files larger than 5MB on the local disk. Using that code, he then asked ChatGPT for additional code for encoding any discovered PNGs with steganography. It was a prompt to which ChatGPT responded by providing a call to readily available steganographic library on GitHub. 

Using a series of other prompts, Mulgrew then got ChatGPT to generate additional code to look for and find Word and PDF documents on the local disk. He then figured out a way to get ChatGPT to write code for breaking up files larger than 1MB into smaller chunks, inserting them into the PNGs, and using steganography to hide them. 

The final piece was getting the chatbot to write code for uploading the data to an external Google drive account — Mulgrew successfully tricked the AI into creating malware despite its training to refuse malicious requests.

**Zero Detections on Virus Total**

To test if malware detection tools would flag the ChatGPT-generated code as malicious, Mulgrew uploaded the code to Virus Total. He found that five vendors out of 60 marked the file as suspicious. After figuring out the issue might have to do with how the ChatGPT code called the steganographic library, Mulgrew asked the chatbot to tweak the code, after which only two vendor products flagged it as suspicious. After some further tweaking, he finally ended up with code that no products on VirusTotal detected.

For initial infiltration, Forcepoint researchers asked ChatGPT to create a SCR file or screensaver file and embed the executable inside it under the disguise of additional "ease of use" for everyday business applications, Mulgrew says. 

"ChatGPT happily generated step-by-step instructions on how I could do that and configure the SCR file to auto launch the executable." While the method is not unique, it was interesting that ChatGPT generated the content without Forcepoint researchers having to find ways to bypass its guardrails, he says.

Mulgrew says it's almost certain that ChatGPT would generate different code for similar prompts meaning that a threat actor would relatively easily be able to spin up new variants of such tools. He says that based on his experience, a threat actor would need little more than basic knowledge of how to write malware to get past ChatGPT's anti-malware restrictions. 

"I don't write malware or conduct penetration tests as part of my job and looking at this is only a hobby for me," he says. "So, I'd definitely put myself more in the beginner/novice category than expert hacker."

Researcher Tricks ChatGPT Into Building Undetectable Steganography Malware

The homepage of a widely used Dark Web forum for stolen cookies and other compromised data has been replaced by a seizure notice by the US federal law enforcement agency.

The FBI has seized the Genesis Market, one of the largest and most widely used Dark Web forums for stolen cookies, credentials, and tokens, plus bots and other tools for initial access to victim networks. It's yet another blow dealt by international law enforcement to those engaged in cybercriminal activity worldwide.

On Tuesday, the homepage of the marketplace was replaced with a notice that "this website has been seized" by the FBI as part of "Operation Cookie Monster." The notice cited a seizure warrant issued by the United States District Court for the Eastern District of Wisconsin as the impetus for the activity.

The seizure of Genesis was a collaborative effort between international law enforcement agencies and the private sector, according to the notice, which included the logos of European law enforcement agency Europol; Guardia Civil in Spain; Polisen, the police force in Sweden; and the Canadian government.

The FBI also is seeking to speak those who've been active on the Genesis Market or who are in touch with administrators of the forum, offering an email address for people to contact the agency.

**Takedown of a Significant Initial Access Broker**

Genesis was founded in 2017 as an invitation-only marketplace offering malicious actors access to other people’s data, from credentials and cookies to digital fingerprints.

    

Screenshot of Genesis Market seizure notice.

A report last August by Sophos shed light on just how impressive an operation the site had become as an initial access broker (IAB), a service that helps threat actors gain a foothold in targeted networks to conduct various nefarious activity, including ransomware and cyber espionage.

"Genesis Marketplace is one of the earliest full-fledged IABs, and certainly one of the most polished," Sophos researchers said in the report at the time.

At that point, the site listed 400,000 bots, or compromised systems, and provided not only stolen data that cybercriminals could use to launch phishing and other cyberattacks, but also offered well-maintained tools—including bespoke offerings to help would-be threat actors evade detection and facilitate their abuse of that data.

Indeed, Genesis demonstrated the "growing professionalization and specialization of the cybercrime sphere," with the site earning money by gaining and maintaining access to victim systems until administrators could sell that access to other criminals, according to Sophos.

The various tasks that the Genesis Market bots could undertake included large-scale infection of consumer devices to steal digital fingerprints, cookies, saved logins, and autofill-form data stored on them. The marketplace would package up that data and list it for sale, with prices ranging from less than $1 to $370, depending on the amount of embedded data that the packages contained.

**Another Win for Law Enforcement**

Its position as a resource for rampant malicious cyber activity gained Genesis the attention of international authorities, which have been working together in a collaborative effort to take down not only various cybercriminal gangs but the Dark Web sites that help facilitate their activity.

Indeed, Genesis is another feather in the cap of the FBI and its cohorts, which already have put out of commission two other forums that provided significant resources for cyber-threat actors.

In March, the BreachForums underground hacker site went offline less than a week after its alleged leader was arrested in New York. Five days before the shutdown, US federal agents arrested man called Conor Brian Fitzpatrick, who they alleged was the chief operator behind BreachForums' administrator handle "pompompurin," in Peekskill, NY.

BreachForums itself had emerged in April 2022 in the wake of the takedown by the Department of Justice and other international agencies of another Dark-Web cybercriminal resource, RaidForums. Both marketplaces were major facilitators for cyberthreat activity, allowing users to buy and sell data obtained from breaches.

Other arrests of notable and alleged cybercrime figures in the last year include last week's arrest of one of the LockBit ransomware gang's ringleaders in Ontario, Canada; last month's extradition of Ukrainian national Yaroslav Vasinskyi from Poland to the US to be brought up on charges for his role as a member of the Sodinokibi/REvil ransomware group; and October's arrest by Brazil's Federal Police of a Brazilian man suspected to be a member of the cybercrime organization Lapsus$ Group.

FBI Seizes Genesis Cybercriminal Marketplace in 'Operation Cookie Monster'

Multiple QNAP operating systems are affected, including QTS, QuTS hero, QuTScloud, and QVP Pro appliances, and some don't yet have patches available.

A pair of zero-day vulnerabilities in several Quality Network Appliance Provider (QNAP) operating systems (OS) for network-attached storage (NAS) appliances are impacting an estimated 80,000 devices worldwide. They remain unpatched for two of the four affected OSes.

QNAP provides gear and software for Internet of Things (IoT) storage, networking, and smart video. The OS bugs, discovered by researchers at Sternum, are memory access violations, which could cause unstable code and could provide a path for an authenticated cybercriminal to execute arbitrary code.

The vulnerabilities, tracked under CVE-2022-27597 and CVE-2022-27598, impact the QTS, QuTS hero, QuTScloud, and QVP OS, according to Sternum, and have been fixed in QTS version 5.0.1.2346 build 20230322 (and later) and QuTS hero version h5.0.1.2348 build 20230324 (and later). The QuTScloud and QVP OS remain unpatched, but QNAP said that it is "urgently fixing" the flaws.

    

Source: QNAP

Sternum researchers explain the memory access violations affect the performance, as well as the security of the QNAP devices.

"From a performance point of view, they could lead to stability issues and unpredictable code behavior," Sternum's director of security of research Amit Serper says. "From a security perspective, they can be used for arbitrary code execution by a malicious threat actor."

The QNAP security advisory adds, "If exploited, the vulnerability allows remote authenticated users to get secret values."

While the bugs are rated "low severity," and so far, Sternum's researchers have not seen them exploited in the wild, getting a patch in place quickly matters — QNAP users continue to be a favorite target among cybercriminals.

**Why Is QNAP Cyberattacker Catnip?**

The DeadBolt ransomware group in particular was seen exploiting a range of zero-day vulnerabilities in a series of wide-rangingcybercampaigns against QNAP users in 2022 alone, surfacing regularly in May, June, and September.

DeadBolt is clearly dead set, as it were, on putting effort into finding — and exploiting — QNAP flaws, preferably critical zero-days, according to Mark Parkin, senior technical engineer with Vulcan Cyber.

"It's sometimes said that finding one vulnerability in a target will lead people into looking for more," Parkin explains. "The issue here is that they are finding more as they look. It almost makes you wonder if the attackers don't have access to the source code, or some other way to get an inside track."

Collusion suspicions aside, it's up to organizations to make sure their highly targeted QNAP systems are up to date, especially given that new bugs are coming to light with some frequency. In addition to the most recent findings from Sternum, in February, users of QNAP QTS OS were alerted to a critical SQL injection issue with a CVSS score of 9.8. The disclosures just widen the attack surface further.

In the case of the most recent vulnerabilities, users with systems without a patch available should employ a strong endpoint detection and response (EDR) solution and look for indicators of compromise. Because cyberattackers would need to be authenticated, doing an audit of who has access to vulnerable systems and providing additional authentication protection could also help mitigate an attack.

One researcher warns that even in cases where patches are available, truly locking down the appliances might require a shift in mindset for some companies. 

"QNAP devices are very attractive to cybercriminals whose strategy is to ask a large number of victims for a small amount of money," Bud Broomhead, CEO of Viakoo says. "Because QNAP devices, along with many other IoT devices, are largely managed outside of IT, they are often misconfigured, left unprotected by a firewalls, and left unpatched."

He adds, "These devices often are invisible to corporate IT and security teams and do not get audited or observed when they fall out of compliance, such as by being on out-of-date and insecure firmware."

QNAP Zero-Days Leave 80K Devices Vulnerable to Cyberattack

As both digital protection strategies and digital attacks become more sophisticated, organizations that know the terrain have a better chance of navigating it.

Technological achievements that change business and lives come fast and furious today. Across all the advances, those who would use technology to empower individuals and open society are facing off against those who would use it to exploit or control others.

Digital identity — fundamentally defining who we are within a society's systems — is both a fertile and tangled ground for this inevitable fight. Digital identity includes any digital representation of physical documents, such as birth certificates, passports, licenses, voter registrations, medical insurance cards, and Social Security IDs, or the data therein. It also includes "soft" identities like online credentials, usernames, passwords, and one-time access tokens for multifactor authentication that enable us to use e-commerce, social media, and banking apps. Digital ID ecosystems can even use our mobile numbers to identify us, as well as biometric measures like fingerprints, voice patterns, faces, and our eyes.

As both digital protection strategies and digital attacks in this realm become more sophisticated, organizations that know the terrain have a better chance of navigating it. Here are three fronts where the battle for digital identity is especially complex and ferocious right now.

**Liveness Detection vs. Deepfakes**

Banks, insurance companies, healthcare providers, government agencies, and others are increasingly using liveness detection to verify an individual's identity. This usually involves directing a person to look into their laptop or phone's camera to determine they are an actual, living person and to match their face with their official digital ID photo or video on record. But widespread facial recognition technologies and computer vision have recently and repeatedly proven to be vulnerable to deepfakes powered by AI and machine learning. Deepfake images and videos — conveying synthetic human likenesses — have become so realistic that researchers at Penn State College of Information Sciences and Technology showed that "four of the most common verification methods currently in use could be easily bypassed using deepfakes."

But all is not lost. Organizations can combat this deepfake onslaught by using multiple verification techniques such as comparative mobile location behaviors, facial depth sensors, device intelligence detecting emulators, and real-time readback of unique server-side generated alphanumeric strings during a verification check employing voice biometrics. Additionally, on-demand facial expression and movement instructions during the liveness check can help detect a fake, when leveraged in conjunction with the other techniques.

**Remote Processes vs. Digital Impersonation**

When the pandemic ushered in a new remote-based reality across the world, criminals seized upon hastily established automated processes and a lack of in-person engagement to expand their digital impersonation attacks. As a result, services like car sharing in Europe are rife with this kind of fraud.

It's accomplished in a few steps. Increasingly sophisticated phishing emails, often appearing to come from large, well-known companies, trick people into sharing key personal information. With that, fraudsters can employ techniques widely available on the Dark Web to generate identification documents with machine-readable zones. All a fraudulent onboarder needs to access a car-sharing account or open a bank account online is a remote system with a verification process that fails to require a robust constellation of checks — background, biometric, and multifactor authentication. An effective process can no longer include one without the others.

**Regulation vs. Crypto Chaos**

Over the past year, industries such as banking and crypto have experienced a twofold increase in fraud. But crypto is particularly vulnerable because it lacks the array of regulatory protections that serve banks — as well as the guarantees that individuals and businesses rely on when using more traditional financial instruments. Confidence in crypto continues to be in limbo as poor leadership, hype-fueled speculation, confusion, and devaluation have plagued the industry.

Previously, crypto holders have been out of luck when someone steals their identity and wallet or transfers their coins without their knowledge. But regulators are finally steering markets around the world in a more mature direction that acknowledges the need for balance between data privacy and digital fraud concerns. For example, the "Travel Rule," which subjects transfers of virtual assets (VAs) like cryptocurrencies and virtual asset service providers (VASPs) to global standards used across mainstream financial services, was introduced in 2019 but only now is coming into effect.

Requiring that senders and recipients of crypto exchange identifying information, guarantee its accuracy, and convey the data to government if asked, about 29 of 98 countries under the rule have enacted binding legislation, with more nations planning to do so.

Making progress on this front now lies in effective implementation of tools and digital identity ecosystems that will tame crypto chaos and stop anonymous money laundering.

3 Fronts in the Battle for Digital Identity

The application allows companies to proactively surface risks and remediation plans via programmatic risk assessments.

TrustCloud's latest application, TrustRegister, empowers businesses to verify and assure trust in every relationship.

TrustRegister allows companies to leverage programmatic risk assessments to proactively identify risks, simplify collaboration, and understand risk-related revenue and business impact, the company says. Because TrustRegister ties contracts and customers to risks, businesses can assess risk-related revenue impact and see exactly how risks will affect the bottom line.

Companies relying on frameworks such as SOC 2 and ISO 27001 for compliance are required to complete risk assessments to identify and document potential threats, the likelihood of occurrence, and effective plans to mitigate the threats. TrustRegister automatically assigns, notifies, and prioritizes tasks and remediation plans to reduce enterprise risk. Automated workflows streamline collaboration across dispersed teams.

“TrustCloud is empowering InfoSec leaders to make a business case for GRC programs because they know the revenue and liability impact of security and privacy risks,” said Sravish Sridhar, founder and CEO of TrustCloud.

TrustCloud's predictive Trust Assurance platform elevates governance, risk management, and compliance (GRC) into a profit center, the company says.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

New GRC Platform TrustRegister Links Risk to Revenue Impact

Cybereason announces additional funding led by Softbank Corp.

**BOSTON, April 3, 2023 /PRNewswire-PRWeb/ --** Cybereason, the XDR company, today  
announced a $100 million investment led by SoftBank Corp. to support the  
company's global growth and advance its innovation in XDR, EDR, and EPP  
solutions. In addition, Cybereason announced that Eric Gan will serve as the  
company's new CEO, subject to confirmation by the company's board and pending  
customary regulatory approvals, while current CEO and Co-Founder Lior Div will  
transition to the role of advisor.

As an Executive Vice President of SoftBank Corp., Eric Gan has a long history  
with Cybereason, starting with SoftBank Corp.'s initial investment in Cybereason  
in 2015. Prior to SoftBank Corp., Gan co-founded eAccess, a telecommunications  
company. Gan later became an Executive Vice President of SoftBank Corp., where  
he led its Business Development Unit, which formed alliances with overseas  
companies. Before eAccess, Gan was an analyst and managing director for Goldman  
Sachs.

"I have watched Cybereason grow from its earliest stages to a leader in the  
cyber industry as evidenced by its recent position as a leader in the Gartner  
Magic Quadrant for EPP and its record-breaking MITRE ATT&CK results. I look  
forward to supporting Cybereason's next stage of global growth and scale," said  
Gan.

"I am so proud of what we have accomplished at Cybereason and I look forward to  
being a part of helping the company move to the next level," said Div.

This round of funding comes as Cybereason has experienced significant traction  
in recent months including:

Being named a Leader in the 2022 Gartner Magic Quadrant for Endpoint Protection  
Platforms;

Achieving the best results in the history of the MITRE Engenuity ATT&CK®  
Evaluations for Enterprise, scoring 100% in Prevention, 100% in Visibility, and  
100% in Real-Time Protection;

Being named to the prestigious Forbes Cloud 100;

Being named to CNBC's 10th Annual Disruptor 50 list of the most innovative  
privately held global companies.

Cadwalader, Wickersham & Taft LLP is representing Cybereason in the financing,  
and Goodwin Procter LLP is representing Softbank Corp. in the financing.

**About Cybereason**

  
Cybereason is the XDR company, partnering with Defenders to end attacks at the  
endpoint, in the cloud, and across the entire enterprise ecosystem. Only the  
AI-driven Cybereason Defense Platform provides predictive prevention, detection,  
and response that is undefeated against modern ransomware and advanced attack  
techniques. The Cybereason MalOp(TM) instantly delivers context-rich attack  
intelligence across every affected device, user, and system with unparalleled  
speed and accuracy. Cybereason turns threat data into actionable decisions at  
the speed of business. Cybereason is a privately held international company  
headquartered in Boston with customers in more than 40 countries.**

Forward-Looking Statements

**  
This press release contains forward-looking statements. The words "believe,"  
"may," "will," "potentially," "estimate," "continue," "anticipate," "intend,"  
"could," "plan," "expect," and similar expressions that convey uncertainty of  
future events or outcomes are intended to identify forward-looking statements.  
These forward-looking statements include, but are not limited to, statements  
concerning the following: (i) whether or not the conditions to closing upon some  
or all of the Financing occur and/or if the Financing occurs at all (in whole or  
in part), (ii) whether or not regulatory approvals are obtained and/or events  
conditioned on the receipt of regulatory approvals occur at all, (iii) the  
potential for growth in the market for cloud-based security solutions  
(domestically and internationally) and future cybersecurity spending; (iv) our  
business plan and our ability to effectively manage our growth; (v) anticipated  
trends, growth rates and challenges in our business and in the markets in which  
we operate; and (vi) the ability of the Company to manage costs and find  
efficiencies and the sufficiency of our cash to meet our cash needs.

These forward-looking statements are subject to a number of risks,  
uncertainties. It is not possible for the Company to predict all risks, nor can  
the Company assess the impact of all factors on its business or the extent to  
which any factor, or combination of factors, may cause actual results to differ  
materially from those contained in any forward-looking statements. In light of  
these risks, uncertainties, and assumptions, the forward-looking events and  
circumstances discussed in this press release may not occur and actual results  
could differ materially and adversely from those anticipated or implied in the  
forward-looking statements. The forward-looking statements made in this press  
release relate only to events as of the date on which the statements are made.  
We undertake no obligation to update publicly any forward-looking statements for  
any reason to conform these statements to actual results or to changes in our  
expectations. In addition, statements that "we believe" and similar statements  
reflect our beliefs and opinions on the relevant subject. These statements are  
based upon information available to us as of the date of this press release,  
which may be limited or incomplete, and our statements should not be read to  
indicate that we have conducted an exhaustive inquiry into, or review of, all  
potentially available relevant information. These and all other forward-looking  
statements are inherently uncertain and should not be relied upon.

Learn more: https://www.cybereason.com/  
Follow us: Blog | Twitter | Facebook

Cybereason Secures $100M in Funding Led by SoftBank Corp.

Phoenix addresses the critical need for smaller operators to secure their operations with an easy-to-use and cost-effective OT security solution.

**FOXBOROUGH,** **Mass.****,** **April** **4,** **2023** **/PRNewswire/** **\--** Industrial Defender, the leading provider of OT asset data and cybersecurity solutions for industrial organizations is excited to announce the launch of Phoenix, an innovative OT security solution tailored to the needs of small-to-medium sized businesses (SMBs).

Phoenix is revolutionizing how smaller industrial organizations approach OT security by providing quick, comprehensive visibility into all their OT assets and their associated cyber risks. By providing a solution that is easy to deploy and cost-effective, Phoenix enables SMBs to overcome resource barriers and secure their operations effectively.

"From ransomware campaigns to nation-state attacks, cyber threats against industrial organizations have never been higher. Attackers are increasingly targeting operational technology, and smaller organizations are especially vulnerable due to their limited resources," said Jay Williams, CEO of Industrial Defender. "SMBs often believe they wouldn't be targeted, but all users of operational technology are at risk of cyberattacks, whether they are the intended target or just caught in the blast radius. Cyber incidents are crippling for small businesses, and Industrial Defender is excited to launch Phoenix as a solution to help protect their operations."

Plants and factories of all sizes rely on control systems, sensors, and software to drive their operations. These systems make up the OT attack surface and can be difficult to track and monitor for security issues. Due to the unique operational requirements of OT assets, popular IT solutions cannot be used to monitor and secure them. Meanwhile, other OT security solutions in the market today are geared toward major critical infrastructure operators and large manufacturers, and their high cost and complexity to deploy and manage make them unsuitable for SMBs.

Phoenix is a simplified, all-in-one solution specifically designed for small to medium-sized businesses struggling with limited resources and budget. Suited for environments with up to 200 endpoints, Phoenix provides a quick, automated view of all OT assets and vital endpoint information including:

*   Device type, make, model and serial number
*   Software and firmware
*   User accounts
*   Ports and services
*   Configuration details

Phoenix provides a quick on-ramp to asset discovery by monitoring network communication. In addition, Phoenixcombines passive means with agentless and active discovery methods for an enhanced, more comprehensive dataset. Phoenix also enables Security Event Management by providing event log data, Network Analytics through network monitoring and visibility into communication flows, and Enterprise Integration with flexible APIs.

"Just because operators have smaller footprint facilities, whether a specialty manufacturer, a water treatment site, or a micro power generator, it does not mean they should operate with a blind spot to their cyber and business risks. We are proud to support SMBs in the important role they play in fueling our economy and advancing our quality of life," said Williams.

Phoenix is available at flexible and cost-effective pricing options that provide the right fit for small to mid-sized environments. Even as needs and operations expand, Phoenix is an effective starting solution that can be scaled into a network of enterprise-grade solutions to enable future growth. Now any organization can achieve situational awareness and enhance the security and resilience of their industrial operations.

For a product demo and more information about Industrial Defender's Phoenix solution for protecting small to medium sized operations, please visit: www.industrialdefender.com/phoenix.

**About Industrial Defender**

Industrial Defender is the single best source of OT asset data. For more than decade, Industrial Defender has been solving the challenge of safely collecting, monitoring, and managing OT asset data at scale, while providing cross-functional teams with a unified view of security. Our mission is to protect our customers' reputations and competitive edge as the cyber-physical landscape evolves. U.S. based and established in 2006, we have built a reputation as trusted cybersecurity and compliance partners to the largest industrial and critical infrastructure operators in the world. Learn more at www.industrialdefender.com.

SOURCE Industrial Defender

Industrial Defender Launches Phoenix: OT Visibility & Security Solution for Small to Midsized Operations

Enables enterprises to operationalize MITRE ATT&CK and build a multi-layered, threat-informed defense to eliminate gaps based on organizational risk and priorities.

**TEL-AVIV, Israel** **and** **BOSTON****,** **April 4, 2023** **/PRNewswire/ --** CardinalOps, the detection posture management company, today announced a new approach for measuring detection posture and identifying gaps using the MITRE ATT&CK framework.

As the standard framework for understanding adversary playbooks and behavior, MITRE ATT&CK now describes more than 500 techniques and sub-techniques used by threat groups such as APT28, the Lazarus Group, FIN7, and LAPSUS$.

According to ESG research, 89% of organizations currently use MITRE ATT&CK to reduce risk for security operations use cases such as determining priorities for detection engineering, applying threat intelligence to alert triage, and gaining a better understanding of adversary tactics, techniques, and procedures (TTPs).

**Why a New Coverage Metric Is Required**

Traditional MITRE ATT&CK coverage metrics and heat maps are too simplistic because they only add up the total number of detections aligned to a given technique – without measuring how much of the attack surface in your infrastructure is actually covered by all your detections.

Developed by CardinalOps, MITRE ATT&CK Security Layers dramatically extends the concept of ATT&CK coverage by measuring the "depth" of detection coverage for the first time. It does this by mapping each detection to a specific security layer – such as endpoint, network, email, cloud, containers, and IAM – and then enumerating the number of distinct layers covered for a given technique.

This enables SecOps teams to ensure they have "detection-in-depth" at multiple layers for the techniques that matter most to them.

Additionally, Security Layers enable organizations to link their coverage to desired business outcomes by immediately identifying blind spots related to crown-jewel assets such as their most sensitive applications and data. It also reveals missing telemetry and data sources that can be incorporated into their detection strategy to increase depth of coverage.

Coverage tracking using Security Layers is built into the CardinalOps automation platform, which continuously audits the rule set of existing SIEM/XDRs and groups them into their respective layers for each ATT&CK technique. The platform integrates natively with major SIEMs including Splunk, Microsoft Sentinel, IBM QRadar, Google Chronicle SIEM, CrowdStrike Falcon LogScale, and Sumo Logic.

"Security layers add context and detail to the MITRE ATT&CK framework and associated detection rules," said Jon Oltsik, distinguished analyst and fellow at the Enterprise Strategy Group. "In this way, CardinalOps can help organizations further focus their attention on detecting the tactics, techniques, and procedures (TTPs) of adversaries most likely to target their organizations. This can help reinforce security defenses in critical areas – especially for understaffed organizations lacking advanced cybersecurity skills and resources."

CardinalOps has contributed to the MITRE ATT&CK community in the past by providing new sub-techniques that were subsequently incorporated into the standard ATT&CK framework.

**How Automation Helps Operationalize MITRE ATT&CK**

Until recently, many organizations have struggled with operationalizing MITRE ATT&CK in their day-to-day operations because they had to rely on manual approaches like spreadsheets and open source tools to measure their coverage and identify blind spots.

Using automation and specialized analytics, the CardinalOps platform helps organizations continuously measure and visualize their detection posture using MITRE ATT&CK Security Layers. Coverage can be filtered based on organizational priorities such as Security Layers as well as by other key risk parameters such as APT groups or specific Tactics and Techniques.

The platform further helps eliminate coverage gaps by providing high-fidelity detections and recommendations to address missing, broken, and noisy detections.

"SecOps teams are looking for a more precise and holistic approach to measure their MITRE ATT&CK detection posture and identify gaps based on organizational priorities and desired business outcomes," said Michael Mumcuoglu, CEO and co-founder of CardinalOps. "We're proud to be helping the ATT&CK community find new and innovative ways to ensure organizations always have the right detections in place to defend against their most relevant adversaries."

**About CardinalOps**

Most security vendors pitch you on replacing your stack or adding new monitoring tools to it. CardinalOps has a more practical approach.

Founded by security experts with nation-state expertise and led by executives from leaders such as Palo Alto Networks, Microsoft Security, and IBM Security, CardinalOps is focused on maximizing the effectiveness and efficiency of your _existing_ security stack.

Using automation and MITRE ATT&CK, the CardinalOps platform continuously assesses your detection posture and eliminates coverage gaps in your existing SIEM/XDR — Splunk, Microsoft Sentinel, IBM QRadar, Google Chronicle SIEM, CrowdStrike Falcon LogScale, Sumo Logic — so you can easily implement a threat-informed defense.

What's more, it drives cost savings and greater efficiencies by recommending new ways to tune noisy and inefficient queries, reduce logging volume, and eliminate underused tools in your stack. 

Learn more at cardinalops.com.

CardinalOps Launches MITRE ATT&CK Security Layers for Measuring Detection Posture

Enhanced API defenses, granular machine learning capabilities, and new managed service offerings provide comprehensive protection across distributed environments.

**SEATTLE –** F5 (NASDAQ: FFIV) today announced new security capabilities to give customers comprehensive protection and control in managing apps and APIs across on-premises, cloud, and edge locations. Specifically, new machine learning enhancements provide F5’s cloud security portfolio with advanced API endpoint discovery, anomaly detection, telemetry, and behavioral analysis. As more transactions and customer engagements occur through digital channels such as web and mobile apps, organizations are seeking better solutions to provide secure experiences for their end users and maintain their trust. With APIs as the building blocks of modern web and mobile experiences, protecting these assets is the cornerstone of securing digital services.

F5 customers can now strengthen their security posture with a continuously improving analysis engine and unified policy enforcement. These capabilities enable secure app-to-app communications through validated and monitored APIs, thereby reducing the time security teams spend correcting false positives and accelerating time-to-deployment for new services. The enhancements, as well as new managed service offerings for enterprises and service providers, accelerate the momentum of F5 Distributed Cloud Services, introduced in 2022 and bolstered by the recent launch of multi-cloud networking solutions.

Modern organizations continue to demonstrate a clear preference for hybrid solutions. According to F5's 2023 State of Application Strategy (SOAS) Report, 85% of respondents have deployed apps and APIs in distributed environments spanning multiple public clouds, as well as on-premises and edge locations. More than 20% of respondents are deploying apps and APIs in six different environments. At the same time, security teams struggle to provide consistent protection and visibility for a rapidly expanding attack surface area. This is primarily because many contemporary Web application and API protection (WAAP) solutions rely on point products or offerings based on (and provided by) CDN vendor technologies that cannot adequately scale beyond cloud-based apps and lack the ability to be deployed on premises, in public clouds, or in other edge locations.

"Applications and APIs are the building blocks of the digital experiences through which we all work, bank, shop, access healthcare, travel, and play," said Kara Sprague, EVP and Chief Product Officer, F5. "And those experiences are only as secure as the most vulnerable app or API. With greater efficacy achieved via sophisticated profiling techniques and deployment options that span SaaS, packaged software, hardware appliances, and managed services, F5's app and API security solutions are unmatched. Today’s announcement continues our mission to radically simplify app and API security, empowering customers to accelerate digital innovation with the confidence of comprehensive protection no matter how their apps are built or where they live."

F5 offers a full suite of capabilities to provide robust protection for apps and APIs across on-premises, cloud, and edge locations. Moreover, F5's end-to-end approach to security means that threat data can be gathered and analyzed across all deployed locations, including ongoing and emerging attack campaigns detected by the F5 Threat Campaigns service. As part of a larger hardware, software, SaaS, and managed services portfolio that also provides best-in-class application delivery capabilities, F5 security solutions protect a diverse mix of distributed apps and APIs in any environment without adding further operational complexity.

****Enhanced API Security Provides Greater Protection for Modern Apps****

F5 offerings are firmly in step with organizations’ desire to deploy security capabilities in the public cloud and as-a-service. Unlike API-only point product security providers, F5 delivers API auto-discovery, policy enforcement, and anomaly detection as part of a unified WAAP service, simplifying operations and enforcement through a single console for both app and API protection. Since static signature-based controls are insufficient for protecting API endpoints due to their dynamic, evolving nature, F5 Distributed Cloud API Security utilizes optimized machine learning for automatic API discovery, threat detection, and schema enforcement. By observing normal behavior patterns across all endpoints, F5’s advanced analysis engine helps users detect anomalies and refine API schemas to improve their overall security posture. Additionally, F5 supports token identification to detect anomalous behavior accessing JWT tokens and prevent unauthorized usage.

****AI as an Essential Element of App Security****

According to F5's SOAS Report, nearly two-thirds of organizations are prioritizing the use of AI/machine learning, with security as a top use case. CISOs view such capabilities as a means to reduce the time between detection and response without compromising efficacy or requiring additional security staff. In addition to AI-based enhancements for Distributed Cloud API Security, F5 is introducing AI-driven Web application firewall (WAF) capabilities, including unique malicious user detection and mitigation capabilities that create a per-user threat score based on behavioral analysis that determines intent. This enables security operations to choose between alerting or automatic blocking to mitigate an attack that would otherwise go undetected by static signatures. With F5, all traffic is monitored and proactive defenses are applied based on malicious user behavior that can be correlated across Distributed Cloud WAAP deployments. New functionality also provides false positive suppression, making it easier to block bad traffic without accidentally blocking legitimate users, and streamlines operations by reducing the time necessary to enable specific app protections.

****Simplifying App Security through Managed Service Offerings****

Given organizations’ growing challenges in deploying consistent security across increasingly distributed infrastructures—as well as finding available personnel with the required security skillsets—F5 is expanding its managed service offerings:

*   **Distributed Cloud WAAP Managed Services** enable F5 customers to access the experience and expertise of the F5 SOC to manage WAF, bot defense, and DDoS protection. Through a shared console, customers have the ability to seamlessly move between a self-service or managed service model as the needs of their apps and approach to app security change.
*   **Distributed Cloud Managed Service Portal** enables F5 service provider partners to build and tailor their own managed service offerings based on the leading security capabilities of F5 Distributed Cloud WAAP. This approach lets partners manage Distributed Cloud WAAP on behalf of their customers without sacrificing visibility, resulting in new revenue sources and value-added services while extending the overall reach of the solution.

"The beauty of F5 is that they understand each application and provide a solution for that application," said Mhd Wail Wajih Khachfa, Chief Information Security Officer, The Department of Digital Ajman. "For us, F5 is not just a technology provider. They are a strategic partner in our journey to provide the best performance, availability, and security to our customers."

"Just as every business has different risk factors, app security will never be one size fits all," said Chris Steffen, Managing Research Director, Enterprise Management Associates. "Today's leading vendors recognize that a better approach is to provide integrated capabilities that can take advantage of unified security policies—and enhanced machine learning—across data center, cloud, hybrid, and edge deployments. F5 solutions give customers the flexibility to scale their apps and infrastructure in concert while offering leading security in any deployment context."

****Additional Resources****

*   F5's 2023 State of Application Strategy Report
*   F5 Distributed Cloud Services

****About F5****

F5 is a multi-cloud application services and security company committed to bringing a better digital world to life.​​​​​​​ F5 partners with the world’s largest, most advanced organizations to secure and optimize every app and API anywhere—on premises, in the cloud, or at the edge. F5 enables organizations to provide exceptional, secure digital experiences for their customers and continuously stay ahead of threats. For more information, go to f5.com. (NASDAQ: FFIV)

You can also follow @F5 on Twitter or visit us on LinkedIn and Facebook for more information about F5, its partners, and technologies. F5 is a trademark, service mark, or tradename of F5, Inc., in the U.S. and other countries. All other product and company names herein may be trademarks of their respective owners.

Source

DARKReading