Category: Black Hat Podcasts

Application Security Posture Management (ASPM) arose a few years ago as a strategy to help software developers and security teams continually improve the security of business applications.

Related: Addressing rising cyber compliance pressures

At Black Hat USA 2024, an iteration called Active ASPM is in the spotlight. I had the chance to visit with Neatsun Ziv, CEO and co-founder of Tel Aviv-based OX Security, a leading Active ASPM solutions provider.

I learned all about how Active ASPM emphasizes continuous, real-time monitoring and proactive remediation, thereby augmenting more passive ASPM methods, if you will, that focus on data aggregation and periodic assessments, Ziv told me. For a full drill down, please give the accompanying podcast a listen.

For its part, OX Security does this by going the extra mile to provide rich, detailed context that enables security teams to do triage more effectively – and CISOs to justify, with hard evidence, why resources need to be directed at specific security improvements.

This heavy lifting gets done, he says, by “going into the code and reading the code myself. I’m going to connect to the cloud, read the configurations and read the active assets you’ve got in your cloud. I’m going to connect to your artifact registry and scan what’s in there. I’m going to connect to your existing tools, understand what’s in there, and basically use every asset that you have inside your organization to provide the best and most accurate answer to the question, ‘Are you right now at risk? If so, let me guide you through the process of getting to a safer place.’ “

How high might Active ASPM move the bar, going forward? I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

---

(LW provides consulting services to the vendors we cover.)

The post Black Hat Fireside Chat: Here’s how ‘Active ASPM’ is helping to triage and remediate coding flaws first appeared on The Last Watchdog.

LAS VEGAS – Here’s what I discovered last week here at Black Hat USA 2024: GenAI is  very much in the mix as a potent X-factor in cybersecurity.

Related: Prioritizing digital resiliency

I spoke with over three dozen cybersecurity solution providers. Some of the more  intriguing innovations had to do with leveraging GenAI/LLM-equipped chatbots as proprietary force multipliers.

This is all part of Generative AI and Large Language Models igniting the next massive technological disruption globally. In the next five years, GenAI/LLM deployments are expected to add $2.6 to $4.4 trillion annually across more than 60 use cases, according to recent McKinsey study; a recent AWS survey predicts that over 93% of employers will use GenAI/LLM to increase innovation and creativity, automate repetitive tasks and boost learning.

Part of this tech revolution will play out in the cybersecurity sector as vendors perfect ways to assign GenAI/LLM to the task of helping companies get a better grip on data sprawl. Massive, indiscriminate ingestion of data was an intractable mess long before this mad scramble to insert AI assistants high and low in company operations.

“AI thrives on large datasets, “Steve Stone, head of Rubrik Zero Labs told me. “When you add AI into the mix, it further intensifies the challenge of managing data sprawl and the associated risks.”

Ditto when it comes to detection sprawl, if you will, in the cyber realm. I’m referring to the proliferation of fragmented, siloed security systems. “Managing all of that telemetry, bringing it together, prioritizing the alerts and remediating them, well, that’s where things break in the real world,” observes Willy Leichter, CMO of AppSOC.

Roger that. Just ask CrowdStrike. After strolling the exhibits floor at Black Hat USA 2024 and speaking with the solution providers, I jotted down two categories of cybersecurity advancements: ‘coding level’ and ‘operational level.’ Highlights of what I learned:

Coding level

The continual monitoring and hardening of business software as it is being rapidly developed, tested and deployed in the field has become a foundational best practice. When it comes to the broad category of Application Security (AppSec,) there’s a lot is going on.

AppSec technology security-hardens software at the coding level. Then there’s the sub-category of application security posture management (ASPM.) ASPM toolsets came along in 2020 or so to help organizations get more organized about monitoring and updating code security as part of meeting data privacy and security regulations.

Big name tech vendors like Palo Alto Networks, Cisco, IBM and even CrowdStrike have since integrated ASPM services in their platform offerings. And alongside them there is a thriving cottage industry of independent ASPM solution providers. I spoke at length with three of them: AppSOC, Cycode and OX Security.

San Jose, Calif.-based AppSOC launched in 2021 to aggregate, consolidate and prioritize security data from various toolsets used in the software development lifecycle (SDLC). AppSOC leverages AI to reduce the noise from multiple data sources and intelligently prioritizes vulnerabilities based on exploitability and business impact, Leichter told me.

Meanwhile, Tel Aviv, Israel-based Cycode started in 2019 to deliver a secrets detection service; it subsequently evolved into supplying advanced ASPM technology, says regional sales manager Kyle Vanderzanden. Cycode uses dedicated, in-house scanners to vet code within the hectic flow of the software development and deployment processes so as to not slow down innovation, he says

I also hosted a LW Fireside Chat podcast with OX Security CEO Neatsun Ziv. We did as deep dive on the evolution of ASPM solutions over the past four years and we discussed so-called Active ASPM;  give a listen once the podcast, which is on track to go live as LW’s Top Story  tomorrow (Aug. 11.)

I’d also put San Francisco-based Traceable and Cambridge, Mass.-based ReversingLabs in the bucket of coding-level solution providers at the leading edge. In my LW Fireside Chat with Traceable’s Amod Gupta, which you can listen to here, we dissect the reasons why API Security is so effective at mitigating online fraud; we also spoke about the emerging need to help enterprises secure their  GenAI deployments.

And stay tuned for my upcoming LW Fireside Chat with ReversingLabs Chief Trust Officer Saša Zdjelar, in which he describes ReversingLabs’  unique approach to deeply vetting new code in a way that greatly enhances Software Build of Materials (SBOMs.)

Operational level

It’s not enough, of course, to do security well at just the coding level. Multiple layers of proactive protection are required to achieve resiliency in a massively complex, highly dynamic operating environment.

This includes hardware security. I spoke to Brett Hansen, CMO, of Cigent Technology, and John Gunn, CEO of Token,  about discreet security devices at the hardware layer: for remote data storage and privileged access, respectively

Based in Naples, Fla.- Cigent provides security-enhanced SSDs and microSDs. Its solution includes hardware encryption, software-based multi-factor authentication, and AI-driven anomaly detection within the storage itself, Hansen noted.

New York, NY-based Token is on the verge of introducing a very unique wearable – a smart security ring activates by a fingerprint sensor and hardened to make it hackproof. For starters the ring is aimed at system administrators and senior executives, but could eventually go mainstream. For a full drill down, give a listen to my LW Fireside Chat podcast discussion with Gunn.

Yet another layer – easily the most porous one — is the user layer. And by far the two most ubiquitous user interfaces are web browsers and mobile devices.

Island’s Uy Huynh and I discussed how enterprise browsers are gaining traction because of advanced methods to both enhance security and improve efficiency. And I visited with AppDome CEO Tom Tovar to discuss the somewhat surprising, to me at least, results of a global consumer survey highlighting smartphone users’ readiness to abandon brands associated with poorly secured mobile apps.

I also heard from San Francisco-based Horizon3.ai, which announced a strategic partnership with Tech Mahindra, a major India-based multinational tech services company.

Horizon3 will integrate its its NodeZero™ platform, which delivers AI-powered pentesting and other services, with Tech Mahindra’s comprehensive suite of cybersecurity services.

And I learned all about Washington D.C.-based Black Girls Hack and London-based Security Blue Team. These organizations are taking a fresh approach to filling a big unmet need. Give a listen to my conversation with BGH founder Tennisha Martin about the support services they offer to anyone looking to enter or move over to a cybersecurity career. And I also spoke with Melissa Boyle, marketing manager at Security Blue Team, about the array of free and paid cybersecurity skills training services.

Those are my big takeaways from Black Hat USA 2024. Much percolating. As always, I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

---

 

 

The post MY TAKE: Black Hat USA 2024’s big takeaway – GenAI factors into the quest for digital resiliency first appeared on The Last Watchdog.

When Tennisha Martin, a veteran software quality assurance analyst, sought to move over to a security team a few years ago, the doors should have been wide open, given the much-ballyhooed cybersecurity skills shortage.

Related: Modernizing security training

Instead, she ran into a rigid wall of shortsightedness. So, Martin taught herself ethical hacking skills and then founded  Black Girls Hack to guide others down the trail she blazed.

As Black Hat USA 2024 rolls into high gear next week, BGH is thriving. The non-profit boasts 2,500 members globally (all genders and races) and has lined up top-tier corporate backers, led by Microsoft and Google, to back its programs.

What’s more, it is putting on a content-rich conference, SquadCon 2024, in parallel with Black Hat, at The Industrial Event Space in Vegas mid next week.

I had the chance to visit with Martin and BGH group leaders Tammy Hinkle and Rebekah Skeete; we discussed how BGH fosters a confidence-building community. Members get access to resources such as training vouchers and tools like RangeForce. And the only requirement is to “not be a jerk,” Martin says. For a full drill down, give a listen to the accompanying podcast.

BGH’s emphasis on diversity has the potential to be a game changer. In a hyper-interconnected operating environment, grasping the context of legit vs. malicious connections, on the fly, is vital.

So how much might a diverse security team contribute to staying on top of context in such a highly dynamic environment?  I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

---

 

 

The post Black Hat Fireside Chat: ‘Black Girls Hack’ emphasizes diversity as effective force multiplier first appeared on The Last Watchdog.

Two-plus decades of enduring wave after wave of mobile app malware and fraud has finally taken its toll on users.

Now comes a global survey from Appdome and OWASP that reveals the vast majority of consumers are fed up.

I recently visited with Appdome CEO Tom Tovar to discuss clear signals that consumers are now insisting upon mobile apps that are private and secure, as well as convenient. For a full drill down, please give the accompanying podcast a listen.

As Black Hat USA 2024 gets ready to open next week in Las Vegas, this brings pressure to bear upon app developers – and on the top consumer brands — to do much better.

“Consumers are becoming highly sophisticated in their demands,” Tovar told me.  “The fear that mobile app providers don’t care about their protection is now equivalent to the fear of the attackers themselves.”

Historically, developers and brands have prioritized innovation and competition over security. Yet consumers are now demanding much improved security – and mobile app providers would do well to make the adjustment.

Appdome’s poll reveals that 74 percent of consumers would abandon an app if they felt unprotected, while 95 percent would advocate for brands that provide strong security measures.

Consumers are demanding much better mobile app security; and they’re also willing to reward brands that deliver it. The good news is that technology is advancing, as well. Appdome, for instance, next week plans to unveil a new tool that leverages GenAI to help developers and brands embed security deeply and flexibly in apps.

Will these developments soon start to temper mobile app badness? I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

---

(LW provides consulting services to the vendors we cover.)

The post Black Hat Fireside Chat: Consumers demand secure mobile apps; it’s high time for brands to deliver first appeared on The Last Watchdog.

Web browser security certainly hasn’t been lacking over the past 25 years.

Related: Island valued at $3.5 billion

Advancements have included everything from sandboxing and web applications firewalls (WAFs,) early on, to secure web gateways (SWGs) and Virtual Desktop Infrastructure (VDIs,) more recently.

Yet profound browser exposures persist — and this has led to the arrival of  enterprise browsers, which will be in the spotlight as Black Hat USA 2024 gets underway next week in Las Vegas.

I recently visited with Uy Huynh, vice president of solutions engineering, at Dallas, Tex.-based Island, the pioneer and leading enterprise browser.

We discussed why enterprise browsers may be in the early stages of revolutionizing how businesses operate in the cloud-driven world. For a full drill down, please give the accompanying podcast a listen.

You’ll learn, as I did, why enterprise browsers are not just another incremental improvement. By embedding user authentication, data protections, robotic process automation, and workflow integration directly into an enterprise browser companies can reduce complexity while improving speed and productivity, Huynh explains.

In effect, this approach extends threat detection and policy enforcement to the presentation layer; each person taps into company assets via a highly capable, flexible browser that’s simpler for the company to manage with dexterity.

Huynh walked me through examples where Island’s browser has replaced cumbersome VDI implementations, complex data loss prevention policies and helped to streamline  M&A deals. “With an enterprise browser, you access applications natively and directly, removing latency and significantly boosting productivity,” says Huynh.

Will enterprise browsers become central to IT and security infrastructures? I’ll keep watch and keep reporting.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

---

(LW provides consulting services to the vendors we cover.)

The post Black Hat Fireside Chat: How ‘enterprise browsers’ help to shrink exposures, boost efficiencies first appeared on The Last Watchdog.