Ram Boreda

Okta signed the Cybersecurity and Infrastructure Security Agency’s Secure by Design pledge at #RSAC to take meaningful steps in adopting #secure by design principles in the coming year. I am excited that we are accompanying our peers in the industry to take the steps needed to prioritize application security. Identity-based #attacks have become a top method for cybercriminals, and according to the Open Worldwide Application Security Project, broken access control is the number one most common web application security risk. It’s putting companies building their applications at risk. This is a priority for Okta. There’s never been a more critical time for us to come together and implement secure design principles to keep the #identity #secure. Learn more about this pledge https://bit.ly/3UQNLbz. Tomorrow is also Okta Showcase! I am excited to join Todd McKinnon, Sagnik Nandy , and others to share the latest product innovations & commitments Okta is making to secure identity. You can tune in here: https://bit.ly/4cLldaI

184

Dara Khosrowshahi Prashanth Mahendra-Rajah Jill Hazelbaker Nikki Krishnamurthy Tony West Gus Fuldner Pierre-Dimitri Gore-Coty Albert Greenberg Sundeep Jain Andrew McDonald Hi Dara and team - Respectfully - we need to talk about your customer support failures.. Failures in the sense that, your users who've been defrauded on your platform, cant actually contact you? Failures in the sense that your customer support won't even talk to you if you aren't a driver. I can see information for Drivers, people you want to employ - but where is the contact information for USERS, the people who PAY for your service, maybe even users who have had money used fraudulently on your platform? If i could get through to someone on the phone i'd ask them How is it that your platform allows for credit and debit cards to be used, WITHOUT VERIFICATION? What about users Dara? @Ronald Sugar Revathi Advaithi Turqi Alnowaiser

A SMB building a SaaS product can you build the 6 CISA's Secure by Design components into your product as part of a #securebydesign foundation. Part 1/3 below on 1 )Increase the use of MFA, and 2) Reduce use of default passwords CISA's Secure by Design pledge has 6 reviewed components: 1.       Increase the use of MFA for users 2.       Reduce the use of default passwords 3.       Reduce classes of vulnerabilities 4.       Provide security patching 5.       Have a Vulnerability Disclosure Program 6.       Provide logging for your customers.   In your design you should consider the use of MFA to be the default behavior of your application. CISA recommends that you follow a 'seat belt chimes' design pattern to remind users to enable MFA. As you design the product you should require that administrative users of your application enable MFA. Admins should also be able to require their users to have MFA as a part of the default experience. You can see an example of this in the Cloudflare console in my post on creating a hardened account. On Zatik.io/blog   Your MFA features should focus on current best practices of phishing resistant MFA, or app based 2FA. Supporting SMS 2FA is something but is an engineering dead end when trying to sell to enterprises.   When building a SaaS application, you must not have any default passwords. Users must be prompted to create a new random password at account creation. If an admin is creating an account for users, you must support the ability to require users change their passwords when they first log in.   Please reach out if you have questions on implementing CISA’s recommendations in your product roadmap.

2

1 Comment

Please join me, @Damon McDougald, and @Jim Routh on May 7th at 10 a.m. for an Accenture & Saviynt discussion at RSA on enhancing identity security. Accenture and Saviynt are shaping digital transformation, and we are looking forward to presenting how AI/ML can both improve operations and reduce organizational risk. As cybersecurity threats evolve, it is important to stay ahead. Register now using the link below #Cybersecurity #AI/ML #AccentureSecurity #Saviynt #CISO #IdentitySecurity #RSAC2024 https://lnkd.in/dFFKBCNA

70

1 Comment

Amplify detection capabilities with Recorded Future's Validated Sigma Rules, crafted by our research team to minimize false positives. Watch to see how to easily search, implement, and configure Sigma Rules without ever leaving Splunk.

2

Enterprises spend more on security but aren’t benefitting from the extra spend. Palo Alto Networks’ customers who buy security across 3 platforms spend more than 40x those that secure just one. Despite those dollars… “Adding incremental point products is not necessarily driving a better security outcome for them.” - Nikesh Arora, CEO of Palo Alto Networks The average enterprise uses upwards of 70 security products. Many of these products produce alerts identifying phishing emails or network access issues or odd device behavior. The security operations center (SOC) reviews these alerts. Estimates suggest the typical team receives between 5,000 & 11,000 alerts per day - every day. Worse still, every SOC team is short-staffed. No wonder these teams can’t keep up with the deluge. Fewer than 10% of alerts are ever reviewed. Many security breaches could have been detected earlier with broader coverage. Dropzone provides AI SOC analysts that never sleep. Leveraging the power of LLMs, Dropzone’s analysts collect alerts, fetch relevant information from other systems, and then triage alerts. These agents also inform copilots that empower security analysts to ask questions of their environment leveraging the insight of the AI analysts. RSA selected Dropzone a top 10 Finalist in the Innovation Sandbox. We’re thrilled to support Edward & the Dropzone team in fulfilling their mission. As Senior Principal Scientist, Edward architected the AI systems at ExtraHop, a network security company acquired for $900M. Our partner Andy wrote in greater depth about our vision for the company here : https://lnkd.in/dyUy6M_3. And if you’re curious to test it on your own, you can test drive it here : https://lnkd.in/djzXcwjs.

43

5 Comments

Before we make your cloud safe, we made our cloud safe

20

Looking forward to speaking about GenAI rollouts, esp Microsoft Copilot and the need for Data Security Governance at the Hartford Cybersecurity summit June 25 https://lnkd.in/gM9KEHzd Link above if you want to register. Hope to see you there #concentricai #dspm #datasecurity #genai #datagovernance

28

Interesting article on CSO Online featuring insight from my colleague, Dan Mellen, on #AI Governance and #cybersecurity certifications. As Dan discusses, we prioritize people with hands-on technical experience to guide our clients. #GenAI

5

Stay ahead of evolving threats and gain faster threat detection, centralized visibility, and intelligent threat prioritization. See how Vectra AI solves SIEM challenges: /https://lnkd.in/gtqcU5uN

13

“One of the biggest vulnerabilities I see, especially in the cloud landscape, is the lack of multi-factor authentication implementation.” Mukhtar Kabir of GuidePoint Security Check out the episode of Beyond The Screen: An IONOS Podcast featuring Mukhtar Kabir, Senior Cloud Security Architect at GuidePoint Security. Here are some key learnings: ⚡ Install alerting mechanisms to identify and block unauthorized access attempts 💡 AI and ML are being increasingly used in security tools, especially in detecting misconfigurations Want to learn more? 🎧 Head on over to the link in the comments below to listen to the full episode 👇 #beyondthescreen #cybersecurity #zerotrust

3

1 Comment

LogRhythm and Exabeam making the news in Information Security Media Group (ISMG) in an article titled, "SIEM Stalwart LogRhythm to Merge With Exabeam." Excerpts: "Vigilant CISOs have eagerly awaited the emergence of a strong, customer-obsessed, singularly focused global leader in AI-driven security operations - one that offers a best-of-breed alternative to the frustratingly complex options on the market today. That day has arrived," asserted LogRhythm CEO Christopher O'Malley O'Malley. Colorado-based LogRhythm is one of the original SIEM players. Unlike fellow stalwart Splunk, it's not being folded into a larger company. Instead, it is banking its future on synergies with California's Exabeam. Networking giant Cisco's $28 billion acquisition of Splunk in a deal completed only weeks ago has created a potential opening in the SIEM market for practitioners concerned about Splunk's viability under Cisco tutelage while also pressuring SIEM firms to shore up their offerings, Forrester Principal Analyst Allie Mellen told Information Security Media Group. "There are synergies from a technology perspective" in joining Exabeam's user analytics with LogRhythm's SIEM capabilities, she said. "Bringing those companies together could be more effective ..." My Take: This merger will create the world’s largest, singularly focused security operations software provider - not by a little, but by a lot. It will form a customer-centric organization dedicated to empowering security analysts heroes to nail the jobs of threat detection, investigation, and response with an AI-driven security operations platform. With respective proven track records of impactful innovation, we've both independently demonstrated a disciplined and relentless mindset for continuously improving the velocity, quality, and efficiency of our innovation delivery processes, and will only become stronger together. In the digital age, partners matter, and cybersecurity partners matter absolutely. This merger creates a best-in-class partner with best-of-breed solutions, emotionally committed to the success of our always beautifully, wonderfully dissatisfied customers, who inspire us to continually do better in their service. And the best part, we're just getting warmed up! And, what about those confused and conflicted tech conglomerates like Cisco-ized Splunk? For LogRhythm and Exabeam, cyber security is our passion and obsession. For Splunk, it's a casual hobby. For CISCO, it's an unwelcome chore. And, for those poor souls of frustrated and aggravated partners trying to work with these confused and conflicted tech conglomerates on mission critical matters of cybersecurity - it's an absolute nightmare.

270

31 Comments

With no tools currently available to discern authentic content from GenAI deepfakes, CyberArk CIO Omer Grossman shares 3 steps you can take now to protect your organization. https://lnkd.in/gAX2JMES #IdentitySecurity #AI #cybersecurity

2

DigiCert shows how you can automate and simplify software development security in just 4 steps! NIST’s Secure Software Development Framework outlines practices you can implement to reduce vulnerabilities. Because these best practices can impact the efficiency of the software development lifecycle, automation is key to successful implementation.

4

The latest critical PAN-OS vulnerability could expose your organization to lateral movement and other exploits. Join our webinar with Zscaler CSO Deepen Desai, SVP Product Management & General Manager, Dhawal Sharma, and Zeus Kerravala, Founder of ZK Research, as they dive into CVE-2024-3400 and the biggest risks of legacy #firewalls and #VPNs. Register now: https://lnkd.in/gTk4B2ES

1

The latest critical PAN-OS vulnerability could expose your organization to lateral movement and other exploits. Join our webinar with Zscaler CSO Deepen Desai, SVP Product Management & General Manager, Dhawal Sharma, and Zeus Kerravala, Founder of ZK Research, as they dive into CVE-2024-3400 and the biggest risks of legacy #firewalls and #VPNs. Register now: https://lnkd.in/gTk4B2ES

3