Salt Security lands $70M for tech to protect APIs from malicious abuse

APIs make the world go round in tech, but that also makes them a very key target for bad actors: As doorways into huge data troves and services, malicious hackers spent a lot of time looking for ways to pick their locks or just force them open when they’re closed, in order to access that information. And a lot of recent security breaches stemming from API vulnerabilities (see here, here and here for just a few) show just how real and current the problem is.

Today, a company that’s building a network of services to help those using and producing APIs to identify and eradicate those risks is announcing a round of funding to meet a growing demand for its services. Salt Security, which provides AI-based technology to identify issues and stop attacks across the whole of your API library, has closed $70 million in funding, money that it will be using both to meet current demand but also continue building out its technology for a wider set of services and use cases for API management.

The funding is being led by Advent International, by way of Advent Tech, with Alkeon Capital, DFJ Growth and previous backers Sequoia Capital, Tenaya Capital, S Capital VC and Y Combinator all also participating.

Salt, founded in Israel and now active globally, is not disclosing valuation, but I understand from a reliable source that it is in the region of $600-700 million.

As with many of the funding rounds that seem to be getting announced these days, this one is coming on the heels of both another recent round, as well as strong growth. Salt has raised $131 million since 2016, but nearly all of that — $120 million, to be exact — has been raised in the last year.

Part of the reason for that is Salt’s performance: In the last 12 months, it’s seen revenue grow 400% (with customers including a range of Fortune 500 and other large businesses in the financial services, retail and SaaS sectors like Equinix, Finastra, TripActions, Armis and DeinDeal); headcount grow 160%; and, perhaps most importantly, API traffic on its network grow 380%.

That growth in API traffic underscores the issue that Salt is tackling. Companies these days use a variety of APIs — some private, some public — in their tech stack as a way to interface with other businesses and run their services. APIs are a huge part of how the internet and digital services operate, with Akamai estimating that as much as 83% of all IP traffic is API traffic.

The problem, Roey Eliyahu, CEO and co-founder of Salt Security, told me, is that this usage has outpaced how well many manage those APIs.

“How APIs have evolved is very different to how developers used APIs years ago,” he said. “Before, there were very few, and you could say they were more manageable, and they contained less-sensitive data, and there were very few changes and updates made to them,” he said. “Today with the pace of development, not only are they always getting updated, but you have thousands of them now touching crown jewels of the company.”

This has made them a prime target for malicious hackers. Eliyahu notes Gartner stats that predict that by 2022, APIs will make up the largest attack vector in cybercrime.

Salt’s approach starts with taking stock of a whole network and doing a kind of spring clean to find all the APIs that might be used or abused.

“Companies don’t know how many APIs they even have,” Eliyahu said, noting that some 40%-80% of the APIs in existence for a typical company’s data are not even in active operation, lying there as “shadow APIs” for someone to pick up and misuse.

It then looks at what vulnerabilities might inadvertently be contained in this mix and makes suggestions for how to alter them to fix that. After this, it also monitors how they are used in order to stop attacks as they happen. The third of these also involves remediation “insights”, but carrying out the remediation is done by third parties at the moment, Eliyahu said. All of this is done through Salt’s automated, AI-based, flagship Salt Security API Protection Platform.

There are a number of competitors in the same space as Salt, including Ping, and newer players like Imvision and 42Crunch (which raised funding earlier this month), and the list is likely to grow as not just other API management companies get deeper into this huge space, but cybersecurity companies do, too.

“The rapid proliferation of APIs has dramatically altered the attack surface of applications, creating a major challenge for large enterprises since existing security mechanisms cannot protect against this new threat,” said Bryan Taylor, managing partner and head of Advent’s technology team, in a statement. “We continue to see API security incidents make the news headlines and cause significant reputational risk for companies. As we investigated the API security market, Salt stood out for its multi-year technical lead, significant customer traction and references, and talented team. We look forward to drawing on our deep experience in this sector to partner with Salt in this exciting new chapter.”

Uptycs secures $50M Series C as security platform continues to expand

Uptycs, a Boston-area startup that uses data to help understand and prevent security attacks, announced a $50 million Series C today, 11 months after announcing a $30 million Series B. Norwest Venture Partners led the round with participation from Sapphire Ventures and ServiceNow Ventures.

Company co-founder and CEO Ganesh Pai says that he was still well capitalized from last year’s investment, and wasn’t actually looking to raise funds, but the investors came looking for him and he saw a way to speed up some aspects of the company’s roadmap.

“It was one of those things where the round came in primarily as a function of execution and success to date, and we decided to capitalize on that because we know the partners and raised the capital so that we could use it meaningfully for a couple of different things, primarily sales and marketing acceleration,” Pai said.

He said that part of the reason for the company’s success over the last year was that the pandemic generated more customer interest as people moved to work from home, the SolarWinds hack happened and companies were moving to the cloud faster. “We provided a solution which was telemetric powered and very insightful when it came to solving their security problems and that’s what led to triple digit growth over the last year,” he said.

But Pai says that the company has not been sitting still in terms of the platform. While last year, he described it primarily as a forensic security data solution, helping customers figure out what happened after a security issue has happened, he says that the company has begun expanding on that vision to include all four main areas of security, including being proactive, reactive, predictive and protective.

The company started primarily in being reactive by figuring what happened in the past, but has begun to expand into these other areas over the last year, and the plan is to continue to build out that functionality.

“In the context of SolarWinds, what everyone is trying to figure out is how soon into the supply chain can you figure out what could be potentially wrong by looking at indications of behavior or indications of compromise, and our ability to ingest telemetry from a diverse set of sources, not as a bolt-on solution, but something which is built from the ground up, resonated really well,” Pai explained.

The company had 65 employees when we spoke last year for the Series B. Today, Pai says that number is approaching 140 and he is adding new people every week, with a goal to get to around 200 people by the end of the year. He says as the company grows, he keeps diversity top of mind.

“As we grow and as we raise capital diversity has been something which has been a high priority and very critical for us,” he said. In fact, he reports that more than 50% of his employees come from under-represented groups whether it’s Latinx, Black or Asian heritage.

Pai says that one of the reasons he has been able to build a diverse workforce is his commitment to a remote workplace, which means he can hire from anywhere, something he will continue to do even after the pandemic ends.

 

Zoom fatigue no more: Rewatch raises $20M to index, transcribe and store enterprise video content

We don’t hear as much these days about “Zoom fatigue” as we did in the first months after the COVID-19 pandemic kicked off last year, but what’s less clear is whether people became more tolerant of the medium, or if they found ways of coping with it better, or if they were hopeful that tools for coping would soon be around the corner.

Today, a startup that has come up with a solution to handling all that video is announcing some funding to grow, on the understanding that whatever people are doing with video today, there will be a lot more video to handle in the future, and they will need more than just a good internet connection, microphone and video camera to deal with it.

Rewatch, which has built a set of tools for organizations to create a “system of record” for their internal video archives — not just a place to “rewatch” all of their older live video calls, but to search and organise information arising from those calls — has closed a $20 million round of funding.

Along with this, Rewatch from today is opening up its platform from invite-only to general availability.

This latest round is a Series A and is being led by Andreessen Horowitz, with Semil Shah at Haystack and Kent Goldman at Upside Partners, as well as a number of individuals, also participating.

It comes on the heels of Rewatch announcing a $2 million seed round only in January of this year. But it’s had some buzz in the intervening months: Customers that have started using Rewatch include GitHub (where co-founders Connor Sears and Scott Goldman previously worked together), Brex, Envoy and The Athletic.

The issue that Rewatch is tackling is the fact that a lot more of our work communications are happening over video. But while video calling has been hailed as a great boost to productivity — you can work wherever you are now, as long as you have a video connection — in fact, it’s not.

Yes, we are talking to each other a lot, but we are also losing information from those calls because they’re not being tracked as well as they could be. And, by spending all of our time talking, many of us are working on other things less, or are confined into more rigid times when we can.

Rewatch has built a system that plugs into Zoom and Google Meet, two of the most-used video tools in the workplace, and automatically imports all of your office’s or team’s video chats into a system. This lets you browse libraries of video-based conversations or meetings to watch them on-demand, on your time. It also provides transcripts and search tools for finding information in those calls.

You can turn off the automatic imports, or further customize how meetings are filed or accessibility. Sears said that Rewatch can be used for any video created on any platform; for now those require manually importing the videos into the Rewatch system.

Sears also said that over time it will also be adding ways to automatically turn items from meetings into, say, work tickets to follow them up.

While there are a number of transcription services available on tap these days, as well as any number of cloud-based storage providers where you can keep video archives, what is notable about Rewatch is that it has identified the pain point of managing and indexing those archives and keeping them in a single place for many to use.

In this way, Rewatch is highlighting and addressing what I think of as the crux of the productivity paradox.

Essentially, it is this: The tech industry has given us a lot of tools to help us work better, but actually, the work required to use those tools can outweigh the utility of the tools themselves.

(And I have to admit, this is one of the reasons I’ve grown to dislike Slack. Yes, we all get to communicate on it, and it’s great to have something to connect all of us, but it just takes up so much damn time to read through everything and figure out what’s useful and what is just watercooler chat.)

“We go to where companies already are, and we automate, pull in video so that you don’t have to think about it,” Sears said. “The effort around a lot of this takes a lot of diligence to make sure people are recording and transcribing and distributing and removing. We are making this seamless and effortless.”

It sometimes feels like we are on the cusp, technologically, of leaning on tools by way of AI and other innovations that might finally cross that chasm and give us actual productivity out of our productivity apps.

In another example of how this is playing out, Dooly, which raised funding last week, is looking to do the same in the world of sales software (automatically populating various sales software with data from your phone, video and text chats, and other sources).

Similarly, we’re starting to see an interesting wave of companies emerge that are looking for better ways to manage and tap into all that video content that we now have swimming around us.

AnyClip, which announced funding yesterday, is also applying better analytics and search to internal company video libraries, but also has its sights on a wider opportunity: organizing any video trove. That points, too, to the bigger opportunity for Rewatch.

For now, though, enterprises and businesses are an opportunity enough.

“As investors we get excited about founders first and foremost, and Connor and Scott immediately impressed us with their experience, clear articulation of the problem, and their vision for how Rewatch could be the end-all solution for video and knowledge management in an organization,” noted David Ulevitch, a general partner at Andreessen Horowitz, in a blog post. “They both worked at GitHub in senior roles from the early days, as a Senior Director of Product Design and a Principal Engineer, respectively, and have first-hand experience scaling a product. Since founding Rewatch in early 2020, they have very quickly built a great product, sold it to large-scale customers, and hired top-tier talent, demonstrating rapid founder and company velocity that is key to building an enduring company.”

Databricks introduces Delta Sharing, an open-source tool for sharing data

Databricks launched its fifth open-source project today, a new tool called Delta Sharing designed to be a vendor-neutral way to share data with any cloud infrastructure or SaaS product, so long as you have the appropriate connector. It’s part of the broader Databricks open-source Delta Lake project.

As CEO Ali Ghodsi points out, data is exploding, and moving data from Point A to Point B is an increasingly difficult problem to solve with proprietary tooling. “The number one barrier for organizations to succeed with data is sharing data, sharing it between different views, sharing it across organizations — that’s the number one issue we’ve seen in organizations,” Ghodsi explained.

Delta Sharing is an open-source protocol designed to solve that problem. “This is the industry’s first-ever open protocol, an open standard for sharing a data set securely. […] They can standardize on Databricks or something else. For instance, they might have standardized on using AWS Data Exchange, Power BI or Tableau — and they can then access that data securely.”

The tool is designed to work with multiple cloud infrastructure and SaaS services and out of the gate there are multiple partners involved, including the Big Three cloud infrastructure vendors Amazon, Microsoft and Google, as well as data visualization and management vendors like Qlik, Starburst, Collibra and Alation and data providers like Nasdaq, S&P and Foursquare

Ghodsi said the key to making this work is the open nature of the project. By doing that and donating it to The Linux Foundation, he is trying to ensure that it can work across different environments. Another big aspect of this is the partnerships and the companies involved. When you can get big-name companies involved in a project like this, it’s more likely to succeed because it works across this broad set of popular services. In fact, there are a number of connectors available today, but Databricks expects that number to increase over time as contributors build more connectors to other services.

Databricks operates on a consumption pricing model much like Snowflake, meaning the more data you move through its software, the more money it’s going to make, but the Delta Sharing tool means you can share with anyone, not just another Databricks customer. Ghodsi says that the open-source nature of Delta Sharing means his company can still win, while giving customers more flexibility to move data between services.

The infrastructure vendors also love this model because the cloud data lake tools move massive amounts of data through their services and they make money too, which probably explains why they are all on board with this.

One of the big fears of modern cloud customers is being tied to a single vendor as they often were in the 1990s and early 2000s when most companies bought a stack of services from a single vendor like Microsoft, IBM or Oracle. On one hand, you had the veritable single throat to choke, but you were beholden to the vendor because the cost of moving to another one was prohibitively high. Companies don’t want to be locked in like that again and open source tooling is one way to prevent that.

Databricks was founded in 2013 and has raised almost $2 billion. The latest round was in February for $1 billion at a $28 billion valuation, an astonishing number for a private company. Snowflake, a primary competitor, went public last September. As of today, it has a market cap of over $66 billion.

Microsoft launches new tools for Teams developers

At its (virtual) Build conference today, Microsoft launched a number of new features, tools and services for developers who want to integrate their services with Teams, the company’s Slack competitor. It’s no secret that Microsoft basically looks at Teams, which now has about 145 million daily active users, as the new hub for employees to get work done, so it’s no surprise that it wants third-party developers to bring their services right to Teams as well. And to do so, it’s now offering a set of new tools that will make this easier and enable developers to build new user experiences in Teams.

There’s a lot going on here, but maybe the most important news is the launch of the enhanced Microsoft Teams Toolkit for Visual Studio and Visual Studio Code.

“This essentially enables developers to build apps easier and faster — and to build very powerful apps tapping into the rich Microsoft stack,” Microsoft group program manager Archana Saseetharan explained. “With the updated toolkit […], we enable flexibility for developers. We want to meet developers where they are.”

Image Credits: Microsoft

The toolkit offers support for tools and frameworks like React, SharePoint and .NET. Some of the updates the team enabled with this release are integration with Aure Functions, the SharePoint Framework integration and a single-line integration with the Microsoft Graph. Microsoft is also making it easier for developers to integrate an authorization workflow into their Teams apps. “Login is the first kind of experience of any user with an app — and most of the drop-offs happen there,” Saseetharan said. “So [single-sign on] is something we completely are pushing hard on.”

The team also launched a new Developer Portal for Microsoft Teams that makes it easier for developers to register and configure their apps from a single tool. ISVs will also be able to use the new portal to offer their apps for in-Teams purchases.

Other new Teams features for developers include ways for developers to build real-time multi-user experiences like whiteboards and project boards, for example, as well as a new meeting event API to build meeting-related workflows for when a meeting starts and ends, for example, as well as new features for the Teams Together mode that will let developers design their own Together experiences.

There are a few other new features here as well, but what it all comes down to is that Microsoft wants developers to consider Teams as a viable platform for their services — and with 145 million daily active users, that’s potentially a lucrative way for software firms to get their services in front of a new audience.

“Teams is enabling a new class of apps called collaborative apps,” said Karan Nigam, Microsoft’s director of product marketing for Teams. “We are uniquely positioned to bring the richness to the collaboration space — a ton of innovation to the extensibility side to make apps richer, making it easier with the toolkit update, and then have a single-stop shop with the developer portal where the entire lifecycle can be managed. Ultimately, for a developer, they don’t have to go to multiple places, it’s one single flow from the business perspective for them as well.”

read

How Expensify shed Silicon Valley arrogance to realize its global ambitions

Expensify may be the most ambitious software company ever to mostly abandon the Bay Area as the center of its operations.

Expensify may be the most ambitious software company ever to mostly abandon the Bay Area as the center of its operations.

The startup’s history is tied to places representative of San Francisco: The founding team worked out of Peet’s Coffee on Mission Street for a few months, then crashed at a penthouse lounge near the 4th and King Caltrain station, followed by a tiny office and then a slightly bigger one in the Flatiron building near Market Street.

Thirteen years later, Expensify still has an office a few blocks away on Kearny Street, but it’s no longer a San Francisco company or even a Silicon Valley firm. The company is truly global with employees across the world — and it did that before COVID-19 made remote working cool.

“Things got so much better when we stopped viewing ourselves as a Silicon Valley company. We basically said, no, we’re just a global company,” CEO David Barrett told TechCrunch. That globalism led to it opening a major office in — of all places —a small town in rural Michigan. That Ironwood expansion would eventually lead to a cultural makeover that would see the company broadly abandon its focus on the Bay Area, expanding from a headquarters in Portland to offices around the globe.

It makes sense that a company founded by internet pirates would let its workforce live anywhere they please and however they want to. Yet, how does it manage to make it all work well enough to reach $100 million in annual revenue with just a tad more than 100 employees?

As I described in Part 2 of this EC-1, that staffing efficiency is partly due to its culture and who it hires. It’s also because it has attracted top talent from across the world by giving them benefits like the option to work remotely all year as well as paying SF-level salaries even to those not based in the tech hub. It’s also got annual fully paid month-long “workcations” for every employee, their partner and kids.

Yet the real story is how a company can become untethered from its original geography, willing to adapt to new places and new cultures, and ultimately, give up the past while building the future.

Qualified raises $51M to help Salesforce users improve their sales and marketing conversations

Salesforce dominates the world of CRM today, but while it’s a popular and well-used tool for organizing contacts and information, it doesn’t have all the answers when it comes to helping salespeople and marketers sell better, especially when meetings are not in person. Today, one of the startups that has emerged to help fill the gap is announcing a round of growth funding on the back of a huge year for its business.

Qualified — which builds better interactions for B2B sales and marketing teams that already use Salesforce by tapping into extra data sources to develop a better profile of those visiting your website, in aid of improving and personalizing the outreach (hence the name: you’re building “qualified” leads) — has picked up $51 million in funding. The startup will be using the Series B to continue building out its business with more functionality in the platform, and hiring across the board to expand business development and more.

Led by Salesforce Ventures, the funding round also included Norwest Venture Partners and Redpoint Ventures, both previous backers, among others. As with so many rounds at the moment — the venture world is flush with funding at the moment — this one is coming less than a year after Qualified’s last raise. It closed a $12 million Series A in August of last year.

Qualified was co-founded by two Salesforce veterans — ex-Salesforce CMO Kraig Swensrud and ex-SVP of Salesforce.com Sean Whiteley — serial entrepreneurs who you could say have long been hammering away at the challenges of building digital tools for sales and marketing people to do their jobs better online. The pair have founded and sold two other startups filling holes to that end: GetFeedback, acquired by SurveyMonkey, and Kieden, acquired by Salesforce.

The gap that they’re aiming to fill with this latest venture is the fact that when sales and marketing teams want to connect with prospects directly through, say, a phone call, they might have all of that contact’s information at their disposal. But if those teams want to make a more engaged contact when someone is visiting their site — a sign that a person is actually interested and thinking already about engaging with a company — usually the sales and marketing teams are in the dark about who those visitors are.

“We founded Qualified on the premise that a website should be more than a marketing brochure, but not just a sales site,” Swensrud, who is the CEO, said in an interview.

Qualified has built a tool that essentially takes several signals from Salesforce as well as other places to build up some information about the site visitor. It then uses it to give the sales and marketing teams more of a steer so that when they reach out via a screen chat to say “how can I help?” they actually have more information and can target their questions in a better way. A sales or marketing rep might know which pages a person is also visiting, and can then use the conversation that starts with an online chat to progress to a voice or video call, or a meeting.

If a person is already in your Salesforce Rolodex, you get more information; but even without that there is some detail provided to be slightly less impersonal. (Example: When I logged into Qualified to look around the site, a chat popped up with a person greeting me “across the pond”… I’m in London.)

Qualified also integrates with a number of other tools that are used to help source data and build its customer profiles, including Slack, Microsoft Teams, 6sense, Demandbase, Marketo, HubSpot, Oracle Eloqua, Clearbit, ZoomInfo and Outreach.

Additional data is part and parcel of the kinds of information that sales and marketing people always need when reaching out to prospective customers, whether it’s via a “virtual” digital channel or in person. However, in the last year — where in-person meetings, team meetings and working side-by-side with those who can give advice have all disappeared — having extra tools like these arguably have proven indispensable.

“Sales reps would heavily rely on their ‘road warrior’ image,” Swensrud said. “But all that stuff is gone, so as a result every seller is sitting at an office, at home, expecting digital interactions to happen that never existed before.”

And it seems some believe that even outside of COVID-19 enforcing a different way of doing things, the trend for “virtual selling”, as it’s often called, is here to stay: Gartner forecasts that by 2025, some 80% of B2B sales interactions will take place in digital channels. (So long to the expense account lunch, I guess.)

It’s because of the events of 2020, plus those bigger trends, that Qualified has seen revenues in the last year grow some 800% and its net customer revenue retention rate hover at 175%, with funding rounds come in relatively close succession in the wake of that.

There is something interesting to Qualified that reminds me a bit of more targeted ad retargeting, as it were, and in that, you can imagine a lot of other opportunities for how Qualified might expand in scenarios where it would be more useful to know why someone is visiting your site, without outright asking them and bothering them with the question. That could include customer service, or even a version that might sell better to consumers coming to, say, a clothes site after reading something about orange being the new black.

For now, though, it’s focused on the B2B opportunity.

There are a number of tools on the market that are competing with Salesforce as the go-to platform for people to organise and run CRM operations, but Swensrud is bullish for now on the idea of building specifically for the Salesforce ecosystem.

“Our product is being driven by and runs on Salesforce,” he noted, pointing out that it’s through Salesforce that you’re able to go from chatting to a phone call by routing the information to the data you have on file there. “Our roots go very deep.”

The funding round today is a sign that Salesforce is also happy with that close arrangement, which gives it a customization that its competitors lack.

“Qualified represents an entirely new way for B2B companies to engage buyers,” said Bill Patterson, EVP of CRM Applications at Salesforce, in a statement. “When marketing and inbound sales teams use this solution with Sales Cloud… they see a notable impact on pipeline. We are thrilled about our growing partnership with Qualified and their success within the Salesforce ecosystem.”

The Cybersecurity Executive Order – What It Means and What You Can Do

Cybercrime continues to be on the rise and is expected to cost businesses worldwide $10.5 trillion annually by 2025. High-profile attacks, including the recent DarkSide ransomware attack on the Colonial Pipeline, the SolarWinds attack, and the recent Hafnium 0-day Exchange vulnerability that led to cyber-attacks on thousands of public sector and private sector organizations, are just a few recent examples.

On May 12, 2021, United States President Biden signed the Executive Order (EO) on Improving the Nation’s Cybersecurity. The EO comes in the wake of an unprecedented year of major cyber events which have greatly impacted Government agencies and the private sector alike.

The intent of the EO is to initiate bold change to improve the Nation’s overall cybersecurity posture. The EO is focused largely on how government agencies protect their networks and extends to federal government vendors and contractors in an effort to improve the security posture of the Federal Government.

The Cybersecurity EO has been developed over the course of several months, but it has been thrust front and center in light of the Colonial Pipeline and Sunburst/Solarwinds attacks, which have disrupted gas distribution and left over 100k systems and their data easily accessible to hackers.

Through this EO, the Biden Administration is introducing several actions for the Federal Government, including:

  • Development of a cloud-service governance framework
  • Requirement to adopt best practices such as a zero-trust network (ZTX) architecture
  • Technological investments such as Endpoint Detection Response (EDR) and Multi-Factor Authentication (MFA)
  • Process improvements for the incident response lifecycle.

Ultimately, this EO aims to ensure that the Federal Government can protect, detect, and respond against the increased cyber-attacks and sophistication.

Most of the rules and requirements defined in the EO control how federal agencies handle security incidents but some also extend to procurement of hardware and software from the private sector. As the government is the largest purchaser of IT products, the goal is that vendors will place a greater focus on security and improve the security posture for the entire country.

The EO addresses 11 sections, with each detailing direct actions and timelines for organizing and implementing new administrative and technical resources and consolidating them under the Department of Defense and the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA).

In this post, we’ll discuss what these sections mean in practice and explain how your organization can implement practical changes to comply with the requirements of the EO.

Removing Barriers to Sharing Threat Information

Section 1 (Policy) outlines the current landscape and high-level policy goals to “identify, deter, protect against, detect, and respond to” malicious actors and organizations. While the Government is leading this initiative, it is necessary to partner with private industry to implement security practices to better ensure the security of their products, networks and organizations lest they become a threat vector for the Government.

Section 2 (Removing Barriers to Sharing Threat Information) directs that the Federal Acquisition Regulation (FAR), which defines the contractual rules to conduct business with the Federal Government, be updated to require the sharing of threat and incident information with CISA. This contractually obligates private sector contractors to provide full cyber visibility to the Government.

SentinelOne autonomously prevents, detects and mitigates any known and unknown threats in real-time, effectively  and seamlessly with maximal visibility to the SOC Analyst in organizations around the world.

Organizations looking to address the requirements of Section 2 can leverage Deep Visibility and STAR to meet their regulatory needs and better protect their business.

  • SentinelOne’s Deep Visibility allows customers to obtain real-time and historic retrospective search capabilities, even for offline endpoints, to improve proactive security.
  • With Storyline Auto-Response (STAR) custom detection rules, you can turn Deep Visibility queries into automated hunting rules that trigger alerts and responses when rules detect matches. STAR gives customers the flexibility to create custom alerts specific to their environment that can enhance alerting and triaging of events.
Rapid Threat Hunting with Storylines
Time always seems to be on the attacker’s side, but security analysts can get ahead by hunting threats faster than ever before.

Modernization and Zero-Trust Architecture (ZTA)

Section 3 (Modernizing Federal Government Cybersecurity) of the EO pushes the Government to advance towards adopting zero-trust architectures (ZTA), accelerate migration to secure cloud services and to adopt multi-factor authentication. The Government is to lean away from outdated security models and towards secure cloud services.

Many of these initiatives are in place or underway in many agencies, but this sets definitive timelines for implementation and reporting on the status of their progress for added accountability.

SentinelOne provides capabilities that allow agencies to follow the principle of least privilege (PoLP). This is achieved by supporting multi-tenancy with Role-Based-Access-Control (RBAC). This allows customers to define who sees what and what actions individuals can take based on their own respective scope.

Beyond that, SentinelOne welcomes the decision to adopt zero-trust architecture (ZTA) for agencies and organizations. Endpoints represent a large attack surface, with over 70% of breaches originating on the endpoint.

Organizations have a heterogeneous mix of endpoints connected to their network – whether they be laptops, mobile devices, servers, or IoT devices. These machines often have different configurations, patch statuses, and operating systems, leading to inconsistent approaches to applying security policy.

This problem is compounded by the rise of bring your own device (BYOD) and remote working practices accelerated by the COVID-19 pandemic. While security teams deploy controls to endpoints they can manage, there are a significant number of devices that remain unmanaged or unable to take a management agent.

Adopting Zero Trust for endpoints can assist organizations in reducing this risk by providing the means to monitor, isolate, secure, control, and remove any device from the network at any time. When integrated into a Zero Trust ecosystem, endpoints can provide valuable information when determining whether to grant access, including the device’s identity, health, and compliance status. SentinelOne’s approach to endpoint-centric zero trust provides cooperative capabilities for managing the hygiene, risk, and hardening of endpoints.

Ranger® IoT
Network Visibility & Control. A cloud
delivered, software-defined network discovery solution designed to add global network visibility and control with minimal friction.

Enhancing Software Supply Chain Security

Section 4 (Enhancing Software Supply Chain Security) requires greater Government visibility into their software supply chain. In the wake of SUNBURST, where the adversary leveraged SolarWinds to provide signed and trusted updates that were embedded with malware, it is a top priority to prevent something like that from happening again.

To assist in that effort, NIST is directed to publish guidelines that cover core security practices that vendors must implement and, when asked, provide evidence of the implemented best practices. The guidelines include:

  • Separate build environments
  • Audit trust relationships
  • Multi-factor authentication
  • Encrypting all data
  • Monitoring and reporting any cyber incidents
  • Use tools to maintain trusted source code chains
  • Check for any vulnerabilities before releasing code
  • Publish a Software Build of Materials (SBOM) that lists all components embedded in the software

This will eventually lead to a software rating system for vendors that can be used to demonstrate best security practices are being used.

Recent incidents like the SolarWinds attack demonstrate the growth of adversaries focusing on the supply-chain. In that particular instance, SUNBURST was unable to disable or bypass SentinelOne in any customer environments. We acknowledge the importance of this field and welcome the modernizing efforts in supply chain security.

Today, SentinelOne is protecting thousands of the world’s leading enterprises with the Singularity Platform. Protecting endpoints, cloud, and IoT attack surfaces with patented Artificial Intelligence tracking, SentinelOne replaces legacy and next-generation products with an autonomous platform to further support the U.S. public sector.

SentinelOne has achieved the coveted FedRAMP designation, which enables U.S. federal government customers to leverage the most innovative endpoint security solution from the fastest-growing cybersecurity company in the market.

2020 MITRE Engenuity ATT&CK Evaluations
Watch the webinar to learn about SentinelOne’s record-breaking results.

Responding To Cyber Incidents and Vulnerabilities

Section 5 (Establishing a Cyber Safety Review Board) establishes a Cyber Safety Review Board to act as a strike team to respond to significant cyber incidents in the same manner the National Transportation Safety Board (NTSB) investigates and reports on civil transport accidents. This board will include stakeholders from across the Government including DOJ, DOD, CISA and NSA along with representatives from private sector entities and lead by a board appointed by DHS.

Section 6 (Standardizing the Federal Government’s Playbook for Responding to Cybersecurity’s Vulnerabilities and Incidents) creates a standard playbook for responding to cybersecurity vulnerabilities and incidents to be used across the Federal Government. This will document procedures used to identify, remediate, and recover from vulnerabilities and incidents affecting their systems.

SentinelOne provides various security automation and response (SOAR) capabilities that aid security professionals during Digital Forensics Incident Response (DFIR) type activities. Through SentinelOne’s ActiveEDR capability, customers can automatically respond to most alerts. When manual intervention is required the Singularity Platform offers various remediation and recovery options. All of the capabilities that are provided can also be orchestrated by leveraging the rich API ecosystem around the SentinelOne solution.

Section 7 (Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks) focuses on improving detection of vulnerabilities and incidents on Federal Government networks. Here the Government acknowledges that traditional antivirus is not enough, and that Endpoint Detection and Response (EDR) capabilities are required to be able to perform “active cyber hunting, containment and remediation, and incident response”.

ActiveEDR, powered by SentinelOne’s patented Storyline technology, provides analysts with real-time, actionable correlation and context and lets security analysts understand the full story of what happened in their environment.

Storyline automatically links all related events and activities together with an attack chain and a unique identifier. This allows security teams to see the full context of what occurred within seconds rather than needing to spend hours, days, or weeks correlating logs and linking events manually.

SentinelOne’s behavioral engine tracks all activities on the system, including file/registry changes, service start/stop, inter-process communication, and network activity. It detects techniques and tactics that are indicators of malicious behavior to monitor stealthy behavior and effectively identify fileless attacks, lateral movement, and actively executing rootkits.

SentinelOne automatically correlates related activity into unified alerts that provide campaign-level insight. This reduces the amount of manual effort needed, helps with alert fatigue, and significantly lowers the skillset barrier of responding to alerts.

Improving Investigative and Remediation Capabilities

Section 8 (Improving the Federal Government’s Investigative and Remediation Capabilities) focuses on the importance of accurate and complete data logging to be able to properly investigate cyber incidents.

The EO requires recommendations on the types of logs to be maintained, the time periods to retain the logs (i.e., retention) and other relevant data, the time periods for agencies to enable recommended logging and security requirements, and how to protect logs.

SentinelOne provides access and visibility into your environment for 365 days and beyond to let you analyze incident activities and conduct historical analysis.

The ability to look back into any point in time allows analysts to see if the threat has targeted the organization in the past and view the full stream of information on how that attack occurred, including the entire process tree, timeline, and related activities.

SentinelOne data retention capability also provides the answer to your compliance needs across different data retention and audit requirements. Allowing customers to be ready for audits including PCI DSS, HIPAA, NIST, and more, by leveraging connected data insights across multiple endpoints.

SentinelOne Singularity XDR
See how SentinelOne XDR provides end-to-end enterprise visibility, powerful analytics, and automated response across your complete technology stack.

Conclusion

While much more remains to be done to fully address the worsening cyber threat environment, this Executive Order takes a number of necessary steps to strengthen American cybersecurity. SentinelOne’s suite of autonomous endpoint protection products is ideally suited to help federal agencies meet the requirements and goals laid out in the Order, and we look forward to engaging with federal decision makers and being a part of these critical efforts to secure federal networks.

If you would like to learn more about how SentinelOne can help your organization meet its security goals, contact us for more information or request a free demonstration.


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Invoca acquires DialogTech for $100M to expand its conversational intelligence tools

On the heels of expanding its marketing call analytics platform last year to provide more insights to help those in sales, e-commerce and customer experience, Invoca is making its first acquisition to widen the net of companies that it targets. The company has acquired DialogTech, a startup that builds tools for marketers to analyze inbound phone calls and other contacts, in what TechCrunch understands to be a $100 million deal.

As part of the transaction, Santa Barbara-based Invoca will be divesting Swydo, a company that Chicago-based DialogTech acquired in 2018. Swydo — originally from The Netherlands — will remain a partner of Invoca’s, the company said.

Invoca has up to now focused on larger consumer-facing enterprises — its customers include the likes of ADT, AutoNation, DISH, TELUS and The Home Depot — providing them with an AI-based platform that lets their marketing, sales and other teams analyze calls from consumer customers and provide call tracking, coaching and other insights in real time and in the form of post-call reports to help those teams do their jobs more easily.

Gregg Johnson, Invoca’s CEO and one of a growing pool of Salesforce veterans who are reinventing the marketing and sales technology landscape, described DialogTech as “complementary” to what Invoca does, but will specifically help Invoca better target mid-market companies.

The opportunity that both Invoca and DialogTech have identified is that, despite the growth of digital media advertising, social media and other channels for brands to connect to would-be customers, inbound calls remain a very key part of how companies sell goods and services, especially when the sale is of a complex item.

“About 40% to 80% of revenues come through contact centers,” Johnson said. “Brands can do all the retargeting they want but the same strategies in digital don’t work there.”

For those working at the other end of the line, the need for tools to do their jobs better became even more pressing in the last year, a time when customers stayed home and away from physical stores, shifting all of their interactions to virtual and remote channels. Subsequently, they demanded and expected better levels of service there.

“This move enables us to be an even better partner to enterprises and agencies looking to optimize their marketing and drive sales,” said DialogTech CEO Doug Kofoid, in a statement. “Together as Invoca, our combined company will deliver an unrivaled solution for conversation intelligence, with the most innovative technology, expertise, experience, and resources in our industry.”

The combined business will become one of the bigger “martech” startups focusing on conversational insights, with 2,000 customers, more than 300 employees and on track to make more than $100 million this year in revenue. This is, however, just the tip of the iceberg: The conversational intelligence market was estimated to be worth some $4.8 billion in 2020 and is expected to balloon to nearly $14 billion by 2025.

Given how many startups we’ve seen launch in the name of better sales intelligence, it’s likely that this will not be the last piece of consolidation in the area. Combining to expand the functionality of a platform, or to expand the scale and reach of a business, or simply to bring on interesting tech that is easier to acquire than build from scratch, are three areas that will likely drive more M&A.

Invoca last raised funding in October 2019, a $56 million round just ahead of the world shifting into COVID-19 pandemic mode. Johnson confirmed that Invoca — which has to date raised $116 million from Accel, Upfront Ventures, H.I.G. Growth Partners, Morgan Stanley, Salesforce Ventures and others — is in a strong enough position as a business not to need to raise more for this acquisition.

However, I suspect that scaling up like this will help it bid for bigger money and a bigger valuation when it does, as will the fact that peers in the market like Gong (which Johnson described to me as the “B2B version of Invoca”) have seen their valuations catapult in the last year, spurred by the changes in how customers interact with businesses, and sales and marketing can work to better serve them.

The Good, the Bad and the Ugly in Cybersecurity – Week 21

Everybody hates doing their taxes, except it seems a group of Russian cybercriminals, who were quite happy to “volunteer” to submit taxes on behalf of their victims. The gang utilized vulnerabilities in accounting software, obtained PIIs of American citizens, filed tax returns and redirected the IRS refunds into their own accounts, earning as much as $1.5 million meant for American taxpayers. But the good news is that this crime did not go unnoticed or unpunished. A joint task force led by the FBI and the Internal Revenue Service (IRS) has managed to arrest a Russian national, Anton Bogdanov (aka “Kusok”), extradite him and sentence him to 5 years imprisonment for Cyber Tax Fraud. Bogdanov will also pay $476,713 in forfeiture.

US Law enforcement agencies showed the same tenacity even when pursuing minor crimes associated with Hot Dogs. Salvatore A. La Rosa from San Jose pleaded guilty to hacking into concession stands at Paypal Park, home of Major League Soccer team the San Jose Earthquakes. La Rosa was fired from Spectra, the concessions contractor for the stadium. Seeking revenge, he hacked into Spectra’s mobile menu Point-of-Sale tablets before the first home game of the season, disabling the menu selections and the ability to accept credit cards, resulting in numerous hungry (and angry) customers and a total loss of $268,000. He’s facing up to 10 years in prison.

The Bad

But let’s not let the success of law enforcement and the courts in putting cyber criminals behind bars confuse us. The battle between cyber criminals and the rest of the world rages and they are all too often on the winning side. One very recent concern is ransomware payouts, which are ballooning. According to one study, these increased 171% from $115,123 in 2019 to $312,493 in 2020, and other research states that the total amount paid by ransomware victims increased by 336% in 2020, totaling $370 million. The figures for 2021 already look like they’re going to bust that amount and then some.

Last week’s Colonial Pipeline payout of $4.4 million to the DarkSide gang was just the tip of the iceberg. According to some sources, DarkSide has netted over $90 million in Bitcoin during their 8 months of operation. Analyzing the amounts received from their victims suggest that this group’s average payout is around $1.9 million.

But even these sums pale by comparison when considering the recent revelation that earlier this year, CNA Financial paid $40 million to free itself from ransomware. There have been even higher ransomware demands reaching $50 million (Apple, Acer), but it is unknown at the moment if these were met.

The Ugly

But the ugliest side of ransomware isn’t the financial damage to victims. It is the devastating effect it has on the ordinary people who are hurt as a consequence of critical infrastructure being crippled by these attacks. And the worst case is when it hits the healthcare sector. This week it was Ireland’s turn to feel that pain.

Health Service Executive (HSE), Ireland’s national healthcare system, responsible for the provision of health and personal social services, has suffered a devastating ransomware attack. Starting last Friday, the Department of Health network has been suffering disruptions to healthcare operations across the country, including delayed surgeries, delays in getting COVID-19 test results and emergency staff resorting to using pen and paper.

The Irish National Cyber Security Centre released an initial report stating that Conti ransomware was the cause of the disruptions. Later, the ransom note surfaced stating that the attacks had encrypted file servers and SQL servers.

Prior to encryption, the attackers exfiltrated more than 700GB of personally identifiable information (PII) including addresses and phone numbers of patients, doctors and nurses, payroll information and employment contracts. Some of this information has already found its way to the Darknet, according to reports. Although HSE is now said to be in possession of a decryptor that may have been provided for free by the gang itself, the cyber criminals are still demanding around $20 million not to leak further data, a sum the Irish Prime Minister refuses to pay.


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security