New iboss Features, CVSS Scores, Praetorian GoKart, & Anti Anti-Money Laundering – ESW #239

So normally, when we mention tools, they're for defenders. In this case, this is a tool to help cybercriminals avoid airing their dirty laundry to law enforcement while laundering their criminal proceeds.

Close your eyes and imagine this: It's February 2005 and you read the headline: "Hollywood Video and Blockbuster are merging into a video rental empire!". What are your immediate thoughts, given you have 16 years of hindsight on the outcome for both those businesses? The real kicker? The big concern wasn't Netflix, it was whether the FTC would allow it, citing anti-trust concerns! I'm betting the press release definitely won't mention the fact that they're representing the absolute bottom, gutter end of low-margin, discounted, shrinking consumer cybersecurity software. Symantec has been on a rollercoaster - first with the split from Veritas in 2014 when they also combined with Blue Coat and shuffled the exec team. Then, in 2019, the company was split into consumer and enterprise, with the consumer side becoming Norton LifeLock and the enterprise side going to Broadcom, which consumed Computer Associates a while back.

Pitched as SOAR, but not really competing with the SOAR you're thinking of. This is much more focused on pure DevOps/Cloud-first startup-style environments.

Daniel Miessler is a very visible thought leader in the industry, so it's worth a mention when he starts a new gig. Especially interesting is that he (like many, many others) has been critical of Robinhood in the past, but took down a blog post he wrote last fall. http://web.archive.org/web/20201127174713/https://danielmiessler.com/blog/why-robinhood-is-dangerous-for-new-investors/ Overall, I see it as a positive development and I hope he can have some positive influence and impact on not just the security of the company and product, but on the company's ethics as well.

I need this single pane of glass, I'm not sure why, but I want it (I think?): "Calico provides automated capabilities to deliver an easy-to-understand and action-oriented view of Kubernetes networking, security and application layer that can be used to quickly resolve performance hotspots and troubleshoot connectivity issues. It provides a single pane of glass across multi-cluster and multi-cloud Kubernetes environments to deploy a standard set of egress access controls, enforce security policies for compliance, and observe and troubleshoot applications."

Oh right, so here's $20 million: "Baffle’s no-code, simple-to-deploy security mesh takes a data-centric approach at cloud scale without a performance impact or changes to applications."

"Automate use cases like event-driven certifications and custom approvals through APIs and event triggers, Accelerate innovation with easy drag-and-drop builder through no-code workflow, decreasing runtime and freeing up team power to focus on forward-looking projects, Connect to other SaaS applications, enabling a broad range of capabilities across a company’s technology ecosystem, Integrate into a customer’s cloud environment and SailPoint’s partner network" - This is hard as you have to have the right integrations with the right features and allow the user to tie it all together. I think we're getting closer, however, I also believe you will need people on staff that can write code to make it all work, at least for a while...

I can't see filling out the CVSS scoring form for each vulnerability in your environment. You really need a tool that will do that for you, based on generalized inputs to the system, or variables that can be inferred or discovered. For example, whether or not an asset is exposed to the Internet, whether or not the vulnerable application is being used and how much and how many instances of it do I have in the environment? I also believe you need a list, or a way to flag certain vulnerabilities, based on external factors, these you just patch. Vulnerabilities in Windows (like the recent string of print spooler vulnerabilities), select VPN appliance vulnerabilities, the recent sudo vulnerability, should just be fast-tracked regardless of CVSS score or environmental factors.

"Security misconfigurations are a constant threat against both APIs and non-API applications alike." - These often slip through the cracks, because often they are not in the code, but in the configuration. Web server configuration is often overlooked by developers, which is why I'm a huge fan of having a more well-rounded team so you can constantly evaluate security and improve security processes.

"GoKart puts Go code into single static assignment (SSA) form, structuring every value computed by the program as an assignment to a unique variable. SSA is used in compilers for optimization, and in a security context it helps trace the source of data used as input. Being able to follow data as it flows through a program, weaving in and out of objects and modules, is one of GoKart's primary features, and what makes GoKart so powerful."

"Takedowns-as-a-service is another part of this portfolio – especially for teams that don't have the time or expertise to launch and manage takedowns effectively. With an average of 1,100 impersonating domains registered against them each year, clients can ensure that malicious domains get taken down, and remain taken down. Digital Shadows custom intelligence provides additional threat intelligence tools for specific strategic or tactical requirements. This includes reporting into a VIP's exposure, tactical investigations into a suspicious domain, and deep investigations into an emerging tactic."