Cloud Security
PR Newswire | October 30, 2023
Darktrace, a global leader in cyber security AI, today unveiled a new Darktrace/Cloud solution based on its unique Self-Learning AI. The new solution provides comprehensive visibility of cloud architectures, real-time cloud-native threat detection and response, and prioritized recommendations and actions to help security teams manage misconfigurations and strengthen compliance. When combined with insight from Darktrace solutions for network, email, apps, zero trust and endpoint, Darktrace/Cloud provides a deeper, contextualized understanding of the risks and threats currently facing an organization's digital estate.
According to a recent report, "Gartner anticipates over 99 percent of cloud breaches will be based on a customer error, account takeover or misconfiguration until 2027". Cloud environments are constantly evolving so security professionals need to increase the level of visibility while keeping up with changing compliance, risk and security requirements. The rise of cloud-native technologies including containers, Kubernetes and microservices also require new tools and techniques for detecting and responding to known and novel threats.
Unlike static cloud security tools that provide snapshots of a specific point in time, Darktrace/Cloud is real-time, all the time. Our Self-Learning AI continuously learns patterns between workloads, assets, policy configurations and identities to provide a dynamic view of cloud architectures. We analyze the entire cloud stack from data to control plane, combining an understanding of architecture and network with a new flexible, scalable deployment model, said Jack Stockdale, Chief Technology Officer, Darktrace. Our innovative approach to cloud security is built on more than a decade of leadership in Cyber AI that is already protecting our customers' critical business areas from network and email to operational technology.
Available today, the new capabilities in Darktrace/Cloud include:
Comprehensive visibility and architecture modelingfor insights into the constantly changing nature of cloud environments. This visibility is constructed dynamically from configuration, network, users and identity and access management (IAM) data. Darktrace establishes patterns of life for cloud resources, identities, and services to understand who has access to what and how. This is critical for detecting anomalies and unknown threats.
Universal attack path modelingprovides a dynamic view of where attackers may look to move next. Darktrace brings together real-time cloud data and a deep understanding of your cloud environment with a platform approach that provides insights about risks from other covered areas of the business (e.g., network, email) to highlight potential attack paths and prioritize important assets to secure.
Unique real-time and cloud-native threat detection and responsethat provides a dynamic view of known and novel threats within the cloud. Darktrace combines deep cloud attack path knowledge with real-time anomaly and threat detection through cloud-native autonomous response actions, such as detaching a policy from a user or removing a workload from a security group.
Prioritized cloud posture managementthat starts by examining cloud configurations against common compliance frameworks. Where misconfigurations are detected, Darktrace provides a prioritized view of what to fix first, based on a risk profile generated from security and business context. Guided steps can be provided to help teams proactively address these before they become a significant issue.
Cost discoveryto provide a better understanding of cloud resource allocation. This helps teams contextualize their cloud resources according to security and business priorities.
Communication and collaboration capabilitiesto streamline workflows between security teams and DevOps teams. Tickets can be created on demand, teams can communicate directly via messaging platforms, and alerts and anomaly detections can be sent to Security Information & Event Management (SIEM) or Security Orchestration, Automation and Response (SOAR) products and the Darktrace Mobile app so they can be alerted on the go.
Flexible deployment optionsinclude an agentless deployment by default so organizations can be up and running in minutes. Teams can use the dynamic architectural view and risk context to decide where to deploy agents for enhanced real-time actions and deeper inspection.
Sykes Cottages, a cloud-native travel agency platform in the UK, has experienced significant growth in the last five years and has relied on the cloud to help them scale throughout this period.
"When it comes to cybersecurity, having visibility and an understanding of what you've got and your risks is critical. If I don't know it's there, I can't protect it," said Jonny Mattey, Head of Cybersecurity, Sykes Cottages. "Having a holistic, live view of our cloud environment enables us to work pragmatically and use AI to cut down management time so that we can address security risks and improve our resilience."
The new Darktrace/Cloud solution is now available on Amazon Web Services (AWS) through the AWS Marketplace, a curated digital catalog that makes it easy for customers to find, buy, deploy, and manage the third-party software they need to build solutions and run their business. Darktrace and AWS have been collaborating since 2017 to help organizations secure their AWS environments. Darktrace protects AWS environments for organizations around the world including Sunwest Bank and ProPhase Labs. Darktrace is an AWS Security Competency Partner and is part of the AWS ISV Accelerate program.
"Security is job zero at AWS," said Paddy Fitzpatrick, Director – Independent Software Vendors, UK & Ireland at Amazon Web Services. "As the threat landscape continues to evolve, the availability of AI-based tools like Darktrace/Cloud on the AWS Marketplace will help customers to gain increased visibility, and respond more effectively to security risks and threats."
Darktrace first extended its Cyber AI capabilities to cloud environments in 2016, applying its world class algorithms to granular network traffic. Darktrace/Cloud was recently named Cloud Security Product of the Year for Large Enterprises by Computing Magazine in its 2023 Cloud Excellence Awards.
ABOUT DARKTRACE
Darktrace (DARK.L), a global leader in cyber security artificial intelligence, is on a mission to free the world of cyber disruption. Breakthrough innovations in our Cyber AI Research Center in Cambridge, UK have resulted in over 160 patents filed and research published to contribute to the cyber security community. Rather than study attacks, Darktrace's technology continuously learns and updates its knowledge of 'you' and applies that understanding to optimize your state of optimal cyber security. Darktrace is delivering the first ever Cyber AI Loop, fueling a continuous end-to-end security capability that can autonomously spot and respond to novel in-progress threats within seconds. Darktrace employs over 2,200 people around the world and protects approximately 8,900 customers globally from advanced cyber threats. Darktrace was named one of TIME magazine's 'Most Influential Companies' in 2021. To learn more, visit http://www.darktrace.com.
Read More
Cloud Security
IBM | November 08, 2023
The cloud-native SIEM enhances scalability, speed, and flexibility while leveraging AI for improved alert prioritization and response.
Cloud-native QRadar SIEM is built on an open foundation, supporting interoperability with multi-vendor tools and cloud platforms.
IBM plans to introduce generative AI capabilities in early 2024.
IBM introduced a significant transformation to its flagship IBM QRadar SIEM (Security Information and Event Management) product. The new QRadar SIEM is redesigned on a cloud-native architecture tailored for hybrid cloud environments, with a strong focus on scale, speed, and flexibility. This update aims to empower security teams by enabling AI and security analysts to work together efficiently.
In fact, SOC professionals get to less than half (49%) of the alerts that they're supposed to review within a typical workday, according to a recent global survey.
[Source- Cision PR Newswire]
The cloud-native QRadar SIEM builds upon the strong foundation of its predecessor, offering efficient data ingestion, rapid search capabilities, and analytics at scale. It is based on an open foundation and is part of the QRadar Suite, IBM's integrated threat detection and response software portfolio.
As hybrid cloud environments expand and evolve rapidly, the security challenges become increasingly complex. The growing attack surface makes it difficult for security professionals to identify true threats amid the noise, leading to delayed threat responses. The new cloud-native QRadar SIEM addresses these challenges by leveraging AI to manage repetitive tasks and streamline the detection and response process for high-priority security incidents.
Built on Red Hat OpenShift, QRadar SIEM is designed to be open at its core, allowing for deep interoperability with multi-vendor tools and cloud platforms. It supports common detection rules (SIGMA) to quickly integrate crowdsourced threat detections from the security community. Additionally, it offers federated search and threat-hunting capabilities across various data sources, enhancing threat investigation across cloud and on-premises environments.
IBM's cloud-native SIEM includes AI capabilities that automatically prioritize alerts, reduce noise, and provide context for high-priority alerts. It streamlines threat investigations by running federated searches, creating visual attack timelines, and suggesting recommended actions. It plans to introduce generative AI (GAI) capabilities for QRadar Suite in early 2024. These AI capabilities will automate tasks like report creation, threat detection, log data interpretation, and threat intelligence curation. GAI is expected to enhance the productivity of security analysts, allowing them to focus on higher-value tasks.
The investment in cloud-native SIEM and AI integration reflects its commitment to delivering next-generation security operations technology. These advancements are designed to simplify security operations, reduce complexity, and provide security teams with the tools to effectively address today's complex threat landscape. The new cloud-native QRadar SIEM will be available as SaaS in Q4 2023.
IBM is actively working on its AI and data platform, watsonx, to enable generative AI to support security teams in automating routine tasks, accelerating threat response, and simplifying threat investigations. This represents a significant step toward more efficient and effective security operations.
Read More
Cloud App Management
Spectro Cloud | November 07, 2023
Spectro Cloud has unveiled its third annual ‘State of Production Kubernetes’ report, providing unique insights into the highly dynamic Kubernetes industry. The report, based on a comprehensive survey of 333 Kubernetes practitioners and decision-makers, reveals key trends and challenges facing the industry.
The research highlights that operations teams are grappling with increasing complexity as their Kubernetes environments expand. A significant 56% of businesses have more than 10 Kubernetes clusters, and 69% run Kubernetes in multiple clouds or other environments. Furthermore, 75% report issues affecting the running of their clusters, an increase from 66% in 2022.
The report also underscores the need for greater support for application developers. Despite the rise of platform engineering, 82% of operations teams struggle to provide developers with access to tailored clusters. Additionally, 37% report inconsistencies between development, staging, and production environments.
The study also points to application modernization as a pressing issue for cloud-native organizations. While all interviewees reported a ‘container first’ approach, they agreed that virtual machines (VMs) are here to stay. A significant 85% are migrating existing VM workloads to Kubernetes, and 86% aim to unify containerized and VM workloads on a single infrastructure platform.
The Spectro Cloud's report reveals challenges in Kubernetes, with 75% of operations teams facing issues with cluster management and 82% struggling to provide developers with tailored clusters. The report also highlights the persistence of VMs and security, compliance, and cost issues in edge computing. However, it also shows a growing trend towards Kubernetes, with a majority of businesses operating multiple clusters across various environments. The rise of platform engineering, migration of VM workloads to Kubernetes, and increasing adoption of Kubernetes in edge computing environments suggest a shift towards modernization and promising advancements.
Finally, the report indicates that edge computing is gaining momentum, with 49% actively piloting or using Kubernetes in edge computing environments. AI is a key driver for edge adoption, with investment expected to improve business processes and enable new connected solutions. However, significant challenges remain, particularly around security, compliance, and the costs of field engineering.
Spectro Cloud's third annual ‘State of Kubernetes’ report highlights these trends and challenges. The report aims to inspire new dialogue in the industry, particularly at events like KubeCon. The report is available for download and will be discussed in a webinar on November 30.
About Spectro Cloud
Spectro Cloud is a leading provider of Kubernetes management solutions. Its comprehensive platform allows organizations to manage the full lifecycle of diverse Kubernetes environments, whether small or large, new or existing, simple or complex, in data centers or the cloud. The company's unique approach offers IT teams complete control and visibility, enabling them to provide developers with flexible Kubernetes stacks and tools tailored to their specific needs, all while ensuring granular governance and enterprise-grade security.
Read More