Tag: Integrated Risk Management Solutions

Finite State has released its Next Generation Platform, which includes extended SBOM management and the ability to ingest and aggregate 120+ external data sources. The new platform provides Application and Product Security teams with a unified and prioritized risk view, as well as unprecedented visibility across the software supply chain lifecycle, allowing them to scale operations through continuous, next-generation risk management. 

Matt Wyckhouse, CEO, Finite State commented, “There’s been a significant shift in the composition of enterprise software, and the cybersecurity market hasn’t kept pace to align with how software is built. 

AppSec and product security teams are looking to automate embedded system assessment and analysis so they can ensure security across any phase of product development, as risks in the software supply chain are increasing rapidly. Our Next Generation Platform is addressing the needs of software producers and consumers to drive down software supply chain risk with the peace of mind they need to ship or deploy connected products securely.” 

With the introduction of the Next Gen Platform, Finite State customers will be able to reduce risk continuously and confidently across “any-party” software, firmware, or applications using a single point of view. 

The AppSec and Product Security teams will be able to use external tooling and feeds to build the Software Bill of Materials (SBOM), which will list all vulnerabilities on software components and dependencies, already having over 2 billion data points of analysis. 

For any organization that needs complete visibility into their software supply chain in order to ship secure products, fulfill vendor and customer requests, and adhere to regulatory requirements, the SBOM has emerged as the output that is most important. 

In contrast to source code, binary SCA (software composition analysis) from Finite State breaks down binaries to help enterprise teams with continuous SBOM management capabilities reduce AppSec risk. 

Features of Finite State’s Next Gen platform include: 

The solution for creating, gathering, visualizing, and distributing SBOMs throughout your supply chain is known as an end-to-end SBOM solution. 

Risk management for unified appsec and product security: the ability to integrate all the tooling and intelligence used to secure products or systems, within the full context of the AppSec or Product Security environment, by ingesting data from 120+ scanners and feeds. 

Advanced guidance: Remediation advice generated or ingested for context-aware recommendations that aggregates and reconciles results from all scans. 

World-class binary SCA: Enhanced SBOM capabilities to dissect a good or asset into its various parts for a risk assessment that is laser focused. 

Intuitive scoring system: A strong scoring methodology that conveys the risk levels of a product or asset using a simple numerical scale and risk prioritization. 

Full VEX support: With advanced vulnerability intelligence correlation, you can import, and export all VEX formats. 

Shufti Pro has launched its risk assessment and eIDV services to assist global businesses in combating identity fraud and financial crimes, as well as complying with the ever-changing KYC/AML regulatory landscape. The risk assessment solution is a tool designed specifically to assist businesses in identifying risks associated with their globally diverse client base. 

Shufti Pro’s custom-built risk-scoring solution adapts to the needs of organizations while addressing every potential risk factor in order to protect businesses from financial crimes, reputational harm, and regulatory sanctions. 

It makes sure businesses make informed choices by assessing customer risk factors using unique questionnaires and fraud prevention data points, which are then further examined by the risk intelligence profiling engines of the Shufti Pro (a database of over 10B ID elements). 

The eIDV service uses a government-issued unique identifier number to verify customers. Except for the requirement for customer-provided paper-based document uploads, it functions similarly to the KYC process. 

With its unmatched security, Shufti Pro’s eIDV matches the clients’ data, including name, DoB, and SSN, against numerous databases. 

Due to improved privacy, fraud prevention, and the improvement of user experience, the digitisation of the modern world reveals that we are moving away from paper IDs and towards completely electronic forms. With these adjustments, customer onboarding will be made simpler, more accurate, and accessible to customers worldwide, effectively lowering the client abandonment rate. 

Victor Fredung, CEO of Shufti Pro stated, “As a global IDV service provider, Shufti Pro continuously innovates to meet an increasingly varied and diverse range of regulatory compliance requirements for our customers. We are dedicated to providing solutions that address the changing needs of our global clientele and the wider general market – both at the point of onboarding and beyond, and I am pleased to share that risk assessment and eIDV services do just that.” 

Shufti Pro recently added a slew of new features to its IDV suite, including SSO implementation, duplicate account verification, and more. The company raised $20 million in Series A funding last year to accelerate its international expansion, improve its IDV solutions, and expand its compliance suite. 

Exterro, a prominent supplier of Legal Governance, Compliance, and Risk (GRC) software has acquired Zapproved, a company well-known for its e-discovery software and is renowned for its excellent client results. The newest development in Exterro’s mission to enable clients to proactively manage their legal governance, risk, and compliance duties is the purchase of Zapproved by Exterro. It also marks a new strategic turning point for Exterro’s collaboration with Leeds Equity Partners, which first acquired the company in 2018 and finished a recapitalization last year.

Exterro gives legal teams the tools they need to proactively and legally manage their Legal Governance, Risk, and Compliance (Legal GRC) needs. The only comprehensive framework that automates the intricate relationships between privacy, legal operations, cybersecurity response, digital investigations, compliance, and information governance is our Legal GRC software. Our complete Legal GRC platform is trusted by thousands of legal teams in corporations, managed services providers, law firms, and governmental and law enforcement organizations to monitor their risks and provide successful results more affordably.

After the takeover of Zapproved is finalized, Vista Equity Partners (“Vista”) will continue to hold a tiny ownership share in the new business. The transaction’s financial details weren’t made public. Exterro provides a service that handles every stage of the forensic investigation and e-discovery process on a single, integrated platform.

“I have known Monica Enand, President and CEO of Zapproved, since the early days of both of our companies’ origins in Portland, Oregon. Since inception, we have shared a common vision for providing market-leading software and support for our clients and partners, and the combination of Exterro and Zapproved will continue that vision by delivering enhanced value to our constituents,” Bobby Balachandran, CEO and President of Exterro said, reminiscing about their past and looking forward to this partnership.

Converging market dynamics in e-discovery, digital forensics, and privacy have raised the demand for a comprehensive, integrated solution that can recognize, comprehend, and manage data contextually within a consistent, defendable procedure that rigorously ensures and preserves data integrity. One of the factors for Exterro’s acquisition of Zapproved was the need for modern businesses to respond to important business concerns within various disciplines as fast and affordably as possible.

Zapproved, a company established in 2008, creates user-friendly e-Discovery software to assist business legal teams in saving time, money, and risk in a legally sound manner. Zapproved has an uncompromising dedication to keeping its corporate customers incredibly successful, backed by unmatched security and customer service.

“Zapproved’s mission has always been to make our customers ridiculously successful,” commented Monica Enand, President and CEO of Zapproved. “We are confident that combining Exterro’s innovation engine with Zapproved’s world-class customer experience brings the best of the industry together in one powerful and easy to use solution that comprehensively addresses the critical business challenges facing our customers today,” Enand added.

Crisis24, a leading provider of global risk intelligence and security solutions, has announced the acquisition of Topo.ai, a cutting-edge mapping and location intelligence company. 

The acquisition will allow Crisis24 to enhance its capabilities in providing real-time, actionable information and analysis on risks and threats around the world. With Topo.ai’s advanced mapping and location intelligence technology, Crisis24 will be able to better identify, track, and respond to potential risks and security threats in a timely manner. 

Topo.ai’s technology uses a combination of satellite imagery, machine learning, and other data sources to create detailed, accurate maps of locations around the world. The company’s platform also includes advanced analytics tools for identifying potential risks and threats, such as natural disasters, civil unrest, and terrorist activity. 

The acquisition of Topo.ai will also allow Crisis24 to expand its reach and capabilities in the global market. The company currently serves clients in a variety of industries, including government, military, and private sector organizations. With Topo.ai’s technology, Crisis24 will be able to better serve its existing clients and reach new markets, such as emergency management and disaster response organizations. 

Gregoire Pinton, Managing Director and Head of Integrated Risk Management at Crisis24 said, “Topo.ai and Crisis24 have been partners for many years. In fact, several Topo customers are Crisis24 customers, so the cultural alignment is a natural one. Joining forces was the obvious next step, allowing us to offer unique and advanced capabilities in Critical Event Management, combining and amplifying our unique strengths. I strongly believe these united synergies will be of great benefit to our clients.” 

Phil Harris, CEO of Topo.ai stated, “We’re honored and excited to join forces with such a global champion in the risk management space like Crisis24. By bringing the timely intelligence capabilities of TopoONE to the team’s already leading arsenal of security operations, we’ll be able to provide an even more robust and tailored solutions approach to clients and the market at large.” 

The terms of the acquisition were not disclosed. The acquisition is expected to close in the coming weeks, subject to regulatory approvals. 

This acquisition is a significant move for Crisis24 and Topo.ai, and it is expected that it will be a major contributor to the way the companies will be able to provide the global market with advanced risk intelligence and security services. The integration of Topo.ai’s technology will help Crisis24 to be more proactive and to give more accurate information to their clients, giving them an edge in the market. 

Cyware has announced the adoption of the newly launched Traffic Light Protocol (TLP) standard version 2.0 to strengthen threat intelligence sharing capabilities within and between organizations worldwide.

The TLP standard is an essential system that aids organizations all over the world in sharing sensitive information with the necessary disclosure rules, the Forum of Incident Response and Security Team (FIRST) for the cybersecurity industry has updated it. In 2015, FIRST spearheaded efforts to harmonize and standardize the TLP to encourage greater sharing of threat information across industries, and Cyware has become one of the early adopters of the new standard.

Anuj Goel, CEO of Cyware commented, “The initiative to elevate threat intelligence sharing capabilities while keeping pace with the latest industry standards puts Cyware in a leading position with regards to adoption of the TLP 2.0 standard. In addition to providing large enterprises, MSSPs/MDRs, information-sharing communities (ISACs/ISAOs), and national CERTs with state-of-the-art threat intelligence-sharing, low-code security automation, and threat response solutions, Cyware has now taken one more step to enable organizations across the spectrum to modernize their information sharing initiatives to foster cybersecurity collaboration.”

Cyware Situational Awareness Platform (CSAP) helps businesses and information-sharing communities (ISACs/ISAOs) to precisely regulate the dissemination of sensitive threat intelligence, vulnerability, and malware advisories. Industry-leading ISACs and ISAOs from the healthcare, retail, energy, space, aviation, automotive, and other sectors use the platform extensively to share threat intelligence with their members and amongst themselves using the ISAC-to-ISAC sharing capability provided by Cyware.

TLP: WHITE has changed to TLP: CLEAR under the new TLP 2.0 standard, while a new TLP: AMBER+STRICT label has been added to highlight information that is only accessible within the recipient’s organization. There are four labels and a sub-label in the TLP standard. This comprises:

• No restrictions on disclosure; TLP: CLEAR.
• Limited disclosure to the community; TLP: GREEN.
• TLP: AMBER – Need-to-know basis restricted disclosure both inside the company and with clients.
• TLP: AMBER+STRICT – Limited disclosure within the organization only to those with a need-to-know basis.
• TLP: RED – Only one recipient may receive disclosure.

Chris Taylor, Director of ME-ISAC stated, “Since the ME-ISAC transitioned to Cyware’s threat intelligence sharing solutions for all of our alert distribution and indicator sharing, we have seen a huge increase in member engagement. The increased efficiency in writing and distributing alerts has enabled our analysts to spend more time focused on analysis instead of the tedium of alert authoring, and the incredible granularity in distribution options with the new TLP 2.0 support has enabled the distribution of alerts to be more focused so that our members receive just the alerts that are the most meaningful to them.”

Read More : Integrated Risk Management Platforms – All You Need to Know

Drata introduced Drata Risk Management, to enable customers to manage end-to-end risk programs by constantly monitoring, identifying, assessing, and treating risks. Following the recent launch of Drata’s Trust Center, Risk Management is now integrated into the company’s current platform to provide a more comprehensive view of developing and maintaining a healthy security posture. 

Adam Markowitz, Co-Founder, and CEO of Drata stated, “Drata aims to be the trust layer between our customers and those they do business with, and we know compliance automation is just one critical piece of that equation. Launching Risk Management and integrating it into our platform is one of the many steps we’re taking to address the maturing needs of customers advancing in their compliance journey.” 

Companies of all sizes and industries face a plethora of risks that can have long-term consequences for their security, reputation, and financial well-being, but monitoring risks frequently results in the management of cumbersome data sheets or siloed tools. With the majority of business executives unsure how or when their organization will be impacted by a cybersecurity incident, Drata’s Risk Management solution gives customers who already have a mature risk and compliance program a centralized view of all potential risks, allowing them to make strategic decisions across the organization and resolve issues quickly. 

The comprehensive Risk Management solution includes a risk register that creates and maintains a risk register to identify and analyze risks, proactively monitor, and manage risks, recognize evolving patterns, and more, as well as a library of more than 150 pre-mapped threat-based risks based on established sources such as NIST SP 800-30, ISO 27005, and HIPAA guidelines. 

Continuous automated monitoring to evaluate and proactively notify customers about the effectiveness of their controls to mitigate new or evolving risks. The Drata Control Framework (DCF) comes pre-mapped to Drata’s threat-based risk library as well as the requirements of multiple security and privacy standards and regulations for integrated risk and compliance. 

Tonya Thepthongsay, Director of Risk and Compliance at Rialtic commented, “Drata’s Risk Management module adds enormous value to our risk management program. Automating the relationship of risks to controls and tests in Drata gives us near real-time visibility to changes in our risk environment. The ability to assign risk owners and automate the follow up process elevates risk visibility and accountability throughout the business.” 

Forescout and Allied Telesis have announced a collaboration in which Allied Telesis’ Vista Manager Ex network management solution will be integrated with Forescout’s Continuum Platform. Customers can now leverage Forescout’s unrivaled device discovery capabilities to improve the security and manageability of their enterprise networks.

The integration of Vista Manager and Forescout provides complete network topology and endpoint device information. Vista Manager uses graphic visualization to quickly identify the connected network segment from the devices in the dashboard map. The map updates with any status change to ensure that the information is always up to date. The dashboard provides easy access to device discovery, visualization, monitoring, and traffic analysis features.

Digital resources, BYOD policies, and third-party devices, such as the Internet of Things (IoT), security cameras, and IP phones, all necessitate wired and wireless access on corporate networks. Prior to today’s explosion in the number and variety of devices in use, remote management was made possible by installing software agents on the devices themselves. Organizations must devise methods for collecting, visualizing, and controlling network assets while not overburdening operational staff to successfully manage this complex environment.

Allied Telesis’ Vista Manager is a graphical network dashboard that simplifies the management of enterprise wired, wireless, and wide-area networks. Originally designed as a graphical interface for the company’s network automation tool, Autonomous Management Framework (AMF), the latest update elevates Vista Manager to a true vendor-agnostic management solution.

Rahul Gupta, Chief Technology Officer at Allied Telesis commented, “We’re delighted to launch an integration with an industry leader like Forescout. Their agentless device discovery and automated security features are second-to-none, and together with our Vista Manager network dashboard, we have a powerful solution for enterprises that is very easy to use.”

The Forescout integration with Vista Manager provides simple plug-in style integration for easy Forescout Continuum installation. Forescout’s agentless discovery technology detects network devices automatically. Discovered devices are added to the network topology and labeled with meaningful icons so that they can be easily identified and controlled.

Read more Blogs:

Major Concerns of IoT Security in 2022

Fusion announced the expansion of its Dynamic Response capability as well as the launch of Fusion Intelligent Incident Manager to deliver agile and interactive resilience. Fusion Risk Management Inc. is a leading provider of operational resilience, risk management, and business continuity software and services. The new Intelligent Incident Manager is a purpose-built solution that allows businesses to identify the full scope of an incident and impacted assets or known outages.

Cory Cowgill, Chief Technology Officer at Fusion Risk Management stated, “The past two years have proven that organizations must remain agile and adaptable as disruptions continue to impact business as usual. Static response plans are no longer sufficient for businesses that need to operate in a layered threat landscape. Data-driven recovery strategies and response plays are increasingly critical. We are excited to offer our global customers these new agile capabilities to help businesses navigate chaos but also thrive during times of disruption.”

The enhanced Dynamic Response features build on already-existing capabilities to drive data-driven response plans that are customized for any business concern. Instead of using static plans to respond promptly when a disruption occurs, the new functionality makes use of dynamic response strategies. Response strategies are dynamic runbooks compiled in real-time based on a unified picture of business operations and the current operating environment. Through flexible diagnostic and remediation procedures that can be flexibly combined into plays based on what the situation commands, organizations will be able to reduce time spent on response planning.

Fusion’s Intelligent Incident Manager uses insights from scenarios and live response outcomes to inform greater agility in times of crisis. The functionality provides a centralized location for resolving critical incidents more quickly. With frictionless activation, organizations can focus on precision of response, more accurately forecast incident resolution time, and provide real-time updates to customers, partners, and internal teams.

Fusion’s new functionalities enable organizations to quickly understand the full impact of disruption and engage teams, critical partners, and response automation in response and recovery efforts by providing a dynamic approach to incident response. Organizations now could safeguard critical services and products by resolving incidents more quickly and preventing future occurrences.

Read more articles:

The Ultimate Guide to GRC in 2022!!