Hello there.
In our May edition, we observed a few activities in the Cloud Security space. Here we are in July - an interesting month, let me assure you. This summer, not only is the temperature rising, but the heat is also intensifying in the Cloud Security space — there's loads of CNAPP-ing snapping happening.
As we see more platformization and consolidation in the cloud security space, in our MI-One’s Issue #5, we'll offer our insights on how you can navigate and ensure that your third-party integration doesn't impact your end customers. We'll provide further insights into what we're seeing.
In case you missed June’s edition, you can find the full text here.
For this month’s edition, we bring you news from across the industry, with an emphasis on surface and endpoint security management - particularly where CAASM platforms and XDR approaches are concerned, including a big announcement from Microsoft.
Let’s begin! |
|
Under the Lens: Recent Developments in the Industry |
|
Cloud Security has been one of the dominant forces driving this year’s security space, starting with SentinelOne’s expansion of its Cloud Security capabilities through the acquisition of PingSafe in January, followed by Wiz acquiring Gem Security and CrowdStrike acquiring Flow Security in March, and Tenable acquiring Eureka and Fortinet acquiring CNAPP Lacework In June. To top it off, in July, there was an announcement that Wiz could be acquired by Alphabet (Google) - even if it remains unconfirmed. We also covered Orca and Aqua’s partnership in our April edition.
So, what does all this mean for your integrations? Well, there’s one point of caution. In our experience, cloud-to-cloud integrations can be easily disrupted if you are using any custom APIs that might not be supported by the new product roadmap. Similarly, if you are using a custom middleware for your on-prem app e.g. forwarder. As such, big changes like cloud adoption typically take time to reflect down to the user level. Nevertheless, we recommend you perform a quick hygiene check to determine if your natively built integration is actively used by customers.
Here’s a quick checklist: Authentication: Confirm proper authentication (e.g., OAuth, SSO) and user permissions. Compatibility: Verify version compatibility and required updates. API Accessibility: Test API endpoints, keys, and tokens. Data Synchronization: Ensure correct and timely data flow. Performance: Measure API response times and monitor for bottlenecks
Hunters Adoption of OCSF: The Open Cybersecurity Schema Framework (OCSF) is continually gaining traction, and Hunters is also joining the burgeoning ecosystem. Their recent announcement for full OCSF adoption with OCSF-native search capability validates their dedication to fostering a more collaborative and efficient security landscape. You can hear more about it from Yuval Itzchakov, CTO at Hunters here. Furthermore, the OCSF-native search functionality empowers analysts to query across different platforms through a single interface. We agree — unlocking data interoperability among security applications makes SOC analysts' lives—and everyone else's—easier!
ServiceNow continues to be one of the most popular platforms for integrations. Here’s a tip from our ServiceNow experts: To ensure that your ServiceNow Service Graph Connector is compatible with the most recent version (Washington) and the upcoming version (Xanadu) of ServiceNow, you will now need to leverage the Common Connection Framework. CrowdStrike and Hewlett Packard Enterprise (HPE) announced that they have joined forces to bolster security for artificial intelligence (AI) advancements, especially large language models (LLMs). This collaboration integrates CrowdStrike's Falcon platform with HPE's GreenLake cloud services and OpsRamp AIOps, offering a streamlined process for securing AI initiatives. The partnership aims to identify and address security vulnerabilities in AI pipelines, ensuring the integrity of AI solutions. It extends to securing AI workloads and LLMs, leveraging HPE and NVIDIA's joint AI solutions.
This partnership empowers organizations to confidently adopt AI across various environments, accelerating secure AI adoption.
A recent decision by Microsoft has caused quite a stir among various users: the company announced its decision to retire Office 365 connectors within Teams, which have been used to deliver updates directly from various services into channels.
|
|
Applications and Version Updates |
|
Microsoft Defender XDR's recent version updates include multiple advances: Incidents and Alerts Queues: Customize columns in the Incidents and Alerts queues in Microsoft Defender’s portal. Critical assets have become a part of the tags in the queues. Whenever a critical asset is involved in an incident or alert, its tag is displayed in the queues. Incidents are arranged as per the latest updates made to them.
Multitenant Management Enhancements: Content Distribution: Manage security policies (detection rules) efficiently across multiple tenants. Alert Filtering by Subscription ID: Simplify investigation by filtering Defender for Cloud alerts based on subscription IDs.
General Availability (GA): Endpoint Security Policies: Create and manage endpoint security policies for your tenants' devices within XDR. Alert Tuning with Severity and Title: Reduce alert fatigue by creating rules to hide or resolve alerts based on severity and title automatically.
Microsoft 365 Defender Integration: Unified Preview Settings: Manage all Microsoft 365 Defender preview features from a single location. SOC Optimizations: Integrate XDR with Microsoft Sentinel for streamlined security operations workflows.
Advanced Hunting Improvements: Search Across XDR and Sentinel: Search for incidents, alerts, and data across both XDR and Sentinel from the XDR search bar. Cloud Audit Events: Investigate cloud activity through advanced hunting of Microsoft Defender for Cloud audit events. Custom Detections with Sentinel Data: Create custom detections leveraging data from both XDR and Sentinel. Advanced Hunting Query API: Query Sentinel data using the advanced hunting query API for extended data retention.
To read in detail about these recent feature enhancements, be sure to peruse the official Microsoft Defender XDR documentation.
The latest upgrades and feature enhancements of Cisco Firepower Threat Defense (FTD) version 7.4.x are out and looking as follows:
|
|
Insights: From Our Integration Factory |
|
Okta Workforce Identity + CAASM: The integration between Okta Workforce Identity and a CAASM platform offers organizations an enhanced security posture through: Streamlined User Provisioning: Automate user provisioning across all your cloud applications, ensuring consistent access controls managed by Okta. This eliminates the risk of having a user account that exists in Okta without a corresponding account in the connected cloud application (managed by the CAASM platform) and simplifies access governance within the CAASM platform. Centralized Identity Management: Okta acts as a central repository that holds the definitive and most up-to-date information about user identities. This includes details like usernames, passwords (securely hashed), group memberships, access privileges, and any other relevant user attributes. The CAASM platform leverages this to enforce consistent access policies and security measures for all users. Adaptive Multi-Factor Authentication (MFA): Okta's MFA capabilities can be extended to the CAASM platform, adding an extra layer of security for accessing critical cloud resources.
Microsoft Defender XDR + XSOAR + IoT: In this integration, the data is fetched from MS Defender while the XSOAR platform maps the data based on the requirements of the IoT platform. This integration offers several advantages for improved device context and risk management: Enhanced Device Attributes: Fills in missing or inaccurate details like OS, version, MAC/IP, and hostname within IoT Security, leading to more complete device profiles. Improved Risk Identification: Leverages risk information from Microsoft endpoints within Defender XDR for a comprehensive risk assessment. This allows for better prioritization of security threats.
Microsoft Entra ID + XSOAR + IoT: Entra ID (formerly Azure AD) plays a vital role in managing IT infrastructure, including user access and device authentication. However, bridging the gap between Entra ID and IoT security devices requires an integration platform. This is where XSOAR comes in.
The XSOAR platform acts as the bridge between Entra ID and the IoT platform. It facilitates the seamless flow of device data from Entra ID to the IoT devices. This data, including user identities and device details, can be used to: Enhance security policies: XSOAR can leverage Entra ID data to create more granular security policies specifically for IoT devices. Implement granular access controls: By understanding user and device identities, XSOAR can enforce strict access controls for IoT devices, ensuring only authorized users can interact with them.
|
|
|
We'll be on the road once again in the coming months and would love to catch up if you're attending any! We will be at Black Hat USA, from 3—8 August at Mandalay Bay Convention Center, Las Vegas. Let’s meet up, email us at connect@metronlabs.com. If you’re not attending Black Hat, we hope to catch up on one of our road trips: Fal.Con, Las Vegas, 16-19 September Recorded Future PREDICT2024, Washington DC, 8-9 October OneCon, Las Vegas, 15-17 October AWS re:Invent, Las Vegas, 2-6 December
We’re also wishing all our valued newsletter readers in the ecosystem a delightful and productive summer! Whether you're enhancing your skills at industry conferences, collaborating on new projects, or taking a well-deserved break, summer can be many things to many people.
However, one old adage does bind us together:
Why do programmers prefer dark mode? Because light attracts bugs!
Okay, but in all seriousness, enjoy the sunny days ahead with bug-free integrations!
|
|
If any of these caught your eye, don’t hesitate to reach out to us for more details at connect@metronlabs.com. |
|