Open source cloud security firm Paladin Cloud has launched a new SaaS-based platform for enterprise cloud attack surface discovery and vulnerability management.
Built on the open source core of Paladin Cloud, the platform has a set of security policies implemented in code to serve as an extended policy management tool that integrates into multiple enterprise systems, providing a comprehensive view of security in multicloud environments.
“Our cloud security platform helps developers and security teams define their cyber asset attack surface, verify that security controls provide intended protection, and extend their security posture in cloud environments multiple and hybrid,” said Daniel Deeney, co-founder and CEO. of the Paladin’s Cloud.
Paladin Cloud was initially released in July 2022 on GitHub and is completely free to download and use. It is a multi-cloud offering with an improved UI/UX interface and integrates with federated identity platforms (eg Active Directory).
Attack surface discovery is a code-based security offering
The new cloud security platform is designed to provide continuous monitoring to identify and visualize digital assets while detecting vulnerabilities, misconfigurations and security risks. It also prioritizes security risks to help DevOps teams drive automated workflow and remediation.
The platform’s code-based, agentless cloud monitoring and alerting capabilities are combined with third-party enterprise system integrations to enable security teams to validate existing security controls and protections.
The product, for example, contains a plug-in for Qualys, a vulnerability scanner, where it automatically maps Qualys installations to the asset inventory of AWS Elastic Composite Cloud (EC2) instances. As a result of this mapping, it is able to identify blind spots and coverage gaps where Qualys is not installed and thus does not protect AWS EC2 instances.
“The Enterprise SaaS platform integrates seamlessly with cloud service providers, such as AWS, Azure, and Google Cloud, and with enterprise systems, such as Qualys, Tenable, Aqua, and Red Hat ACS. We also continue to add new plug-ins to the platform in systems widely deployed business,” Deeney said.
The platform’s “security as code” offering, which references several hundred pre-coded security policies from regulatory benchmarks such as CIS and NIST, as well as industry best practice policies from other organizational sources, it also allows organizations to code their own security. policies
“It’s great to see a new player in the cloud security posture management and cloud-native application protection platform spaces,” said Melinda Marks, senior analyst at ESG. “The move to security as code is popular because it’s a way to code security early in development processes to minimize misconfigurations or coding errors. We see this in the use of open source infrastructure as code, where you have templates that developers can use to set up their own infrastructure instead of waiting for IT or Ops to set it up.”
With pre-built code, the offering aggregates the assets and security findings of users, applications, products, business units and cloud services to impact a granular and continuous view of a customer’s multi-cloud environments.
Early adoption is promising
According to Paladin Cloud, early adoption by customers in financial services, technology and healthcare has revealed a 30% reduction in the attack surface in terms of exposure to vulnerabilities and threats.
“Paladin uses plug-in plugins to help organizations identify and visualize their assets in cloud environments, assess their cybersecurity protection, including the tools and policies they have in place for those assets, and then assess any gaps because they can apply the right tools or processes to all their assets,” Marks said. “It’s an innovative way for organizations to ensure that the applications they put in cloud environments have the right security processes and tools to protect them. It also helps speed up remediation with features where you can apply fixes to groups of assets.”
The platform automates incident management through ticket integrations like JIRA and Slack, alerts and notifications. Additionally, it implements reporting across multiple benchmarks and standards to improve governance and compliance.
Open source security solutions are popular compared to vendor solutions because it makes it easier for organizations to connect and use the solutions, compared to a solution where it can be difficult to get a trial version and go through a cycle of purchase There is a high rate of adoption of many open source security tools, such as testing tools, and some vendors are also using the open source tools to build products around them, Deeney said.
Copyright © 2023 IDG Communications, Inc.
Source link
Ikaroa is proud to announce that Paladin Cloud has launched a brand new tool for attack surface discovery and management. This new tool is a game-changer for the industry, allowing users to actively monitor and protect their networks from malicious activity and vulnerabilities.
The tool gives organizations the ability to discover, assess, and manage their Attack Surface, which is the sum of all digital assets, technology, and processes accessible to an attacker. Through this assessment, organizations can detect any weaknesses in their networks that could be exploited.
The tool is powered by Ikaroa’s cutting-edge technologies, which provide comprehensive attack surface analysis and deep-dive information on an entity’s most vulnerable assets. By leveraging the cloud-based system that Ikaroa provides, Paladin Cloud is able to provide users with a comprehensive approach to attack surface management.
This new tool is a revolutionary step forward for information security, allowing organizations to easily detect and remediate potential threats to their assets. With the help of Ikaroa’s powerful platform, Paladin Cloud can provide businesses with the peace of mind that comes with knowing their networks are safe and secure.
At Ikaroa, we are proud to be partnering with Paladin Cloud to bring this revolutionary new technology to market. We are committed to continuing to innovate and support the latest advancements in cyber security.
