11 Dec How Data Theorem Brings Full-Stack Security to Multi-Platfo…
Many enterprises are going through the throws of digital transformation to expedite their movement into the cloud. However, with transformation comes challenges, namely in the form of reengineering applications that are not only efficient, but also secure. Palo Alto-based Data Theorem aims to proactively secure enterprise applications with its suite of products that potentially redefine what enterprise security is all about.
The Data Theorem approach
Data Theorem is taking a different approach to the cybersecurity problem and has created an integrated suite of services that bring automated security to the full application stack. The company took a long, hard look at the types of cyber issues many enterprises are facing today and discovered several inconvenient truths. For example, research revealed that 73% of enterprises are currently unable to remediate cloud-native application issues. What’s more, research reveals that it can take businesses as long as six months to detect a data breach. Simply put, those two statistics can spell big trouble for today’s enterprise, translating into a sobering conclusion in which a business can take far too long to discover a data breach and then is ill-equipped to remediate the issues that led to the breach itself.
Many enterprises are attempting to deal with those application security issues with multiple tools, dedicated staffers, and numerous intelligence sources, yet are still failing to keep critical applications and the associated data secure. Data Theorem dived into solving those problems by creating a platform of security tools that leverage automation, along with continuous validation and protection, which is offered as software as a service (SaaS).
The company’s full-stack application security solution offers security teams automated analysis and testing of modern applications, along with the associated APIs, cloud services, web frameworks, microservices, containers and so on. Ultimately, Data Theorem’s combination of automation, vulnerability scanning, application security testing and the ability to look at the full stack brings new meaning to the term web application security testing (appsec).
A closer look at Data Theorem components
Data Theorem offers multiple products / services which span the complete threat surface of current applications. The three primary service offerings are Mobile Secure, API Secure and Web Secure. As indicated by the names, each one of those services offers a setup of tools that are designed to address the security issues of its namesake.
Mobile Secure is designed to address the numerous security issues presented by devices and applications that fit into the moniker of “mobile devices,” a broad category that not only involves Android and iOS applications, but also the underlying technology and API services used by those devices–hence the concept of full-stack protection.
Basically, Mobile Secure analyzes and secures modern applications to prevent data breaches using automation, along with machine intelligence to lessen the burden on both developers and the cybersecurity professionals that work in an organization. Using Mobile Secure is surprisingly straightforward and basically starts with uploading subject applications into Data Theorem’s Analyzer Engine. The analyzer examines submitted applications, checks for backend APIs, third-party SDKs and libraries and subjects the application to static and dynamic analysis without the use of jail-broken devices. This is a critical differentiator, because theoretical vulnerabilities and low-probable exploits often waste time of development teams and hamper DevSecOps efforts.
Mobile Secure can directly look at binaries in App Stores, or users can manually upload applications, or even further automate application analysis via scripts that can integrate with Jenkins or other CI/CD pipeline management tools. In other words, Mobile Secure can be integrated directly into a build pipeline, bringing much-needed automation to the security elements of application creation and delivery.
Submitted binaries are put through an extensive set of security tests, including compliance validations, regional requirements, and numerous other checks, which can be driven by custom scripts. The analysis process is used to create alerts, remediation tips, as well as comprehensive reports that show the “health” of the submitted application. Mobile Secure also has the ability to further drive remediation by offering secure code snippets as well as other critical information, which can be delivered via Slack or other team communications applications.
Mobile Secure eliminates much, if not all, of the manual work that was expected by developers to secure mobile applications, allowing them to integrate full-stack security directly into the build lifecycle. What’s more, the service offers instant results on policy violations, compliance issues, or even fraudulent applications listed in third-party app stores.
API Secure, as the name implies, is a service that identifies potential attack surfaces that are created by APIs. The service scans for APIs, attempts to hack those APIs, and also discovers shadow APIs across an enterprise. Identifying and securing APIs has become one of the most critical steps for proper cybersecurity hygiene, especially since today’s applications can use hundreds of different APIs, some of which may be…