computer security

Auto Added by WPeMatico

Otonomo raises $46 million to expand its automotive data marketplace

New vehicles today can produce a treasure trove of data. Without the proper tools, that data will sit undisturbed, rendering it worthless.

A number of companies have sprung up to help automakers manage and use data generated from connected cars. Israeli startup Otonomo is one such player that jumped on the scene in 2015 with a cloud-based software platform that captures and anonymizes vehicle data so it can then be used to create apps to provide services such as electric vehicle management, subscription-based fueling, parking, mapping, usage-based insurance and emergency service.

The startup announced this week it has raised $46 million to take its automotive data platform further. The capital was raised in a Series C funding round that included investments from SK Holdings, Avis Budget Group and Alliance Ventures. Existing investors Bessemer Venture Partners also participated. Otonomo has raised $82 million, to date.

The funds will be used to help Otonomo scale its business, improve its products and help it remain competitive, according to the company. Otonomo is also aiming to expand into new markets, particularly South Korea and Japan.

“We now have the expanded resources needed to deliver on our vision of making car data as valuable as possible for the entire transportation ecosystem, while adhering to the strictest privacy and security standards,” Otonomo CEO and founder Ben Volkow said in a statement.

Otonomo’s pitch focuses on creating opportunities to monetize connected car data while keeping it safe from the moment it is captured. Once the data is securely collected, the platform modifies it so companies can use it to develop apps and services for fleets, smart cities and individual customers. The platform also enables GDPR, CCPA and other privacy regulation-compliant solutions using both personal and aggregate data.

Today, Otonomo’s platform takes in 2.6 billion data points a day from more than 20 million vehicles through partnerships with more than automakers, fleets and farm and construction manufacturers. Otonomo has more than 25 partnerships, a list that includes Daimler, BMW, Mitsubishi Motor Company and Avis Budget Group. The company said it’s preparing to bring on seven more customers.

That opportunity for Otonomo is growing based on forecasts, including one from SBD Automotive that predicts connected cars will account for more than 70% of cars sold in North American and European markets in 2020.

Powered by WPeMatico

Decrypted: Space hacking, iPhone vulnerability, Zoom’s security boom

Security startups to the rescue.

As we continue to ride out the pandemic, security experts are closely monitoring the surge of coronavirus-related cyber threats. Just this week, Google’s Threat Analysis Group, its elite threat hunting unit, says that while the overall number of threats remains largely the same, opportunistic hackers are retooling their efforts to piggyback on coronavirus.

Some startups are downsizing and laying off staff, but several cybersecurity startups are faring better, thanks to an uptick in demand for security protections. As the world continues to pivot toward working from home, it has blown up key cybersecurity verticals in ways we never expected. To wit, identity startups are needed more than ever to make sure only remote employees are getting access to corporate systems.

Can the startups take on the giants at their own game?


THE BIG PICTURE

Another payments processor drops the security ball

For the third time this year, a payments processor has admitted to a security lapse. First it was Cornerstone, then it was nCourt. This time it’s Paay, a New York-based card payment processor startup that left a database on the internet unprotected and without a password. Worse, the data was storing full, plaintext credit card numbers.

Anyone who knew where to look could have accessed the data. Luckily, a security researcher found it and reported it to TechCrunch. We alerted the company; it quickly took the data offline, but Paay denied that the data stored full credit card numbers. We even sent the co-founder a portion of the data showing card numbers stored in plaintext, but he did not respond to our follow-up.

Powered by WPeMatico

Decrypted: Post-coronavirus, Auth0’s close call, North Korea warning, Awake’s Series C

Welcome to a look back at the past week in security and what it means for you. Each week we’ll look at the big news of the week and why it matters.

What will the world look like after the coronavirus pandemic subsides?

Some of us are now in our fifth week of sheltering in place, but there’s no fixed end-date in sight. We’ve gone from a period of confusion and concern to testing and mitigation. Now we’re starting to look ahead at the world post-coronavirus. Things still have to get done. But how do we regain a semblance of normality in the middle of a pandemic?

Tech can be the answer but it’s not a panacea; Apple and Google have explained more about their contact tracing efforts to help better understand the spread of the virus seems promising. But privacy concerns and worries that the system could be abused have raised justified concerns. On the other hand, with a U.S. presidential election slated for later this year, many experts want tech out of the picture in favor of a secure solution that uses paper ballots.

Will tech save the day, or will it kick us while we’re down? Let’s dive in.


THE BIG PICTURE

Voting by mail should be having its moment. Will it?

This year’s U.S. presidential election will still go ahead — it’s in the constitution as an immutable fact — but a pandemic throws a wrench in the works.

But security experts say electronic voting isn’t secure or resilient enough to protect from foreign interference. Even the more established mobile voting offerings have been shown to be deeply flawed.

Powered by WPeMatico

German security firm Avira has been acquired by Investcorp at a $180M valuation

Mergers and acquisitions largely grinded to a halt at the end of March, in the wake of the coronavirus pandemic spreading around the world, but today comes news of a deal out of Europe that underscores where pockets of activity are still happening. Avira, a cybersecurity company based out of Germany that provides antivirus, identity management and other tools both to consumers and as a white-label offering from a number of big tech brands, has been snapped up by Investcorp Technology Partners, the PE division of Investcorp Bank. Investcorp’s plan is to help Avira make acquisitions in a wider security consolidation play.

The financial terms of the acquisition are not being disclosed in the companies’ joint announcement, but the CEO of Avira, Travis Witteveen, and ITP’s MD, Gilbert Kamieniecky, both said it gives Avira a total valuation of $180 million. The deal will involve ITP taking a majority ownership in the company, with Avira founder Tjark Auerbach retaining a “significant” stake of the company in the deal, Kamieniecky added.

Avira is not a tech startup in the typical sense. It was founded in 1986 and has been bootstrapped (in that it seems never to have taken any outside investment as it has grown). Witteveen said that it has “tens of millions” of users today of its own-branded products — its anti-virus software has been resold by the likes of Facebook (as part of its now-dormant antivirus marketplace) — and many more via the white-label deals it makes with big names. Strategic partners today include NTT, Deutsche Telekom, IBM, Canonical and more.

He said that the company has had many strategic approaches for acquisition from the ranks of tech companies, and also from more typical investors, but these were not routes that it has wanted to follow, since it wanted to grow as its own business, and needed more of a financial injection to do that than what it could get from more standard VC deals.

“We wanted a partnership where someone could step in and support our organic growth, and the inorganic [acquisition] opportunity,” he said.

The plan will be to make more acquisitions to expand Avira’s footprint, both in terms of products and especially to grow its geographic footprint: today the company is active in Asia, Europe and to a lesser extent in the US, while Investcorp has a business that also extends deep into the Middle East.

Cybersecurity, meanwhile, may never go out of style as an investment and growth opportunity in tech. Not only have cyber threats become more sophisticated and ubiquitous and targeted at individual consumers and businesses over the last several years, but our increasing reliance on technology and internet-connected systems will increase the demand and need to keep these safe from malicious attacks.

That has become no more apparent than in recent weeks, when much of the world’s population has been confined to shelter in place. People have in turn spent unprecedented amounts of time online using their phones, computers and other devices to read news, communicate with their families and friends, entertain themselves, and do critical work that they may have in part done in the past offline.

“In the current market, you can imagine a lot are concerned about the uncertainties of the technology landscape, but this is one that continues to thrive,” said Kamieniecky. “In security, we have seen companies develop quite rapidly and quickly, and here we have an opportunity to do that.”

Avira has been somewhat of a consolidator up to now, buying companies like SocialShield (which provided online security specifically for younger and social media users), while ITP, with Investcorp having some $34 billion under management, has made many acquisitions (and divestments) over the years, with some of the tech deals including Ubisense, Zeta Interactive and Dialogic.

Powered by WPeMatico

Estimote launches wearables for workplace-level contact tracing for COVID-19

Bluetooth location beacon startup Estimote has adapted its technological expertise to develop a new product designed specifically for curbing the spread of COVID-19. The company created a new range of wearable devices that co-founder Steve Cheney believes can enhance workplace safety for those who have to be co-located at a physical workplace even while social distancing and physical isolation measures are in place.

The devices, called simply the “Proof of Health” wearables, aim to provide contact tracing — in other words, monitoring the potential spread of the coronavirus from person-to-person — at the level of a local workplace facility. The intention is to give employers a way to hopefully maintain a pulse on any possible transmission among their workforces and provide them with the ability to hopefully curtail any local spread before it becomes an outsized risk.

The hardware includes passive GPS location tracking, as well as proximity sensors powered by Bluetooth and ultra-wide-band radio connectivity, a rechargeable battery and built-in LTE. It also includes a manual control to change a wearer’s health status, recording states like certified health, symptomatic and verified infected. When a user updates their state to indicate possible or verified infection, that updates others they’ve been in contact with based on proximity and location-data history. This information is also stored in a health dashboard that provides detailed logs of possible contacts for centralized management. That’s designed for internal use within an organization for now, but Cheney tells me he’s working now to see if there might be a way to collaborate with WHO or other external health organizations to potentially leverage the information for tracing across enterprises and populations, too.

These are intended to come in a number of different form factors: the pebble-like version that exists today, which can be clipped to a lanyard for wearing and displaying around a person’s neck; a wrist-worn version with an integrated adjustable strap; and a card format that’s more compact for carrying and could work alongside traditional security badges often used for facility access control. The pebble-like design is already in production and 2,000 will be deployed now, with a plan to ramp production for as many as 10,000 more in the near future using the company’s Poland-based manufacturing resources.

Estimote has been building programmable sensor tech for enterprises for nearly a decade and has worked with large global companies, including Apple and Amazon . Cheney tells me that he quickly recognized the need for the application of this technology to the unique problems presented by the pandemic, but Estimote was already 18 months into developing it for other uses, including in hospitality industries for employee safety/panic button deployment.

“This stack has been in full production for 18 months,” he said via message. “We can program all wearables remotely (they’re LTE connected). Say a factory deploys this — we write an app to the wearable remotely. This is programmable IoT.

“Who knew the virus would require proof of health vis-a-vis location diagnostics tech,” he added.

Many have proposed technology-based solutions for contact tracing, including leveraging existing data gathered by smartphones and consumer applications to chart transmission. But those efforts also have considerable privacy implications, and require use of a smartphone — something Cheney says isn’t really viable for accurate workplace tracking in high-traffic environments. By creating a dedicated wearable, Cheney says that Estimote can help employers avoid doing something “invasive” with their workforce, since it’s instead tied to a fit-for-purpose device with data shared only with their employers, and it’s in a form factor they can remove and have some control over. Mobile devices also can’t do nearly as fine-grained tracking with indoor environments as dedicated hardware can manage, he says.

And contact tracing at this hyperlocal level won’t necessarily just provide employers with early warning signs for curbing the spread earlier and more thoroughly than they would otherwise. In fact, larger-scale contact tracing fed by sensor data could inform new and improved strategies for COVID-19 response.

“Typically, contact tracing relies on the memory of individuals, or some high-level assumptions (for example, the shift someone worked),” said Brianna Vechhio-Pagán of John Hopkins University’s Applied Physics Lab via a statement. “New technologies can now track interactions within a transmissible, or ~6-foot range, thus reducing the error introduced by other methods. By combining very dense contact tracing data from Bluetooth and UWB signals with information about infection status and symptoms, we may discover new and improved ways to keep patients and staff safe.”

With the ultimate duration of measures like physical distancing essentially up-in-the-air, and some predictions indicating they’ll continue for many months, even if they vary in terms of severity, solutions like Estimote’s could become essential to keeping essential services and businesses operating while also doing the utmost to protect the health and safety of the workers incurring those risks. More far-reaching measures might be needed, too, including general-public-connected, contact-tracing programs, and efforts like this one should help inform the design and development of those.

Powered by WPeMatico

How much should a startup spend on security?

One of the questions I frequently ask startup founders is how much they’re spending on security. Unsurprisingly, everyone has a different answer.

Startups and small companies are invariably faced with the prospect that they’re either not spending enough or are spending too much on something that’s hard to quantify in terms of value. It’s a tough sell to sink money into an effort to stop something that might one day happen, particularly for bootstrapped startups that must make every cent count — yet we’re told security is a crucial investment for a company’s future.

Sorry to break it to you, but there is no easy answer.

The reality is that each company is different and there is no single recommended dollar amount to spend. But it’s absolutely certain that some investment is required. We know because we see a lot of security incidents here at TechCrunch — hacks, breaches and especially data exposures, often a result of human error.

We spoke to three security experts — a head of security, a security entrepreneur and a cybersecurity fellow — to understand the questions facing startups.

Know and understand your threat model

Every company has a different threat model — by that, we mean identifying risks and possible ways of attack before they happen. Companies that store tons of user data may be a greater target than companies that don’t. Each firm needs to evaluate which kind of risks they face and identify weaknesses.

Powered by WPeMatico

SentinelOne raises $200M at a $1.1B valuation to expand its AI-based endpoint security platform

As cybercrime continues to evolve and expand, a startup that is building a business focused on endpoint security has raised a big round of funding. SentinelOne — which provides a machine learning-based solution for monitoring and securing laptops, phones, containerised applications and the many other devices and services connected to a network — has picked up $200 million, a Series E round of funding that it says catapults its valuation to $1.1 billion.

The funding is notable not just for its size but for its velocity: it comes just eight months after SentinelOne announced a Series D of $120 million, which at the time valued the company around $500 million. In other words, the company has more than doubled its valuation in less than a year — a sign of the cybersecurity times.

This latest round is being led by Insight Partners, with Tiger Global Management, Qualcomm Ventures LLC, Vista Public Strategies of Vista Equity Partners, Third Point Ventures and other undisclosed previous investors all participating.

Tomer Weingarten, CEO and co-founder of the company, said in an interview that while this round gives SentinelOne the flexibility to remain in “startup” mode (privately funded) for some time — especially since it came so quickly on the heels of the previous large round — an IPO “would be the next logical step” for the company. “But we’re not in any rush,” he added. “We have one to two years of growth left as a private company.”

While cybercrime is proving to be a very expensive business (or very lucrative, I guess, depending on which side of the equation you sit on), it has also meant that the market for cybersecurity has significantly expanded.

Endpoint security, the area where SentinelOne concentrates its efforts, last year was estimated to be around an $8 billion market, and analysts project that it could be worth as much as $18.4 billion by 2024.

Driving it is the single biggest trend that has changed the world of work in the last decade. Everyone — whether a road warrior or a desk-based administrator or strategist, a contractor or full-time employee, a front-line sales assistant or back-end engineer or executive — is now connected to the company network, often with more than one device. And that’s before you consider the various other “endpoints” that might be connected to a network, including machines, containers and more. The result is a spaghetti of a problem. One survey from LogMeIn, disconcertingly, even found that some 30% of IT managers couldn’t identify just how many endpoints they managed.

“The proliferation of devices and the expanding network are the biggest issues today,” said Weingarten. “The landscape is expanding and it is getting very hard to monitor not just what your network looks like but what your attackers are looking for.”

This is where an AI-based solution like SentinelOne’s comes into play. The company has roots in the Israeli cyberintelligence community but is based out of Mountain View, and its platform is built around the idea of working automatically not just to detect endpoints and their vulnerabilities, but to apply behavioral models, and various modes of protection, detection and response in one go — in a product that it calls its Singularity Platform that works across the entire edge of the network.

“We are seeing more automated and real-time attacks that themselves are using more machine learning,” Weingarten said. “That translates to the fact that you need defence that moves in real time as with as much automation as possible.”

SentinelOne is by no means the only company working in the space of endpoint protection. Others in the space include Microsoft, CrowdStrike, Kaspersky, McAfee, Symantec and many others.

But nonetheless, its product has seen strong uptake to date. It currently has some 3,500 customers, including three of the biggest companies in the world, and “hundreds” from the global 2,000 enterprises, with what it says has been 113% year-on-year new bookings growth, revenue growth of 104% year-on-year and 150% growth year-on-year in transactions over $2 million. It has 500 employees today and plans to hire up to 700 by the end of this year.

One of the key differentiators is the focus on using AI, and using it at scale to help mitigate an increasingly complex threat landscape, to take endpoint security to the next level.

“Competition in the endpoint market has cleared with a select few exhibiting the necessary vision and technology to flourish in an increasingly volatile threat landscape,” said Teddie Wardi, managing director of Insight Partners, in a statement. “As evidenced by our ongoing financial commitment to SentinelOne along with the resources of Insight Onsite, our business strategy and ScaleUp division, we are confident that SentinelOne has an enormous opportunity to be a market leader in the cybersecurity space.”

Weingarten said that SentinelOne “gets approached every year” to be acquired, although he didn’t name any names. Nevertheless, that also points to the bigger consolidation trend that will be interesting to watch as the company grows. SentinelOne has never made an acquisition to date, but it’s hard to ignore that, as the company to expand its products and features, that it might tap into the wider market to bring in other kinds of technology into its stack.

“There are definitely a lot of security companies out there,” Weingarten noted. “Those that serve a very specific market are the targets for consolidation.”

Powered by WPeMatico

No pan-EU Huawei ban as Commission endorses 5G risk mitigation plan

The European Commission has endorsed a risk mitigation approach to managing 5G rollouts across the bloc — meaning there will be no pan-EU ban on Huawei. Rather it’s calling for Member States to coordinate and implement a package of “mitigating measures” in a 5G toolbox it announced last October and has endorsed today.

“Through the toolbox, the Member States are committing to move forward in a joint manner based on an objective assessment of identified risks and proportionate mitigating measures,” it writes in a press release.

It adds that Member States have agreed to “strengthen security requirements, to assess the risk profiles of suppliers, to apply relevant restrictions for suppliers considered to be high risk including necessary exclusions for key assets considered as critical and sensitive (such as the core network functions), and to have strategies in place to ensure the diversification of vendors”.

The move is another blow for the Trump administration — after the UK government announced yesterday that it would not be banning so-called “high risk” providers from supplying 5G networks.

Instead the UK said it will place restrictions on such suppliers — barring their kit from the “sensitive” ‘core’ of 5G networks, as well as from certain strategic sites (such as military locations), and placing a 35% cap on such kit supplying the access network.

However the US has been amping up pressure on the international community to shut the door entirely on the Chinese tech giant, claiming there’s inherent strategic risk in allowing Huawei to be involved in supplying such critical infrastructure — with the Trump administration seeking to demolish trust in Chinese-made technology.

Next-gen 5G is expected to support a new breed of responsive applications — such as self-driving cars and personalized telemedicine — where risks, should there be any network failure, are likely to scale too.

But the Commission take the view that such risks can be collectively managed.

The approach to 5G security continues to leave decisions on “specific security” measures as the responsibility of Member States. So there’s a possibility of individual countries making their own decisions to shut out Huawei. But in Europe the momentum appears to be against such moves.

“The collective work on the toolbox demonstrates a strong determination to jointly respond to the security challenges of 5G networks,” the EU writes. “This is essential for a successful and credible EU approach to 5G security and to ensure the continued openness of the internal market provided risk-based EU security requirements are respected.”

The next deadline for the 5G toolbox is April 2020, when the Commission expects Member States to have implemented the recommended measures. A joint report on their implementation will follow later this year.

Key actions being endorsed in the toolbox include:

  •     Strengthen security requirements for mobile network operators (e.g. strict access controls, rules on secure operation and monitoring, limitations on outsourcing of specific functions, etc.);
  •     Assess the risk profile of suppliers; as a consequence,  apply relevant restrictions for suppliers considered to be high risk – including necessary exclusions to effectively mitigate risks – for key assets defined as critical and sensitive in the EU-wide coordinated risk assessment (e.g. core network functions, network management and orchestration functions, and access network functions);
  •     Ensure that each operator has an appropriate multi-vendor strategy to avoid or limit any major dependency on a single supplier (or suppliers with a similar risk profile), ensure an adequate balance of suppliers at national level and avoid dependency on suppliers considered to be high risk; this also requires avoiding any situations of lock-in with a single supplier, including by promoting greater interoperability of equipment;

The Commission also recommends that Member States should contribute towards increasing diversification and sustainability in the 5G supply chain and co-ordinate on standardization around security objectives and on developing EU-wide certification schemes.

Powered by WPeMatico

Satori Cyber raises $5.25M to help businesses protect their data flows

The amount of data that most companies now store — and the places they store it — continues to increase rapidly. With that, the risk of the wrong people managing to get access to this data also increases, so it’s no surprise that we’re now seeing a number of startups that focus on protecting this data and how it flows between clouds and on-premises servers. Satori Cyber, which focuses on data protecting and governance, today announced that it has raised a $5.25 million seed round led by YL Ventures.

“We believe in the transformative power of data to drive innovation and competitive advantage for businesses,” the company says. “We are also aware of the security, privacy and operational challenges data-driven organizations face in their journey to enable broad and optimized data access for their teams, partners and customers. This is especially true for companies leveraging cloud data technologies.”

Satori is officially coming out of stealth mode today and launching its first product, the Satori Cyber Secure Data Access Cloud. This service provides enterprises with the tools to provide access controls for their data, but maybe just as importantly, it also offers these companies and their security teams visibility into their data flows across cloud and hybrid environments. The company argues that data is “a moving target” because it’s often hard to know how exactly it moves between services and who actually has access to it. With most companies now splitting their data between lots of different data stores, that problem only becomes more prevalent over time and continuous visibility becomes harder to come by.

“Until now, security teams have relied on a combination of highly segregated and restrictive data access and one-off technology-specific access controls within each data store, which has only slowed enterprises down,” said Satori Cyber CEO and co-founder Eldad Chai. “The Satori Cyber platform streamlines this process, accelerates data access and provides a holistic view across all organizational data flows, data stores and access, as well as granular access controls, to accelerate an organization’s data strategy without those constraints.”

Both co-founders (Chai and CTO Yoav Cohen) previously spent nine years building security solutions at Imperva and Incapsula (which acquired Imperva in 2014). Based on this experience, they understood that onboarding had to be as easy as possible and that operations would have to be transparent to the users. “We built Satori’s Secure Data Access Cloud with that in mind, and have designed the onboarding process to be just as quick, easy and painless. On-boarding Satori involves a simple host name change and does not require any changes in how your organizational data is accessed or used,” they explain.

Powered by WPeMatico

Is your startup protected against insider threats?

We’ve talked about securing your startup, the need to understand phishing risks and how not to handle a data breach. But we haven’t yet discussed one of the more damaging threats that all businesses large and small face: the insider threat.

The insider threat is exactly as it sounds — someone within your organization who has malicious intent. Your employees will be one of your biggest assets, but human beings are the weakest link in the security chain. Your staff are already in a privileged position — in the sense that they are in a place where they have access to far more than they would as an outsider. That means taking data, either maliciously or inadvertently, is easier for staff than it might be for a hacker.

“Organizations need to understand that the threats coming from inside their organizations are as critical as, if not more dangerous than, the threats coming from the outside,” said Stephanie Carruthers, a social engineering expert who serves as chief people hacker at IBM X-Force Red, a division of Big Blue that looks for breaches in IoT devices before — and after — they go to market.

Insider risks can become active threats for many reasons. Some individuals may become disgruntled, some want to blow the whistle on wrongdoing and others can be approached (or even manipulated) by career criminals over debts or other matters in their private life.

There are plenty of examples, many not too far back in recent history.

Powered by WPeMatico