Companies need to embed cybersecurity into the DNA of their organizations to combat potentially disastrous cyber threats by state actors and individuals. This is the message that Richard Clarke, former National Coordinator for Security, Infrastructure Protection and Counter-Terrorism for the United States, gave cybersecurity executives at CISOs Connect San Diego 2019.

Clarke told CISOs attending the conference about the chilling impact of cyberwar by state actors such as Russia, Iran, North Korea and China which are focused on causing “disruption” to Western states. This might range from getting access to power grids so they can cause mayhem by switching off power, to infiltrating into weapons systems as well as attacking private corporations. 

Clarke said the biggest security threats facing the United States and other Western countries were from cyber threats by state actors. Clarke is about to publish a book on his research called The Fifth Domain: Defending the Country, Our Companies, and Ourselves in the Age of Cyber Threats. In this book, he studied companies that fell victim to hackers but more importantly companies that withstood cybersecurity attacks. He found that companies that withstood cyberattacks all had three common features that all companies could adopt. These were governance, funding and a cyber aware culture.

In terms of governance, Clarke said that companies that withstood attacks all had the CISO reporting directly to the CEO, the CFO, or the Board. He said there was a natural conflict of interests between the KPIs of a cybersecurity unit and the KPIs of a CIO role As a result, companies that took cybersecurity seriously should have their CISO reporting to the C-suite or board. 

“The governance part sounds untechnical. It sounds trivial. I think the governance part is key. The key difference between the companies that succeed and the companies that don’t is who the CISO reports to. If a CISO is reporting to the CIO then you are in trouble,” he told leading CISOs at CISOs Connect, a knowledge sharing and thought leadership conference run by Security Current.

“A CIOs’ interests are in keeping up the network, keeping everything easy to use. That is inherently in conflict with cybersecurity,” he said. 

Clarke added that it was essential for cybersecurity to be embedded into the culture of the organizations. This involved designing cybersecurity into company strategy and operations from the onset,  to a security mindset from the board level all the way down to the trenches.

“It is possible (not to be hacked). You have to get the governance right. You have to create a culture of security that starts at the board level and goes all the way down. Every company needs a culture of security, the right governance model and the right spend model,” he said. 

He said that cybersecurity spending should probably be around eight percent of the IT budget. For many companies, the cybersecurity spend might only be three percent, an amount which Clarke said was insufficient for combatting cyberthreats. Oftentimes, cybersecurity spending was in double digits after a company was hacked. “Companies are not paying enough to stop cyberthreats,” he said, warning that it was ultimately cheaper to spend more for a robust cybersecurity policy from the outset than having to spend after a breach. 

“They pay when they are hit, but they do not pay enough to defend it before they are hit. The amount of money you pay to stop a breach is a fraction of what you pay if you are hit,” said Clarke, who said that companies with a strong cybersecurity budget, or in some cases an open checkbook were less likely to be hacked based on his research. 

Clarke finished off his address to some of the U.S.’s leading CISOs by saying that companies cannot rely on governments. He said governments can do R&D and they can handle regulation. However, there is no replacement for a company implementing its own aggressive cybersecurity policy by acknowledging from the onset that a cyber breach is not a nuisance but a potentially disastrous outcome. 

He reminded the conference attendees that companies need to understand also that cybersecurity is a moving target as the technology changes as do the threats. “Companies need to design cybersecurity from the start.” 

CISOs Connect is the United States’s leading cybersecurity conference bringing CISOs together to share knowledge and best practices. It is run by Security Current and takes place twice every year with this year’s conferences taking place in Miami and San Diego.

The post Former U.S. government cyber-czar says cyberwar is a huge security threat but it can be combatted appeared first on Security Current.

Aqua Security has announced that it closed $25 million in a Series B round led by Lightspeed Venture Partners with existing investors TLV Partners , Microsoft Ventures and Check Point co-founder Shlomo Kramer taking part, bringing the total investment in the virtual container company to $38.5 million.

Based in Israel and San Francisco, Aqua said its Container Security Platform enables enterprises to secure their container applications from development to production, accelerating container adoption. It added that it bridges the gap between DevOps and IT security.

“The rapid rise and convergence of DevOps, containers, and microservices-based applications is an opportunity to rethink application security,” said Dror Davidoff, CEO and co-founder of Aqua Security said in a press release. “Aqua’s success in leveraging containers to improve security provides visible customer value, and we are thrilled to have Lightspeed on board as we continue to our next phase of growth.”

Founded in 2015, Aqua said it will use the round to continue to ramp up globally to ensure it’s “Secure Once, Deploy Anywhere” Approach to Application Security for what it calls the cloud-native era can become ubiquitous despite the current complexity. It said that means working hard to become a part of various leading stacks, which is a resource intensive but worthwhile endeavor.

The post Container Security Company Aqua Security Raises $25 Million in Series B appeared first on Security Current.

Aqua Security has announced that it closed $9 million in a Series A round led by Microsoft Ventures with participation from existing seed investors TLV Partners and Check Point co-founder Shlomo Kramer, bringing the total investment in the secure virtual container company to $13.5 million.
Based in Israel and San Francisco, Aqua said its Container Security Platform delivers full visibility into container activity to allow organizations to detect and prevent suspicious activity and attacks in real time. It said it does this by combining smart default security profiles, behavioral analytics, and in-house cybersecurity research to create a comprehensive security and compliance envelope.
Kramer, who will joining Aqua’s board of directors, said: “Aqua’s amazing progress in bringing its platform to market and growing its customer base are indicative of how rapidly containers are being adopted by enterprises, and of the need for a new security approach for this new stack.”
Founded in 2015, Aqua said it would use the funds to expand – noting that it planned to double its staff in 2017.

The post Container Security Platform Company Aqua Security Announces $9 Million Series A Round appeared first on Security Current.

Cloud security company Avanan announced that raised $14.9 million in a Series A round led by Greenfield Cities Holdings, L.P. with participation from existing investors, Magma VC and StageOne Ventures, bringing the total investment to $16.4 million.
Headquartered in New York City with research and development in Israel, Avanan said its Cloud Security Platform provides protection for Software-as-a-Service (SaaS) and Infrastructure-as-a-Service (Iaas) products, including Amazon AWS, Box, Google and Office 365.
It said it does this using preconfigured cloud-based versions of security technologies from 60 vendors, including Check Point, Symantec, McAfee Palo Alto Networks and others.
Avanan founder and CEO Gil Friedrich said customers were moving to the cloud and wanted the same protection that was being provided on the network. “We wanted to allow them to secure their cloud with one easy-to-use SaaS platform that incorporates the technologies they already trust,” Friedrich said in a press release.
Founded in 2014, Avanan did not specify for what it would use the funding.

The post Cloud Security Company Avanan Raises $14.9 Million in Series A Round appeared first on Security Current.

Threat detection company Pwnie Express announced that it raised $12.9 million in a Series B round led by Ascent Venture Partners with investments from MassMutual Ventures LLC and existing investors .406 Ventures, Fairhaven Capital and the Vermont Center for Emerging Technologies (VCET).

Headquartered in Massachusetts, Pwnie Express provides continuous threat detection for wireless and wired devices in and around the workplace, which are potentially open pathways for attackers.

“Pwnie Express is uniquely positioned to deliver the device detection, identification and threat assessment platform required to secure business-critical data and infrastructure,” said Matt Fates, General Partner at Ascent Venture Partners who will be joining Pwnie’s board of directors.

Founded in 2009, Pwnie Express has raised $18 million in total funding. It did not specify what the funds would be for.

The post Threat Detection Company Pwnie Express Raises $12.9M in Series B Funding appeared first on Security Current.

Industrial Internet of Things (IoT) company, Bayshore Networks has announced that it has closed $6.6 million in Series A funding led by Trident Capital Cybersecurity.
Headquartered in Maryland, Bayshore was founded in 2012 to help protect industrial enterprises against Internet-based cyberattacks. It said the term “Industrial Internet” refers to the convergence of networked applications and sensors with industrial machinery and processes.
Bayshore said its cloud-based software, called the Bayshore IT/OT Gateway, provides IT departments with visibility into Operational Technology (OT) infrastructure, networks, applications, machines and workers.
“Trident Capital Cybersecurity watched Bayshore Networks’ growth success for nearly two years as it achieved its key milestones. “We chose to lead the Series A because Bayshore has been recognized as an innovator and early leader in an emerging cybersecurity segment that is largely untapped to date,” said Alberto Yépez, managing director of Trident Capital Cybersecurity, who will join Bayshore Networks board.
Bayshore said it would use the capital to extend its market reach. It did not specify details.

The post Industrial Internet of Things (IoT) Company Bayshore Networks Raises $6.6M in Series A Funding appeared first on Security Current.

Web application security company IMMUNIO has announced that is has secured $5 million in a series A sound led by White Star capital and previous investors.
Headquartered in Montreal, IMMUNIO offers what is calls runtime application software protection (RASP) to allow companies to deploy software into production securely.
IMMUNIO says the technology flags vulnerabilities within the application and immediately block attacks in real time while providing developers and IT operations teams information to understand where the vulnerability was and what  steps are needed to fix it.
“Cloud has brought such incredible advancements in the speed at which we build applications, and with hundreds of millions of applications on the web today, a huge portion are vulnerable. RASP allows for real-time protection while uniting the development and IT operation teams in their efforts to ensure applications are running smoothly and securely,” Zaid Al Hamami, CEO and Cofounder said in a press release.
Al Hamami said the funds would be used to accelerate their growth and bolster their management team, with Goran Begic, previously of Veracode, joining IMMUNIO as vice president of product and Richard April, previously of Cyber-Ark as vice president of marketing.
Launched in 2013, the latest round brings the total funding to $8.3 million.

The post Web Application Security Company IMMUNIO Closes $5M in Series A Round appeared first on Security Current.

Security analytics company SparkCognition has announced that it has closed $6 million in a Series B funding from CME Ventures and Verizon Ventures with existing investors taking part.
Texas-based SparkCognition said it is applying machine learning and artificial intelligence to identify potential attacks, allowing for more accurate risk mitigation policies. It said it is using patent-pending algorithms to deploy a data-driven analytics platform for clouds, devices and Internet of Things.
“We are already well on our way to an AI-powered Industrial IoT Revolution – where cognitive systems will truly augment human capabilities, but at machine speed and big data scale,” Amir Husain, Founder and CEO of SparkCognition said in a press release. “Our collaboration with CME Ventures and Verizon Ventures further validate the work we are doing at SparkCognition and speak to the industry needs we are addressing within the Industrial IoT and cyber security markets.”
SparkCognition did not specify what the funding would be used for.
Founded in 2013, SparkCognition has reportedly raised a total of $12 million.

The post Security Analytics Company SparkCognition Secures $6M in Series B appeared first on Security Current.

Social media cybersecurity company ZeroFOX has announced that it has raised $27 million in an angel round led by Silicon Valley venture firm Highland Capital, along with previous investors New Enterprise Associates (NEA), Genacast Ventures and Core Capital.

Headquartered in Baltimore, ZeroFOX provides detection and defense for social media threats, which Cisco’s 2015 Midyear Report (p 28) cited as the number one method for web-based attacks to breach organizational networks.

“Social media is the biggest change in the digital landscape over the past decade, and organizations are increasingly coming to terms with the risk exposure associated with social networking,” said Corey Mulloy, general partner at Highland Capital who joined the ZeroFOX board in conjunction with the round.

ZeroFOX said it will use the funds to accelerate engineering, global sales &  marketing, M&A activity and apply additional emphasis around its IP protection and defense.

Launched in 2013, the latest angel round follows earlier investments, bringing the total funding to $40.2 million.

The post Social Media Cybersecurity Company ZeroFOX Secures $27M in Series B Round appeared first on Security Current.

Datto Inc., the company that provided backups of Democratic presidential front-runner Hillary Clinton’s email accounts, today announced that it had raised $75 million in Series B funding, bringing the total investment in the round to $100 million. Technology Crossover Ventures (TCV) led the round.

The Connecticut-based company, which gained attention when it was revealed in October that it had turned over email data with the Clinton’s consent, was founded in 2007.

Datto, which says it provides a Total Data Protection Platform to safeguard customers’ business data no matter where it resides, on premises, virtual or physical servers or in a cloud-based SaaS application, said it was cash flow positive and would use the funds to expand its geographical reach.

“Since we are cash flow positive, Datto isn’t raising capital to fund operations, but instead, to enter new markets and build new products and technology,” Datto founder and CEO Austin McChord said in a release. “With this new investment, Datto is excited to be pushing ahead to build new technology and improve the experience for our MSPs and end users around the world.”

Ted Coons, general partner at TCV and new Datto board member added: “Cloud-based data protection holds great promise in ensuring information is always accessible and recoverable as more organizations conduct business in the cloud, and Datto has a tremendous opportunity to grow internationally in meeting this need.”

The post Company That Provided Backups of Clinton Emails Raises 75 Million In Series B appeared first on Security Current.