Data Theorem launches 'industry first' attack surface management solution
Modern application security provider Data Theorem has announced the launch of Supply Chain Secure, what it says is the industry's first attack surface management product to address software supply chain security threats across the application full-stack of APIs, cloud services, SDKs, and open source software.
Data Theorem identifies third-party vulnerabilities across the application software stack with continuous runtime analysis and dynamic inventory discovery that goes beyond traditional source code static analysis approaches and processing of software bill of materials.
High-profile security breaches such as SolarWinds, Kaseya, and Apache Log4j demonstrated the widespread damage that can occur for enterprise supply chains if third-party APIs, cloud services, SDKs, and open source software have security flaws, which allow hackers to infiltrate systems, initiate malicious attacks, and extract sensitive data.
These headlining hacks expose coverage gaps found in traditional static code analysis tools and the lack of security insights in most vendor management programs.
According to Gartner, seventy-two percent of business professionals expect their third-party networks to expand moderately or significantly in the next three years. Gartner stated that, by 2025, 45 percent of organisations worldwide will have experienced attacks on their software supply chain, a three-fold increase from 2021.
Current software supply chain security approaches have focused on either vendor management or software composition analysis. However, these approaches often lack source code access for mobile, web, cloud, and commercial-off-the-shelf (COTS) software, as well as third-party API services.
While neither approach can perform continuous runtime security monitoring, now with Data Theorems Supply Chain Secure product organisations can benefit from a full-stack attack surface management solution that delivers continuous third-party application asset discovery and dynamic tracking of third-party vendors.
Data Theorem's new supply chain product can automatically categorise assets under known vendors, allow customers to add additional new vendors, curate individual assets under any vendor, and alert on increases in policy violations and high embed rates of third-party vendors within key applications. These automated capabilities allow vendor management teams to remedy supply chain security problems faster and easier.
The Apache Log4j vulnerability highlighted how difficult the current state of dynamic asset discovery between first-party and third-party software can be for every organisation building and deploying software. Log4shell hacking that impacted over 3 billion devices globally illustrated the widespread risk that can occur with only a single exploitation in the software supply chain. The flaw showed how important generating an accurate software bill of materials can be to improving the security of third-party supply chain risk.
Data Theorem's Supply Chain Secure product ingests SBOM files from vendors and its Analyzer Engine can dynamically generate SBOM inventories based on the applications themselves. Comparing the delta between what has been documented as third-party software versus what the runtime application actually contains is an important aspect of any attack surface management effort to understand the real-world exposure of third-party software vulnerabilities.
According to a Gartner report, software bills of materials improve the visibility, transparency, security and integrity of proprietary and open source code in software supply chains. To realise these benefits, software engineering leaders should integrate SBOMs throughout the software delivery life cycle. The report further states, by 2025, 60 percent of organisations building or procuring critical infrastructure software will mandate and standardise SBOMs in their software engineering practice, up from less than 20 percent in 2022.
Gartner also mentions that, SBOMs are an essential tool in your security and compliance toolbox. They help continuously verify software integrity and alert stakeholders to security vulnerabilities and policy violations.
"While other software supply chain security approaches have emerged, no solution uses full-stack application runtime analysis and dynamic inventory discovery to support the challenges around vendor management," says Doug Dooley, chief operations officer at Data Theorem.
"Data Theorem's Analyzer Engine with attack surface management enables organisations to conduct continuous, automated security inspection with application telemetry collection," he says.
"This allows customers to have a better handle on the third-party software supply chain assets and exposures within their vendors, suppliers, and their own software stacks."
