Hello and welcome to Protocol Enterprise! Today: what enterprises need to know for stopping the surge in identity-based cyberattacks, Mobileye files its plan for an IPO, and the latest in enterprise tech funding.
Stopping the most common breaches
Businesses are facing a surge in attacks that use stolen identity credentials — that’s now the largest source of breaches, according to Verizon.
Shutting down the hackers will require many enterprises to evolve their strategies, industry analysts and executives told me for our "Securing the Enterprise" special report.
- While abusing credentials has long been a part of the hacker playbook, identity-based attacks have risen to the forefront with so many employees now working outside of a corporate network firewall.
- “Identity has become that first level of defense. And that's a massive shift," said Vasu Jakkal, a Microsoft corporate vice president who leads the company's security business.
- In response, enterprises should explore deploying stronger authentication, making authorization technology a bigger focus, and getting improved visibility into their IT environments, according to experts.
When it comes to authentication, requiring at least two forms of verification to log in — aka multifactor authentication — remains a top recommendation.
- Unfortunately, many enterprises that have adopted MFA are still not in the clear, as hackers have been finding ways around certain configurations.
- Hardware security keys, such as Yubico's YubiKey, are considered a step up. Because a YubiKey requires the user to physically touch the device, completing the login “can't be done by a remote hacker,” said Stina Ehrensvard, Yubico’s co-founder and CEO.
- Meanwhile, the weakness of other second-factor options, such as push notifications and one-time passcodes delivered over SMS or authenticator apps, is becoming more glaring due to the recent wave of MFA-busting attacks.
- “I think the big question is, to what degree should we even allow these phishable configurations?” said Todd McKinnon, co-founder and CEO of identity platform Okta. “The argument is easier and easier to make that they shouldn’t even be allowed.”
Enhanced authorization technology for improved control of access and permissions is another top area for businesses to explore.
- Minimizing what users are authorized to access — even after successfully authenticating their identities — helps reduce what an attacker or malicious insider could exploit.
- Meanwhile, improved visibility can enable identity threat detection, allowing security teams to spot malicious behavior such as credential theft and misuse of credentials.
- Visibility into the use of unmanaged applications, often referred to as shadow IT, is essential to rounding out the identity security picture.
Ultimately, businesses will want to adopt a “defense in-depth” strategy that involves multiple layers of defense and recognizes that identity now plays an outsize role in the attacker playbook, Microsoft’s Jakkal said.
- “This is a world in which identity has now become the fabric of all security,” she said.
Read the full report here, and check out the rest of our special report on securing the enterprise.
A MESSAGE FROM AT-BAY
In 2021, there were 623 million cyberattacks worldwide. If there’s an opportunity to enter a business’s premises undetected, cybercriminals will find it. In the digital age, no organization is safe from cyberthreats. Size doesn’t matter.
Mobileye gets ready to IPO
The day has finally arrived: Intel’s self-driving technology unit Mobileye has unveiled its prospectus with the SEC, inching the company closer to the promised IPO Intel announced late last year.
Sensing an opportunity on the back of several high-quality IPOs that have performed amid difficult stock market conditions, Intel opted to roll out a major step toward listing the high-profile unit of the company. Intel acquired Mobileye for roughly $15 billion in 2017, but promised that it would take the company public in December of last year.
The potential Mobileye IPO arrives amid a tumultuous time on the stock market, as the U.S. Federal Reserve continues to hike interest rates. But investors may be willing to support high-quality issues of profitable companies such as Porsche. The sports-car brand listed last week in Europe and has performed admirably, according to a person familiar with IPO planning and execution.
As with every prospectus that gets filed, it’s worth pointing out that it doesn’t guarantee Mobileye will go through with the proposed listing. Intel could opt to hold or kill the plan at any point — which would likely occur if market conditions significantly worsened.
Intel is aiming for a valuation of roughly $30 billion, down from the $50 billion it had hoped to get earlier this year.
Mobileye has a strong business, and reported a net loss of $67 million on revenue of $854 million for the six months ending in July. Bernstein’s chip analyst Stacy Rasgon noted in a report that its revenue growth has been slowing as the company continues to scale but said it remains “still admittedly robust.”
There tend to be few chip company IPOs, so any new prospectus contains a wealth of information to pore through. We’ll have more on the details of the S-1 this week.
Securing the enterprise
In today’s global landscape, cybersecurity threats are something that every business operating on the internet must face — not just enormous tech companies. In this virtual Protocol event on Oct. 4 at 10 a.m. PT, we’ll examine the best practices for securing both large and small to medium-sized businesses, providing viewers with a true threat landscape and information they can use to make decisions about the strategy that best supports their business goals.
Protocol Enterprise’s Kyle Alspach will be joined by a great panel of speakers: Andrew Rubin, co-founder and CEO at Illumio; Alex Weinert, vice president and director of identity security at Microsoft; Jameeka Green Aaron, chief information security officer at Auth0; and Devdatta Akhawe, head of security at Figma.
Financial corner
Wasabi raised $250 million for its cloud storage services.
Workstream raised $60 million for its text-based recruiting tools.
Flatfile raised $50 million for its data onboarding software.
Arthur.ai raised $42 million to monitor and improve machine-learning models.
Ox Security raised $34 million to help stop software supply chain attacks.
— Aisha Counts (email | twitter)Around the enterprise
Microsoft has released mitigations for the recently disclosed Exchange vulnerabilities, but researchers said it’s possible to bypass them.
The Australian government said telecom Optus is definitively to blame for the company’s massive data breach, which was reportedly caused by the mishandling of an API.
Qualcomm has filed a paragraph-by-paragraph responseto a lawsuit from Arm, which accused Qualcomm of violating a license agreement.
A MESSAGE FROM AT-BAY
With the amount of our economy now dependent on technology, the lack of government regulation is resulting in major risk to companies, and in the end, our own citizens. In the absence of government action, insurance steps in.
Thanks for reading — see you tomorrow!