Cyber Nutrition, IT & Sec Funding, Private Equity Firms, & The Splunk/Cribl Battle – ESW #292

$401M Convertible Note offering, led by Owl Rock. Arctic Wolf is an MSSP/MDR firm with over 3000 customers and 1100 channel partners. The core of its offering is an XDR platform designed for SOC use with a concierge model, where Arctic Wolf's team helps out as needed.

$66M Venture Round that isn't labeled as a Series D, but follows a larger $75M Series C from 14 months ago. Led by Ten Eleven Ventures. I'm a big fan of training defenders with realistic simulations - Immersive has services that look somewhat similar to Recon InfoSec and Rangeforce (who we had on recently - episode 287!).

$45M Series B, led by Section 32. Malware discovery, analysis, and detection platform designed to complement AV and EDR tools. Great demo of the tool available on YouTube, hosted by Risky Biz's Patrick Grey here: https://www.youtube.com/watch?v=VgYoEzY6R04

$45M Series C, led by Third Point Ventures. Seems like an enterprise data privacy tool. Claims to integrate with over 1000 tools and streamlines the process of completing data subject requests (DSRs). This is one of the key features built into GDPR, where individuals have the right to request a copy of all data a company stores about them.

$25M Seed, led by Lightspeed Venture, Dell Tech Capital, and Sierra Ventures. IMO, this has "competitive Snyk ambitions" written all over it. The "SCA is not enough" line has been a familiar one over the past year, as we've seen new AppSec/software supply chain startups emerge. Star Wars reference?

$20M Series A, led by Canapi. Cyber insurance MGA - has an agent that, when installed on endpoints, alerts when it finds issues, which, when fixed, can raise a security score, which will lower insurance premiums.

$15M combined Series A and Seed, co-led by .406 Ventures and Energy Impact Partners. Oort appears to be an identity-specific Attack Surface Management play. They both look for configuration issues and potential threats, as well as publicly leaked or exposed credentials.

Vista Equity's latest take private is a $4.6B deal to acquire KnowBe4. The deal comes a few weeks after the initial take private offer went public. This follows a $16.5B acquisition of Citrix in January.

https://investors.forgerock.com/press-releases/detail/353/forgerock-to-be-acquired-by-thoma-bravo-for-2-3b

Yeah... we can tell! Look at how many funding announcements we have this week!!

The attack details are interesting, but that's not what I want to focus on here. What I'm trying to understand is how Binance loses over half a billion dollars while claiming "no users had lost money in the hack". How is the company absorbing a loss like this? It's unclear how much funding Binance has received, but it doesn't appear to be much, and the company doesn't appear to have done a raise since 2018. There were rumors that even Crypto.com had to raise some additional funding to cover the $30M they lost earlier this year. Afterwards, they implemented a $250k guarantee, copying the FDIC guarantee for banking customers. Does Binance make enough revenue from exchange fees to absorb this? Or do they have to dip into customer funds? This may partially be my ignorance, but I didn't think that crypto exchanges were like banks that are only required to have 10% of customer funds on hand at any given time? We've seen so many customers lose funds from crypto exchanges going bust (Celsius and Voyager, most recently), I can't imagine customers would be comfortable with this practice in 2022.

The 2022 Information Risk Insights Study (IRIS) from Cyentia is available. The IRIS series has done some very interesting deep dives into topics like extreme loss events and multi-party incidents (the Tsunami report). This report zooms way out to focus on the big picture insights that can be gleaned from large datasets (77k events) going back a decade.

Cyentia's analysts, writers, and data scientists apparently don't sleep (says the guy typing this at half past midnight), so here's another great report from them! This is the sequel to the excellent "Mitigating Ransomware's Impact" report, which also leverages Arete's dataset of ransomware incidents. One of the most compelling insights that came out of the first report was a potential correlation between MFA deployments and reduced likelihood of paying a ransom. I look forward to reading through this volume!

An interesting survey with a significant (900) sample size. Most interesting are some of the article's takeaways and the survey's assumptions, which I think help us understand why we're losing this fight in the first place: security teams may not be focused on the right things. There's a quote in the article: "If you're short-staffed, you can't have someone looking at every alert," said Bob Bragdon, SVP and managing director of Foundry's CSO Worldwide. If your goal is to have someone look at every alert, I'm not sure you're using your resources correctly. I've long wondered if the SOC isn't a symptom of a problem we created. My favorite metaphor is that Vuln Mgmt, IDS, SIEMs and their derivatives (SOAR, XDR, NDR) represent both the haystack AND the needles. Perhaps it's some misguided sense of FOMO that prevents us from ignoring the stuff that doesn't matter, I'm not sure. What I AM sure of is that we're wasting a LOT of time looking at vulnerabilities and alerts that represent no risk or threat to the business whatsoever. I have my doubts that using AI/ML to filter them is the right approach either - it feels too much like throwing even more money on the already blazing pyre of security budgets.

Remember Wolfgang Goerlich's "Stuck in Traffic" YouTube series? (https://www.youtube.com/c/JWolfgangGoerlich/videos) This is like that, but with an anonymous host, and on a motorcycle.

We've been talking about this for a while, but the White House is now actively looking for feedback on a security labeling system for IoT devices. Cyber Nutrition Labels, yum! Actually, Carnegie Mellon has already created some prototypes for security labels: https://www.cylab.cmu.edu/news/2020/05/27-iot-labels-consumers.html And Germany has implemented a similar system, though it's voluntary and has only been implemented by 37 devices and services so far (all email services and broadband routers). https://www.redalertlabs.com/blog/top-10-things-you-should-know-about-german-it-security-label