12:15 PM
Connect Directly

Startup Of The Week: Trusteer

A new approach to security focuses on protecting online banking and e-commerce.

The major flaw of most security software is it can't keep pace with new malware. Trusteer doesn't even try. "We assume the desktop is compromised," says CEO and co-founder Mickey Boodaei. Trusteer's software protects passwords and account numbers rather than trying to seek and destroy infections.
--Andrew Conry-Murray


Mickey Boodaei, co-founder and CEO, Trusteer

Boodaei tackles online banking security
HEADQUARTERS: Tel Aviv, Israel

PRODUCT: Rapport

PRINCIPALS: Mickey Boodaei, co-founder and CEO; Amit Klein, co-founder and CTO; Shmulik Regev, co-founder and chief architect

INVESTORS: Private investors

FUNDING: $4 million

EARLY CUSTOMERS: ING Direct, Muriel Siebert

Rapport is a desktop agent that performs multiple functions, including encrypting all the keystrokes from the keyboard driver to the browser to thwart keyloggers. It also restricts access to the browser and browser APIs. Any attempt by a browser add-on to interact with the browser must be allowed by the software's rule set. Finally, the software authenticates the e-commerce server, whether by checking a trusted list of IPs, by reverse DNS lookup, or by using a secure DNS server hosted by Trusteer.

Trusteer's security software doesn't try to identify malware. Instead, it protects Web transactions by monitoring browser processes so malware can't log keystrokes, redirect the browser, or inject transactions. In addition, Trusteer doesn't sell to end users. It contracts with banks and e-commerce companies, which in turn offer the software to their customers.

Trusteer faces a couple of major hurdles. First, its software has to be nearly flawless, both in operation and construction. Second, banks usually don't provide security software to customers because they risk liability if something goes wrong. But the pain inflicted by criminal malware may now outweigh the risk. Trusteer's product is compelling enough to get in the labs of potential customers, where it will be pounded mercilessly. If it can run the gauntlet, look for an acquisition within two years.

CEO and co-founder Boodaei was VP of EMEA sales at Imperva, a Web and database security vendor. CTO and co-founder Klein was chief scientist at security vendor Cyota, which was acquired by RSA.

Timeline Chart

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.