Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/31/2019
01:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Former Twitter CISO Launches Startup to Secure Cloud Collaboration

Altitude Networks, led by Michael Coates and Amir Kavousian, aims to prevent accidental and malicious file sharing.

Cloud applications have enabled employees to send data across all corners of the Internet, to any number of third parties. It's a growing challenge for security and IT admins to keep track of which corporate data is shared, who is sharing the data, and where they might be sending it.

The problem is evolving as businesses adopt a growing number of cloud products: On average, companies use 27 different cloud apps and services. Nearly half of IT and security pros surveyed say cloud services make it tougher to protect confidential or sensitive data; 57% don't think their organization is careful about sharing sensitive information with third parties in the cloud.

Altitude Networks, a new startup from former Twitter CISO Michael Coates and former Capital One lead data scientist Amir Kavousian, today officially launched with $9 million in Series A funding to address this issue. The round was led by Felicis Ventures with participation from Slack Fund, Accomplice, and a personal investment from former Facebook CSO Alex Stamos.

Coates and Kavousian want to tackle the problem of data security in the cloud and in doing so, protect businesses from unauthorized data access, data theft, and accidental and malicious sharing to unintended recipients. Altitude's platform monitors for personally identifiable information, payment data, and other files that may cause potential damage if shared: legal documents, internal financial data, product road maps shared with unauthorized accounts.

"I needed this as a CISO, I wanted to buy it, it didn't exist," says Coates, who also previously led security at Mozilla and served as chairman of OWASP. In his role at Twitter, Coates sought to find a platform that would protect data from unauthorized sharing. What he found were several cloud access security broker and data loss prevention tools, many of which promised to alert when files were publicly shared.

"It's far deeper of a problem than is shared publicly," he adds. Even when they're not made public, sensitive files can still do damage if shared with the wrong people. Coates spoke with CISO peers and learned many want to prevent this risk but hadn't found an answer: They have plenty of collaboration apps but no way to know how files move in and out of the company.

"Cloud collaboration makes it easy for an employee to make a mistake and share documents they shouldn't," he explains. Someone leaving a company may decide to send files to a personal account; if the account is compromised, the attacker now has strategic data. "All of these issues are happening regularly inside of companies due to the doubling down of collaboration."

Altitude's platform integrates into cloud environments to give businesses a view of where sensitive files are so they can remove access and protect them. By understanding the context and provenance of a file, it can determine a "risk rating" that dictates whether sharing is dangerous. It categorizes these risks so administrators can filter files that have been leaked outside the company, or specifically look at sensitive files that have leaked outside the company, Coates explains. They can also view files that were downloaded and shared.

Right now, the tool is designed to support software-as-a-service applications G Suite and Box, with plans to expand to Office 365, Slack, and Salesforce, among others.

"Part of the challenge in tackling the problem is the massive amount of collaboration and sharing that's happening," says Coates. Some file-sharing actions are egregious; for example, publicly sharing financial earnings. Others might be more of a gray area, such as sharing a strategic road map with a third party. Altitude's platform lets security managers question a file and ask an employee whether they meant to perform an action, then lock the file if needed.

"When you have a security problem, what you need is context," he explains, citing his experience in incident response and addressing malicious insiders. Admins don't just need to know a file was dangerously shared but whether it was sensitive and who shared it. Coates says Altitude's platform has detected when financial reports are shared with personal accounts.

Altitude Networks plans to use its funding to drive growth and customer acquisition strategies.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7257
PUBLISHED: 2019-12-11
SQL injection vulnerability in DBD::PgPP 0.05 and earlier
CVE-2013-4303
PUBLISHED: 2019-12-11
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-s...
CVE-2013-5743
PUBLISHED: 2019-12-11
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
CVE-2013-5978
PUBLISHED: 2019-12-11
Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Product name or (2) Price description fields via a request to wp-admin/admin.php. NOTE: This issue may...
CVE-2013-3542
PUBLISHED: 2019-12-11
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware 1.0.4.11, have a hardcoded account "!#/" with the same password, which makes it easier for remote attackers to obtain ...