Security Boulevard (Original)

Cerby Emerges From Stealth to Transform Application Security

Cerby this week emerged from stealth to unveil a security platform that allows end users to enroll their preferred applications rather than being limited to a set of applications that were pre-approved by an IT organization.

Fresh from raising $12 million in additional funding, Cerby CEO Belsasar Lepe said that once an application is enrolled, the Cerby software-as-a-service (SaaS) platform will automatically install agent software to secure that application. Cerby also leverages integrations with third-party identity management platforms from providers such as Okta and Microsoft.

That approach shifts the tenor of the application security debate because cybersecurity teams are no longer put in the position of trying to limit the number of applications that end users can access, said Lepe. Instead, end users can decide to use any application they prefer as long as it complies with zero-trust IT principles without impacting the cybersecurity posture of the organization, Lepe noted.

A survey conducted by Osterman Research on behalf of Cerby found just over half (51%) of respondents admitted they continued to use their preferred applications even if those were specifically prohibited by the employer. A similar number (52%) said they wanted their company or IT department to “get out of their way.” The survey polled more than 500 business professionals in North America and the United Kingdom working at organizations with more than $100 million in annual revenues.

The survey also found three out of five respondents felt that having an application blocked by their organization would reduce their assessment of how much their employer trusted them, which, in turn, would negatively affect the way they thought about their organization.

Lepe said it’s clear that most cybersecurity professionals have been placed in an impossible situation. The only way to rectify that toxic relationship situation is to provide security to unmanaged applications via a platform that makes it easy to apply security policies, he added. Cybersecurity professionals should not be in the business of trying to force end users to employ a narrow range of applications that have been pre-approved by an organization, Lepe noted.

More than a few cybersecurity teams have been trying to improve relationships with the end users that have historically viewed the cybersecurity policies as productivity obstacles to be circumvented. The challenge is that cybercriminals have become more adept than ever at targeting end users that use a wide range of endpoint devices accessing any number of applications. Months can go by before cybersecurity teams are even aware that an application is being used.

In an ideal world, cybersecurity professionals should be viewed as enablers of secure processes regardless of what applications are preferred, noted Lepe. The Cerby platform enables that goal to be achieved by making use of robotic process automation (RPA) to streamline the enrollment process via a centralized portal that provides single sign-on capabilities via support for the secure access markup language (SAML) and system for cross-domain identity management (SCIM) frameworks, said Lepe.

It’s not clear to what degree cybersecurity professionals are ready to transition toward a softer approach to enforcing cybersecurity policies. Many cybersecurity professionals have been moving toward implementing zero-trust IT policies that, to varying degrees, lock down IT environments by limiting access. The challenge, of course, is getting end users to buy into those approaches over the long term as conflicts between application preferences and the need for greater security persist.

Michael Vizard

Mike Vizard is a seasoned IT journalist with over 25 years of experience. He also contributed to IT Business Edge, Channel Insider, Baseline and a variety of other IT titles. Previously, Vizard was the editorial director for Ziff-Davis Enterprise as well as Editor-in-Chief for CRN and InfoWorld.

Recent Posts

Linux Kernel Privilege Escalation Vulnerability (CVE-2024-1086) Alert

NSFOCUS CERT has detected that details and a proof-of-concept (PoC) tool for a Linux kernel privilege escalation vulnerability CVE-2024-1086, have…

4 hours ago

LockBit Hacker Sentenced To 4 Years Jail Plus Fined $860K

Recent reports about legal proceedings, a 34-year-old Russian-Canadian national, Mikhail Vasiliev, has been handed a sentence of almost four years…

5 hours ago

MSP Case Study: Infinite IT Elevates Customer’s Email Defense Capabilities with PowerDMARC MSP Program

Reading Time: 2 min Discover how Infinite IT transforms its email defense capabilities through the PowerDMARC MSP Program in this…

6 hours ago

Symmetry Systems Ramps Up Hybrid-Cloud Data Security with $15 Million Series A Funding

ForgePoint Capital and Prefix Capital Double-Down on Data Store and Object Security as Lead Investors Symmetry Systems, provider of cutting-edge…

11 hours ago

What is Threat Management?

Threat management is a process that is used by cybersecurity analysts, incident responders and threat hunters to prevent cyberattacks, detect…

14 hours ago

Building Strong Defences: The Intricacies of Effective Bot Mitigation – Part 1

Learn how you can assess a bot mitigation provider's ability to detect and stop bots in our new technical blog…

15 hours ago