Evaluating Agentless Cloud Security Solutions?

#4: What certifications and competencies do you have to validate the security of your solution?

Orca Security has the following third-party certifications and validations:

• ISO 27001
• ISO 27017
• ISO 27018
• SOC 2 Type 2
• AWS Security Competency

#5: How do you prioritize alerts / issues? What reasoning and details do you provide along with each alert / issue?

A few things to keep in mind here. Is the vendor able to clearly articulate how they prioritize alerts? Does the vendor’s priority levels look consistent across different types of issues / alerts? Does the vendor provide a clear rationale and explanation for why an alert is being categorized the way it is?

Alerts in Orca are graded according to the risk level they pose to your organization. There are four levels of risk, highlighted below from lowest (Informational) to highest (Compromised):

Informational [Score 4]
Alerts with no clear attack vector and pose minimal risk to the organization, so are thus deemed informational.

Hazardous [Score 3]
Alerts with no known exploit or not reachable from the outside but still lessen your security posture.

Imminent Compromise [Score 2]
Alerts with a high probability that the machine will be compromised based on the findings and a viable external to internal attack vector.

Compromised [Score 1]
Alerts when malicious code or activity is existing on the asset.

Alert Scoring can be upgraded or downgraded by taking multiple factors into consideration. Some examples are:

• Whether the asset is Internet-facing or not (Orca builds a context map to understand the topology, even if the asset is behind a proxy, load balancer, etc.)
• Vulnerability correlation to network services
• The publication date of CVE
• Fix availability per package/CVE by the vendor
• IOC – Indicator of Compromise (authentication logs, etc..)
• Exploit availability per CVE
• CVSS score baseline
• Potential damage like remote code execution or denial of service
• Trending/High-Profile CVE (security blogs, threat intelligence, Twitter chatter, etc…)
• Risky configuration (both the cloud control plane and workload risky configuration)
• Asset state (running /shut down)

In the screenshot below, Orca is showing an unpatched web service vulnerability. As explained in the alert itself, its severity is justified by the fact that the resource is exposed to the Internet. The visual attack map helps you understand how a would-be attacker could access this resource from the Internet.

Orca is the only vendor that effectively prioritizes alerts by taking a holistic approach to risk by combining workload data (vulnerabilities, misconfigurations, malware, file integrity monitoring), threat intelligence, and environmental context (accessibility and potential business impact).

#6: How do you shorten time to resolution / remediation?

Alert prioritization is critical. Solutions that separate the 1% of alerts that matter help you focus your efforts on where they need to be. Equally important is that the solution give you a clear path forward to resolution.

For example, can the vendor’s solution not just detect a rogue SSH key in a workload, but also tell you what else in your environment those keys provide access to? Can the solution not only find malware but also tell you if the machine that they found it on is accessible? How will the vendor’s solution guide you in containing the damage?

Can the solution not only detect cloud keys that a developer has embedded in a test script but also tell if those keys are for accounts that you control? And if so, for what users? Or is it something that someone spun up on a credit card to try and test something?

Can the solution detect misplaced PII, whether it’s in the form of email addresses, or social security numbers, or credit card numbers? If so, can they tell you if that repository or location is accessible from the internet?

The fact is you’ll need answers to the questions above to go back and find the root cause and fix these problems today as well as reducing the chances of them happening tomorrow. At Orca, we help you understand the magnitude of the issue and how to ultimately solve the problem. Orca provides recommendations for corrective actions so security teams can expertly harden cloud environments and strengthen their security posture.

Orca not only provides the information to remediate the issue, but also gets it into the hands of the team member(s) that can actually fix the problem. Orca then closes the loop by providing visibility into remediations, notifying the IT operations team as issues are resolved so they can track their successes and turn their attention to other tasks.

Orca’s integration with Azure Sentinel Security Center and ServiceNow makes the solution far more valuable for BeyondTrust. It uses Security Center like a SIEM, so Orca’s findings pour right into Azure Sentinel Security Center. Orca Security can kick off a ticket in ServiceNow if an investigation or remediation is needed.

#7: What integrations do you have today and what is the maturity of those integrations?

The cloud is about openness, and Orca is cloud-native in that regard. This means that authorized technology partners and customers can retrieve data or invoke operations via our public API. The same API that powers the Orca dashboard is open to you. Orca swims nicely with others as shown by our ever-expanding ecosystem of technology partners.

But just as important as the number of integrations is the quality and depth. As just one example, Orca has bi-directional sync with Jira that allows our customers to kick-off automated workflows that:

• Include the precise path to remediation
• Confirms the issue has been resolved
• Maintains evidence for auditors

The flexible Orca-Jira configuration interface can even support custom workflows.