News
Fortinet Doubles Down on Secure Development and Transparent Vulnerability Disclosure
Fortinet has announced it is building on the company’s long-standing commitment to responsible radical transparency as an early signer of the Secure by Design pledge developed by the Cybersecurity and Infrastructure Security Agency (CISA). This voluntary industry pledge complements and builds on existing Fortinet software security best practices, including those developed by CISA, NIST, other federal agencies, and international and industry partners. The pledge outlines seven goals, including responsible vulnerability disclosure policies, which are already an integral part of Fortinet’s product security development.
Jim Richberg, Head of Cyber Policy and Global Field CISO at Fortinet, said, “At Fortinet, we have a long-standing commitment to being a role model in ethical and responsible product development and vulnerability disclosure. As part of this dedication, Fortinet has proactively aligned to international and industry best practices and upholds the highest security standards in every aspect of our business. We applaud CISA’s continued call to the industry to follow suit and appreciate CISA’s willingness to collaborate with Fortinet on the development of these important goals. We strongly encourage others in the technology community to join this effort to keep organizations secure.”
CISA’s latest initiative strongly aligns to Fortinet’s existing product development processes already based on Secure by Design and Secure by Default principles. Fortinet is committed to adhering to robust product security scrutiny at all stages of the product development lifecycle, helping to ensure that security is designed into each product from inception all the way through to the end of life, in the following ways:
- Secure Product Development Lifecycle (SPDLC): Fortinet aligns its processes in accordance with leading standards, including NIST 800-53, NIST 800-161, NIST 800-218, US EO 14028, and UK Telecom Security Act.
- Robust Security Product Testing: Fortinet leverages tools and techniques such as static application security testing (SAST) and software composition analysis built into its build processes, dynamic application security testing (DAST), vulnerability scanning, and fuzzing prior to each release, as well as penetration testing and manual code audits.
- Trusted Supplier Program: To ensure rigorous selection and qualification of its major manufacturing partners, Fortinet adheres to NIST 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. Fortinet’s commitment to data privacy and security is embedded in every part of the company’s business and in every phase of the product development, manufacturing, and delivery processes.
- Information Security Program: The Fortinet Information Security Program is based on and aligned with industry-leading security standards and frameworks including ISO 27001/2, ISO 27017 and 27018, and NIST 800-53, as well as data privacy regulations such as GDPR and CCPA.
- Third-Party Certifications: Fortinet products are regularly certified to standard and validated through third-party product quality standards, including NIST FIPS 140-2 and NIAP Common Criteria NDcPP / EAL4+.
Additionally, the Fortinet Product Security Incident Response Team (PSIRT) is responsible for maintaining security standards for Fortinet products and operates one of the industry’s most robust PSIRT programs, including proactively and transparently disclosing vulnerabilities. Nearly 80% of Fortinet vulnerabilities discovered in 2023 were identified internally through the company’s rigorous auditing process. This proactive approach enables fixes to be developed and implemented before malicious exploitation can occur. Fortinet works with its customers, independent security researchers, consultants, industry organizations, and other vendors to accomplish the company’s PSIRT mission.
To further advance its dedication to a culture of responsible radical transparency, Fortinet has a long-standing commitment to public and private partnerships that align to its mission, including:
- As a founding member of the Network Resilience Coalition, Fortinet is helping deliver real-world solutions to protect networks and sensitive data, including addressing the issue of software and hardware updates and patches not being implemented.
- Through its membership with the Joint Cyber Defense Collaborative (JCDC), which was established by CISA in 2021, Fortinet works with public and private entities to gather, analyze, and share actionable information to more proactively protect and defend against cyberthreats.
- As a founding member of the Cyber Threat Alliance (CTA), Fortinet shares timely threat intelligence with other cybersecurity practitioners to better protect customers against adversaries.
- Working with global leaders as a founding member of the World Economic Forum’s Centre for Cybersecurity (C4C), Fortinet is helping to encourage intelligence sharing across the industry to reduce global cyberattacks and disrupt cybercrime.
Cyber Security
World’s Largest Cybersecurity Startup Hub GISEC North Star Debuts in 2025
GISEC Global is thrilled to announce the launch of GISEC North Star, an expanded startup zone designed to connect cybersecurity innovators, investors, and industry leaders on an unprecedented global scale. In partnership with Expand North Star, the world-renowned startup and investor networking event, GISEC North Star aims to elevate the cybersecurity startup ecosystem by featuring 250 leading-edge cybersecurity startups and 150 investors. The 14th edition of GISEC Global anticipates over 25,000 visitors and participants from 160 countries.
The event will take place during GISEC GLOBAL 2025 at the Dubai World Trade Centre from 6-8 May 2025, introducing unparalleled opportunities for networking, collaboration, and investment. As cybersecurity threats escalate globally, GISEC North Star is designed to foster an ecosystem of innovation and resilience by connecting global minds in cybersecurity technology, venture capital, and enterprise solutions.
As an anchor of GISEC Global, GISEC North Star will serve as a premier platform where disruptive startups can showcase their innovations, connect with leading global investors, and engage with key industry leaders across various sectors. The event will feature cutting-edge showcases, live demos, and panel discussions with top minds in cybersecurity technology and business.
“We are thrilled to expand GISEC’s role in the global cybersecurity ecosystem through our partnership with Expand North Star. GISEC North Star is committed to bringing together the brightest minds in cybersecurity, empowering startups with unparalleled access to the resources, networks, and investments they need to thrive in today’s fast-evolving digital landscape,” said Nawaz Ali, Commercial Director at GISEC Global.
GISEC North Star’s expansive setup is designed to attract the best cybersecurity talent from across the globe, uniting startups, investors, and visitors to collaboratively tackle the sector’s most pressing challenges. With participants from over 160 countries, the event will foster diverse and impactful exchanges that shape the future of global cybersecurity.
Designed to promote collaboration and growth, GISEC North Star is set to showcase breakthrough innovations that address critical challenges in cybersecurity, ranging from AI-driven threat detection to secure data management solutions. Investors will have an unprecedented opportunity to connect with and support promising startups driving advancements that safeguard the future.
Critical Communications
Hytera to Show Off 4G and 5G Body Cameras for Law Enforcement at GITEX GLOBAL 2024
Hytera Communications will introduce its latest body camera innovations at GITEX Global 2024. Showcasing the advanced SC780 Smart 4G Body Camera and SC880 Smart 5G Body Camera, Hytera aims to revolutionize the capture, storage, and management of digital evidence for law enforcement and emergency services. These new-generation body cameras reflect the Gulf region’s growing commitment to tech-driven public safety solutions, especially in alignment with the UAE’s and Saudi Arabia’s national visions for enhanced security infrastructure. With their cutting-edge AI capabilities, real-time communication functions, and the power of 4G and 5G connectivity, these devices are designed to deliver unparalleled clarity, reliability, and situational awareness to on-the-ground teams.
Stanley Song, Vice President of Hytera, commented: “At Hytera, we are committed to supporting the Gulf region’s public safety goals by providing cutting-edge technology solutions. Our next-generation body cameras, powered by AI and 5G, reflect our dedication to delivering innovation and reliability. We are proud to align with the UAE’s and Saudi Arabia’s visions of leveraging smart technologies to enhance law enforcement capabilities and public safety. These solutions are tailored to the region’s unique needs, ensuring law enforcement agencies can operate with the highest level of efficiency and accountability.”
Hytera’s new-generation body cameras offer High-Quality Evidence Collection, ensuring optimal performance in diverse environments. With advanced image stabilization technology, they provide steady video even during high-motion activities, while the night vision capabilities guarantee clear footage in low-light scenarios. Equipped with a wide-angle lens, these body cameras capture a broader field of view, giving law enforcement greater coverage during operations.
In addition to their advanced recording capabilities, the body cameras provide Real-Time Communication functionalities. Not merely recording devices, they double as Push-to-Talk over Cellular (PoC) radios, ensuring constant connectivity in mission-critical situations. These cameras come with AI-powered noise cancellation for clear audio, long battery life for extended field operations, and an IP68 rating, making them fully dustproof and waterproof, ideal for the region’s harsh environments. The facial and license plate recognition features further enhance their ability to provide quick and accurate data to the command centre, ensuring fast and precise suspect identification.
Hytera’s body camera solutions are built with Advanced Network Capabilities in mind, capitalizing on the rapid deployment of 4G and 5G networks in the Middle East. Leveraging these technologies, particularly the SC880 model’s 5G technology, enables faster transmission speeds, enhancing the efficiency of both data recording and live communication. The SC880 captures 4K ultra-high-definition footage with an extended pre/post-recording feature that lasts up to 300 seconds and allows for 15 hours of uninterrupted recording without the need for recharging. Additionally, these cameras capture crystal-clear audio within a 10-meter range, ensuring the reliability and integrity of evidence gathered on the field.
Hytera’s Digital Evidence Management (DEM) system is designed to offer the highest level of protection and efficiency for digital evidence in line with the region’s strict focus on data security. The DEM system ensures a secure, closed chain of evidence, from the moment of capture through to courtroom presentation. It provides enhanced operational efficiency through redaction features and remote device management, making it a critical tool for law enforcement and public safety users who require the highest standards of data integrity and security throughout the entire lifecycle of digital evidence.
The Gulf region, particularly the UAE and Saudi Arabia, has seen a significant rise in the adoption of body camera technologies as part of a broader focus on public safety and transparency. Law enforcement agencies are increasingly relying on these devices to document interactions with the public and enhance accountability. The integration of AI-powered facial recognition technology has also become a game-changer, dramatically improving the efficiency of law enforcement operations, and enabling faster responses to real-time situations.
Hytera’s body camera solutions have already gained global recognition, with deployments in over 60 countries across diverse regions including Southeast Asia, Central Asia, the Middle East, Africa, Latin America, and Europe. This global success reinforces Hytera’s role as a trusted partner for law enforcement and public safety agencies worldwide.
Expert Speak
Shadow IT – Is It Really a Problem?
Personally, I love shadow IT—most employees do. But is it a problem? Let’s explore.
Wondering what shadow IT is? Shadow IT refers to the use of software and hardware tools or services by employees without the knowledge of the organization’s IT department.
The use of shadow IT tools has been a topic of discussion for years, with each company having its stance. Using these tools is often more about personal preference than anything else, and the same applies to how companies handle them. Most people lean toward shadow IT because official IT software tools often do not offer features that cater to individual preferences.
Some commonly used tools that fall under shadow IT include project management tools like Trello and Notion, messenger apps like WhatsApp, and file transfer apps like WeTransfer and Dropbox. The common factor? They’re all easy to access and use. However, with the rise of GenAI, everyone’s new shadow IT tool is ChatGPT.
The problems
I’m sure you already know the main issues that make companies dislike shadow IT tools: privacy and security.
Let’s look at ChatGPT. The use of ChatGPT isn’t regulated in most organizations, and many companies are still at a crossroads regarding GenAI tools. There’s a risk of employees unintentionally sharing sensitive information, leading to data leaks. This could include intellectual property, like code used to build applications, or personal information such as phone number, email address, house address, and more.
Whatever the sensitive information may be, it’s not safe to share it with tools like ChatGPT. Threat actors are constantly trying to breach systems, especially widely used tools like ChatGPT, where there’s much to gain. There’s still an obvious vulnerability here despite companies providing best practices to employees.
Another problem with shadow IT tools is that they restrict collaboration. If one team member uses a cool, new project management app to track progress and others use a different tool, it’s difficult to stay on the same page. For example, design and development teams often work together on the same project, such as designing web pages.
If the design team uses one project management tool and the development team another, how can they collaborate and work in sync to meet deadlines? It creates unnecessary friction. This is why organizations provide the same, approved project management tools for everyone. While using different tools might boost individual productivity, it can cause productivity issues within the project as a whole.
From a financial standpoint, companies pay for business tools that their employees use. If employees start using free online tools instead, the money spent on approved tools for a user who uses a shadow IT tool instead becomes a loss for the company.
Additionally, when organizations approve software solutions, those tools are vetted by a team of professionals and comply with the laws and regulations that the company must follow. However, we can’t be sure those tools are compliant when employees download apps on an ad-hoc basis, and employees usually don’t check for these things when they download or use shadow IT apps.
The good
Shadow IT tools are awesome. We all agree on that. The tools organizations give us, or approve, are often outdated. They’ve been around in the tech landscape for years (for good reasons, of course), but as technology advances, we don’t want to be tied to old tools that lack new features, which could make our work easier.
Restricting access to apps doesn’t feel great. We all work differently and have unique preferences. Using shadow IT tools that we like makes us feel more productive, and empowered, and allows for individuality in the workplace. When we use tools we love, we tend to be more efficient compared to when we’re stuck using approved, traditional tools that may lack the features we need.
The verdict
Shadow IT comes with many advantages, and dismissing it solely because of the risks isn’t wise. If we think about it, all tools carry some degree of risk. It’s up to us to be educated and understand how to use them securely and efficiently while benefiting the team and the company we work for. Shadow IT tools might benefit you individually, but what’s more important is to look at the bigger picture and ensure that your teamwork doesn’t get affected because of this.
Speaking of the financial loss that a company incurs while giving out tools that an employee may not need, what can be done instead is that organizations can avoid giving all the tools that an employee might need. Even if it’s a tool that employees may need regularly, us a request-based system so that employees reach out to get a paid tool by the company only if they need it and want to use it. This eliminates the unnecessary cost incurred by the company when an employee is provided with paid tools by default but chooses to use a shadow IT tool instead.
At first glance, shadow IT might seem like a problem, but with employee education and empowerment, it doesn’t have to be. Restricting shadow IT tools is easy, but educating employees is key.
ManageEngine is a company that believes in employee-driven innovation and encourages its employees to be aware of secure cybersecurity practices while allowing room for individuality. To learn more about ManageEngine and its offerings that allow you to have a secure and efficient IT infrastructure, click here.
-
Cyber Security7 days ago
Tenable Urges Organisations to Reimagine Cybersecurity at GITEX 2024
-
Cyber Security7 days ago
Check Point Software to Emphasise its Prevention-First Approach to Cyber Security
-
GITEX1 week ago
OPSWAT to Showcase its Mobile Critical Infrastructure Protection Lab at GITEX 2024
-
GITEX1 week ago
Fortinet to Focus on Digital Transformation with Advanced Security at GITEX 2024
-
GITEX1 week ago
Snowflake to Demo its AI Data Cloud at GITEX 2024
-
GITEX7 days ago
Sophos to Highlight Advanced MDR Capabilities at GITEX Global 2024
-
Critical Communications3 days ago
Hytera to Show Off 4G and 5G Body Cameras for Law Enforcement at GITEX GLOBAL 2024
-
Artificial Intelligence6 days ago
Dataiku Launches LLM Guard Services to Control Generative AI Rollouts