Former Twitter CISO Launches Startup to Secure Cloud Collaboration

Cloud applications have enabled employees to send data across all corners of the Internet, to any number of third parties. It's a growing challenge for security and IT admins to keep track of which corporate data is shared, who is sharing the data, and where they might be sending it.

The problem is evolving as businesses adopt a growing number of cloud products: On average, companies use 27 different cloud apps and services. Nearly half of IT and security pros surveyed say cloud services make it tougher to protect confidential or sensitive data; 57% don't think their organization is careful about sharing sensitive information with third parties in the cloud.

Altitude Networks, a new startup from former Twitter CISO Michael Coates and former Capital One lead data scientist Amir Kavousian, today officially launched with $9 million in Series A funding to address this issue. The round was led by Felicis Ventures with participation from Slack Fund, Accomplice, and a personal investment from former Facebook CSO Alex Stamos.

Coates and Kavousian want to tackle the problem of data security in the cloud and in doing so, protect businesses from unauthorized data access, data theft, and accidental and malicious sharing to unintended recipients. Altitude's platform monitors for personally identifiable information, payment data, and other files that may cause potential damage if shared: legal documents, internal financial data, product road maps shared with unauthorized accounts.

"I needed this as a CISO, I wanted to buy it, it didn't exist," says Coates, who also previously led security at Mozilla and served as chairman of OWASP. In his role at Twitter, Coates sought to find a platform that would protect data from unauthorized sharing. What he found were several cloud access security broker and data loss prevention tools, many of which promised to alert when files were publicly shared.

"It's far deeper of a problem than is shared publicly," he adds. Even when they're not made public, sensitive files can still do damage if shared with the wrong people. Coates spoke with CISO peers and learned many want to prevent this risk but hadn't found an answer: They have plenty of collaboration apps but no way to know how files move in and out of the company.

"Cloud collaboration makes it easy for an employee to make a mistake and share documents they shouldn't," he explains. Someone leaving a company may decide to send files to a personal account; if the account is compromised, the attacker now has strategic data. "All of these issues are happening regularly inside of companies due to the doubling down of collaboration."

Altitude's platform integrates into cloud environments to give businesses a view of where sensitive files are so they can remove access and protect them. By understanding the context and provenance of a file, it can determine a "risk rating" that dictates whether sharing is dangerous. It categorizes these risks so administrators can filter files that have been leaked outside the company, or specifically look at sensitive files that have leaked outside the company, Coates explains. They can also view files that were downloaded and shared.

Right now, the tool is designed to support software-as-a-service applications G Suite and Box, with plans to expand to Office 365, Slack, and Salesforce, among others.

"Part of the challenge in tackling the problem is the massive amount of collaboration and sharing that's happening," says Coates. Some file-sharing actions are egregious; for example, publicly sharing financial earnings. Others might be more of a gray area, such as sharing a strategic road map with a third party. Altitude's platform lets security managers question a file and ask an employee whether they meant to perform an action, then lock the file if needed.

"When you have a security problem, what you need is context," he explains, citing his experience in incident response and addressing malicious insiders. Admins don't just need to know a file was dangerously shared but whether it was sensitive and who shared it. Coates says Altitude's platform has detected when financial reports are shared with personal accounts.

Altitude Networks plans to use its funding to drive growth and customer acquisition strategies.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.