Tanium, a leading provider of converged endpoint management (XEM) solutions, has announced significant updates to its Software Bill of Materials (SBOM). The enhanced SBOM now includes Common Vulnerability and Exposures (CVE) information, enabling organizations to effectively prioritize and address software supply chain risks.
The rise of software supply chain attacks has become a major concern for organizations, largely due to their growing reliance on third-party suppliers and service providers. In order to combat this threat landscape and protect vulnerable organizations, Tanium has integrated SBOM into its Vulnerability Management solution. This integration allows businesses to identify, prioritize, and remediate emerging and zero-day vulnerabilities within software components, including open-source software embedded within application libraries, across all endpoints.
According to Nic Surpatanu, the Chief Product Officer at Tanium, more than ninety-two percent of applications contain open-source libraries that can potentially harbor hidden vulnerabilities. Attackers frequently exploit these vulnerabilities, such as Log4j, OpenSSL, or Struts. Consequently, there is an increasing demand for an SBOM from federal agencies, cyber insurance providers, and other organizations. Tanium’s SBOM is the only solution on the market that enables organizations to detect and address software supply chain vulnerabilities in production environments. This capability empowers both DevOps and SecOps teams to identify and mitigate risks across various stages of development, staging, and production.
Aside from the risks associated with open-source software, organizations also face the challenge of continually evolving processor architectures. The usage of ARM-based servers has seen a sevenfold growth between 2019 and 2022, with ARM-based computers projected to represent thirty percent of all personal computers by 2026. Tanium had previously introduced support for endpoints running ARM-based processors from Apple and Amazon, and now the company has expanded its support to additional ARM-based endpoints running Oracle Linux, RedHat, and Windows 11. By doing so, Tanium aims to provide its customers with a unified platform for managing endpoints and reducing reliance on separate point solutions.
To complement these enhancements, Tanium has also introduced several new features in its Risk & Compliance offering. Firstly, the solution now supports compliance and vulnerability assessments of ESX and ESXi hypervisors via vCenter APIs. This allows security teams to efficiently assess risks associated with virtual servers. Additionally, Tanium’s vulnerability assessments now include information on CISA Known Exploits and Vulnerabilities (KEV), enabling the prioritization of high-risk CVEs for swift remediation. The solution also includes an Exception Management feature, which allows organizations to create exceptions for compliance and vulnerability findings with valid reasons or expiration dates, allowing them to focus on pressing issues. Finally, Tanium has introduced Benchmark Enhancements, offering a dedicated page within the Tanium Benchmark to help customers visualize the health of their key operations and security metrics.
As organizations continue to embrace digital transformation, it is imperative to have comprehensive visibility, control, and real-time remediation capabilities to mitigate cyber risks. Tanium’s latest enhancements to its SBOM and Risk & Compliance offerings address these needs. To learn more about these updates, organizations can participate in the Tanium Innovation and Technology Update scheduled for June 28, 2023. Registration for the event is now open.