By Dow Jones & Co. has developed an open-source tool that scans for security vulnerabilities within the Amazon Web Services cloud platform and in some cases fixes them automatically, in an example of how cybersecurity is becoming increasingly automated. The tool was developed over the past year partly in response to the growing need for automation in cybersecurity amid cybersecurity talent shortages and the fast-paced nature of software development, said Jaswinder Hayre, chief information security officer for Dow Jones. Dow Jones, which is the publisher of the Wall Street Journal and WSJ CIO Journal, and is owned by News Corporation, announced the tool’s release earlier this month. More enterprises are taking advantage of public cloud platforms such as Amazon.com Inc.’s AWS, but business teams sometimes overlook security configurations for all the data they’re storing in the cloud, Mr. Hayre said. Cybersecurity employees at large enterprises also face challenges with tracking and managing security configurations for information within the hundreds of AWS accounts that companies create, which is why the tool is beneficial, he said. “There’s just not enough security folks to go around,” said Mr. Hayre, who reports to Ramin Beheshti, chief product and technology officer for Dow Jones. “We need to make security for the masses, and the way you do that is security automation, or this concept of security as code.” AWS did not immediately respond to a request for comment. The number of unfilled cybersecurity positions is expected to reach more than 1.8 million globally by 2022, according to a 2017 report from (ISC)2, a nonprofit association, WSJ Pro Cybersecurity recently reported. Companies now are using automation to sift through many thousands of security alerts that would typically have required human attention, and automation tools have been widely deployed to remediate ransomware and phishing attacks so far. However, automated security technologies have not been widely adopted among the Fortune 500 in part because existing security services do not trust machines to make decisions without human intervention, said Avivah Litan, an analyst with the research firm Gartner Inc., in a previous interview. The new tool, called Hammer, uses application programming interfaces to connect to the AWS accounts that an enterprise uses, Mr. Hayre said. It then scans for security vulnerabilities in, for example, cloud-based storage devices called S3 buckets, where businesses often store unstructured data such as images, Javascript files and logos. Data in such storage devices is sometimes left exposed to other AWS users because employees forget to secure them, he said. If a security vulnerability is found, the tool will automatically send a message to a security professional within the company. If the employee does not respond right away, it will reconfigure privacy settings so that only certain IP addresses within the company will have permission to access the data stored in the bucket. Last year, basic contact information about Wall Street Journal subscribers was left exposed to other AWS customers as a result of improper security configurations. The new security tool can find and fix such vulnerabilities for Dow Jones and other companies because it’s free and open-source, he said. “Security is one of those things where we feel like we’re all in this together — us and every other company in the world,” he said.
Dow Jones has created an open-source cybersecurity tool that scans for weaknesses on AWS (the Amazon Web Service) cloud platform. The Hammer tool can also fix some vulnerabilities automatically. Platforms such as the Amazon Web Service are increasingly used by companies, but some businesses overlook security configurations for all the data they store. Hammer scans for security weaknesses and alerts a security professional at the respective firm if it finds a vulnerability. If they do not respond, the tool then refigures privacy settings so only certain IP addresses have permission to access the stored data.