Boost Admin Usability and Productivity: Customizable Admin Roles, On-Platform Collaboration and More

Redefining User Control with Flexible, User-Centric Tools

At Transmit Security, we are dedicated to providing our customers with powerful tools for enhanced security and control. Our latest updates include advanced tools to strengthen client authentication methods, improve fraud detection and provide precise control over admin access. This edition highlights FAPI-aligned authentication methods for highly regulated industries, mobile native app fraud detection and security features and customizable admin roles, empowering teams to better protect their environments and deliver seamless user experiences.

Highlights

Customizable Admin Roles for Seamless Access Management

Admin Custom Role-Based Access Control (RBAC) is now live on the Mosaic Platform, offering customers the flexibility to tailor admin permissions based on organizational needs. This powerful feature enhances access management and ensures admins only have the permissions they require.

With Admin Custom RBAC, customers can:

1. Leverage default roles or create custom roles to fit unique workflows.
2. Assign permissions specific to Mosaic services.
3. Streamline access while avoiding over-permissioning.

Unlock Collaboration in the Admin Portal

The Mosaic Admin Portal is now a hub for streamlined team collaboration, designed to support admins in managing and assigning critical tasks and projects without relying on external systems. With features like in-portal comments and @mentions, teams can communicate directly within the platform, ensuring everyone stays aligned. Admins mentioned in comments receive email notifications with a direct link to the relevant page, enabling quick access to the discussion. Comments can also be viewed across all pages or limited to specific projects, depending on the admin's permissions. These updates empower teams to centralize their workflows and go further with Mosaic.

Fraud Prevention

Quick Actions on the Recommendations Page for Streamlined Investigations

To boost productivity for fraud analysts, we've introduced Quick Actions on the Recommendations page. This feature allows users to interact efficiently with table data while reviewing cases. By hovering over table cells, users can quickly:

• Add the value to filter criteria for refined searches.

• Investigate the value as a pivot to uncover related activities.

• Isolate the value in a new tab for focused analysis.

• Create a rule based on the property for proactive threat management.

Looking ahead, we plan to extend support for more action types and introduce Quick Actions in the side panel, further enhancing flexibility and efficiency.

New Mobile Native Security Features for Enhanced Threat Detection

We’re also presenting powerful updates to our mobile SDKs, designed to detect and mitigate threats targeting trusted devices. Adding to the pre-existing detection of emulators, jailbroken/rooted devices and tampering risks, key enhancements include:

• Protection against sensitive interaction risks like screenshots and overlay attacks.

• Identification of behavioral threats and social engineering signals.

These updates ensure robust security, empowering organizations to detect and respond to emerging mobile threats. For full details, upgrade to the latest SDK version.

Customer Identity Management

Private Key JWT for Advanced Client Authentication

Private Key JWT is now available for customers requiring strong client authentication. Ideal for highly regulated industries, this feature ensures compliance with stringent standards like FAPI, enhancing both security and regulatory alignment.

Strengthening Client Authentication with Self-Signed mTLS

mTLS (mutual TLS) is now available, establishing a secure, two-way authentication channel where both client and server validate each other’s identity. This feature is also particularly valuable for highly regulated industries, ensuring compliance with strict regulations and certifications while protecting sensitive communications from end to end.

Enhanced Mobile Biometrics Management: Greater Transparency and Control

We’ve updated the user profile panel to display detailed information for each biometric authenticator, including app name, operating system, registration date and more. The additional details empower customers to effortlessly view and manage biometric authenticators, ensuring greater transparency and precise control over user authentication methods.

Flexible Session and Token Timeout Management

You now have greater flexibility in session and token timeout management for OIDC-based applications, with the ability to configure these settings on a per-client basis. By decoupling token timeout configurations from Resource definitions, this update offers greater control and customization. Customers can now effortlessly adjust timeout settings to optimize both user experience and security, ensuring a balance that meets their specific needs.

Enhanced Authentication Visibility with Client-Side Attributes

We’re enhancing our backend authentication APIs with the introduction of the client_attributes object, enabling our customers to forward client-side details like user agent and IP address during authentication. Gain improved visibility into end-user client attributes and enable more detailed logging within authentication events.

Enhance Hosted UI with Custom Titles and Descriptions

We’re introducing new customization options for the Login Form and Get Information from Client actions in the Hosted UI. A new "Sent to Client" section allows you to define a Form Title and Form Description using Expression strings.

Additionally, app_data and error_data fields have been reorganized under this section as "Additional Data" and "Error Data," with updated descriptions to better support client-side features and error handling. These changes streamline even further the UI management and enable richer client-side experiences.

Identity Verification

Strengthen Verification Integrity with Cryptographic Signatures

We’re introducing cryptographic signatures to reinforce trust and security in the identity verification (IDV) process. This feature ensures that the device initiating the IDV process matches the one transmitting captured images, preventing hijacking attacks and safeguarding sensitive workflows.

By validating device and source integrity, this update addresses vulnerabilities like injection attacks, fraudulent image submissions, and bypassed liveness checks. Currently available in our hosted web solution, this capability represents a vital step in securing IDV processes and protecting against fraud risks.

Platform-Wide Enhancements

Transmit Security Events Add-on for Splunk: Now Cloud Compatible

Version 1.2.8 of the Transmit Security Events Add-on for Splunk is officially approved for distribution as a Splunk Cloud app. This update introduces a new connector version to support the latest Events API, ensuring seamless integration and enhanced compatibility for cloud environments.

* All updates featured in these Release Notes are globally available.