Vulnerability Management 101 - edgescan

By -
Vulnerability Management:

The age old penetration test is dead, long live the penetration test...So as discussed before a 1-off penetration test does not work, why?

  • Code changes - possible introduction of vulnerabilities
  • Framework vulnerabilities are discovered all the time  (see here )
  • Server/Hosting changes may give rise to a vulnerability
  • Patching - vulnerarability
  • Logical/Business logic vulnerability - from new features
  • etc etc

So, our 1-off penetration test is only a point-in-time assessment and has its place for deep-dive penetration tests but more often than not the value of a 1-off penetration test is erroded the day the report is finished...like driving a car out of a dealership, it looses half its value in an instant.

We decided to do something different..


How about a solution that provides...

  • Monthly or more frequent vulnerability assessments
  • Covers Layer 1-7 (host, protocol, server, IP, patch, webapp, framework etc etc).
  • Is manually verified by humans (not androids or monkeys!)
  • Integrates with many many other security services.
  • A single point to view your entire security posture across all OSI layers for you entire Internet presence.

Ths type of idea makes sense right?

We dont have experienced consultants running scans and chasing False positives
We dont have 300 reports to manage and attempt to track what, how when was fixed not to mention risk priority.

Bring forth...edgescan

For the Last year we have been developing a pretty decent vulnerability management tool.
It answers questions like
  • What are my high risk issues?
  • Where are my high risk issues?
  • How old are they?
  • What is vulnerability history for my assets?
  • Am I more or Less Secure than yesterday/last month last year?
Some screen shots of edgescan given a picture is worth 1000 words

 
Executive Dashboard:
What are my biggst security concerns on network and application layers? What is the history of each asset and what changes have occured..the dashboard answers such questions.
 
 

 

 
Vulnerability List
My to do list!! Ordered by risk, date, asset  etc etc. what do I need to remediate and which issues take a high priority. Also advice on how to fix discovered issues.
 
 
 
Asset List
Each of my assets organised by criticality. A snapshot of each asset. Is it more secure than the last scheduled assessment? are my issues in the network later (administration/config) or the application layer (development/devops)?
 
 
 
Reporting
Yes, you can download deep technical reports or executive level reports on one or more assets if you wish. Select date ranges for historic reporting also.
 
 





Comments

Post a Comment

Popular posts from this blog

By -
Image
The HSE Data Breach and the State of Irish Cyber Security Many years ago, shortly after I founded the Irish chapter of OWASP ( http://www.owasp.org ) (in 2007??) we were delivering free application and software development classes to anyone who wanted them. It was a local low key affair but every class we delivered was "sold out". We have 60-80 folks mostly developers willing to spend 4-5 hours on learning the fundamentals of secure application development and testing. I suppose we felt cyber security was an important issue because that's what we did. At the time many folks in business felt cyber security was an overhead or a "tax" and did not give it much time. A few years later (late 2010) when the the foundation of the NCSC (National Cyber Security Centre) was announced, a few of us (local OWASP Ireland leaders) wrote a number of emails to the Irish government offering free cyber security training. As we were working for a non profit (501.3c) charity (OWA...
Read more

Edgescan and Huawei - Cybersecurity - Irish Times Article and Panel Discussion

By -
Image
I recently was interviewed by the Irish times on why is everything getting hacked and how can we change the game.... https://www.irishtimes.com/special-reports/cybersecurity-focus/criminals-have-an-inbuilt-advantage-in-the-great-cyber-arms-race-1.4651078  A recording of the Panel with Andy Purdy, CSO of Huawei North America. https://www.youtube.com/watch?v=cQJ1uSQ4IEk&t=33s Both are decent and worth a listen.
Read more

How Simple can it be.....XSS Prevention....

By -
Cross Site Scripting is sill a very common web vulnerability. Generally it is used to attack clients/users. It can be used for malware upload, botnet hooking, keylogging, a payload delivery system for clickjacking and CSRF attacks and much much more, all for 6 easy payments of $9.99...sorry got carried away there :) But is is easily preventable. You dont even have to know what XSS (type 0, type 1, type 2, DOM, Stored, Reflected) is to prevent it. One pretty simple way to prevent XSS is to use the OWASP ESAPI (Enterprise Security API). A very easy tool to use/invoke. It's also managed and attended to by Chris Schmidt ....A great guy... Regardless of what it does....if there was a mandate to use it on all redisplayed external input a site could become virtually XSS free!! (all for 6 easy payments of......). It's easy to deploy.... 1. Include in JSP (Java version) 2. Invoke in JSP 3. Job done!!! We include it by <%@ page import="org.owasp.esapi.ESAPI...
Read more