Eoin & The Security

I recently did a webinar with one of our senior security warriors, James Mullen discussing where automated validation works and where it doesn't.  We also discussed false positives in both technical and logical vulnerabilities.  This is worth tuning into if you want to understand the constraints of automation, where is falls down and why we think reliance on automation alone for vulnerability management is a poor idea, we currently still need "the Human Element". Check it out if you want to learn more..

  What’s the worst that can happen…..An Ode to Risk Risk a widely used word in many walks of life but do we understand what it means… “ Risk  involves uncertainty about the effects/implications of an activity with respect to something that human’s value (such as health, well-being, wealth, property or the environment), often focusing on negative, undesirable consequences .” Cyber security often talks about risk....  A high-risk vulnerability or the risk of an event occurring.  So, risk is related to statistical occurrence of an event and the negative outcome…. We often talk about likelihood and impact. The chance of something happening and the effect the of it happening. As CISO’s or cyber security professionals we try to first address items with the highest risk or combination of likelihood and impact we call this prioritization. The reason we need to prioritize is because we can’t fix all the issues and not every vulnerability is created equal . We ...

For the third year running Edgescan contributed to the Verizon DBiR . The DBiR is recognized as the defacto cyber report which casts a wide net across all types of cyber security and breaches, this includes vulnerability management in both infrastructure and applications. Edgescan vulnerability data is curated and validated, sanitized and reflects tens of thousands of assessments we deliver globally across the full stack to our clients. As stated by Gabriel Basset of Verizon " I think there’s a positive story around how vulnerability scanning, patching, and filtering are preventing exploiting vulns from being the easiest way to cause a breach but that asset management is needed to identify and patch unpatched systems... " A few things that stand out to me in the report are as follows: Nearly half of breaches involved Hacking and 70% of breaches were external threat actors. To me this makes sense as in our experience most large enterprises h...

API’s   ( Application Programming Interfaces ) are backend services   which expose an interface which can be used to connect to and transact or read/write information to and from a backend system. The are super useful and a great architecture decision delivering flexibility and extensibility of a service. API’s deliver functionality once the client service knows how to “talk” to the API. API’s generally sit behind a HTTP port and can’t be “seen” unlike a website but they may deliver an equal level of value and functionality to the requesting client. Many websites may use an API but the User does not invoke the API directly but rather the Website /App is a proxy for the API. API’s are not built to be human readable, like a website, but rather machine readable. There are two challenges relating to API security assessment: 1. API Discovery : Do we have an inventory of all API’s deployed on the public Internet. You may have API’s hosted on systems behind HTTP por...

Making a "dent" in the Universe.... We like to think we "move the dial" and have a positive impact for our clients at edgescan. Our combination of technology and expertise helps our clients very quickly prioritize and focus on vulnerabilities which matter.  Realistically as a managed vulnerability intelligence service we do the "heavy lifting" so our partners and clients can work on remediation and improvement coupled with on-going situational awareness. We put together a short video to explain this a little better, Hope you like it.

Vulnerability Management Automation = Good or Bad and for Whom? Do we believe "highly automated security services" are a good thing? Where does automation work and where does it fall short? The Good: Scale Security Automation can deliver thousands of assessments, on-demand and scale to extremely large estates which require vulnerability management on a regular basis. "Low hanging fruit" can be easily detected but at times Risk can be inaccurate which affects prioritization.  Automation still needs to be tuned such that its production safe and does not negatively affect the asset being assessed.  Automation can be challenging in relation to authenticated assessments and even more so when multi-factor authentication is used by the asset. Metrics Frequent or on-demand assessments via automation can assist in the provision of ongoing metrics.  We can measure TTR (Time To Remediation), Identify most common vulnerabilities, Assist with Root-cause an...

Measure, so we can improve. Its been a while since I've blogged anything due to lack of anything meaningful to say or the fact that few people actually want to listen :) but anyways... I've been working on the 2019 edgescan Vulnerability Stats report which always gives me joy as I find it very interesting to see a real picture of the vulnerability landscape based on the clients we humbly serve via our edgescan SaaS. Currently we assess thousands of web applications and hundreds of thousands of endpoints, all under continuous/on-demand cyber security assessment.  Industries such as finance, government, media, pharma, retail, energy, legal all served by our SaaS but the result makes for some good reading when you look into the statistics of vulnerability. App layer is where the risk lives: In 2018 we discovered that on average, 19% of all vulnerabilities were associated with (Layer 7) web applications, API’s, etc., and 81% were network vulnerabilities. The Risk ...