We are pleased to announce that AppSec Phoenix has been named a Leader in the 2022 Hype Cycle for Application Security Orchestration and Correlation. 

This article covers some of the critical vision and pillars that determine the recognition of leaders in the category.

What is ASOC

Application security orchestration and correlation (ASOC) tools ease software vulnerability testing and remediation by automating workflows and processing findings. They automate security testing within and across the development life cycle, ingesting data from multiple sources. They correlate and analyse results to centralise efforts for more straightforward interpretation, triage and remediation, acting as a management and orchestration layer and control between application development and security testing.

What are the characteristics of a next-generation ASOC?

How does ASOC help you: Visibility, control, correlation of vulnerabilities across your native deployment

> Application security native stack correlation

• Code Vulnerabilities
• Library Vulnerability
• API Security
• Website Security
• IAST/DAST Vulnerability (Black Box Testing)

> Cloud security 

• Cloud-native deployment
• Cloud Misconfiguration
• Cloud Visibility

> Infrastructure Security Vulnerability

• Vulnerable Servers
• Vulnerable images
• AMI Images vulnerability
• Cloud Misconfiguration and drift

> Container Security

• Kubernetes Security
• Container Security
• Image Register Security

What is the vision of a modern Next Generation ASOC?

Correlate Results

Each of the security tools in the pipeline can deliver some severity results but having all the results in one single place prioritised and triaged is the nirvana of security professionals.

Correlation between results helps you remove false positives and focus your security efforts on the vulnerabilities that are most likely to get exploited tomorrow.

Prioritise Vulnerabilities in important conditions

Are you fixing all the vulnerabilities? An impossible task. Modern organisations focus on battling priorities and focus. Not all security issues, cloud misconfigurations and vulnerabilities are equally important. An attacker will more likely target a vulnerability, like log4j, or an authentication error on a web server exposed over the web without security controls. The system is protected by four layers of network security controls and not exposed over the web. 

Focusing your security engineering efforts on the more exploitable vulnerabilities first is the key to getting ahead of the attacker.

Contextualisation & Business Context

Which one would you choose: 

• Fixing vulnerabilities on your critical systems and the one that generates most of the revenue-generating
• Cafeteria software that enables the menu delivery on display

No brainer, right? It is hard to represent those business context decisions in the modern Software lifecycle or environment patching/upgrading. Organisations battle the complexity of vulnerabilities and struggle to correlate business context.

Transferring key business contextual knowledge onto the decision process for fixing and prioritising vulnerabilities ensures engineers are working on the business-critical apps first. 

Attackers think about what’s more valuable for the business and how do I get in the business; by reflecting those considerations into the vulnerability and risk prioritization, you will ensure your organization prioritises vulnerabilities with the eye of an attacker 

DevSecOps workloads 

Determining which team is working on what and delivering the prioritised and contextualised vulnerabilities that need to be solved to the backlog (or tools) of the groups responsible for it is key to false positive reduction and augmentation of focus. 

Track Path to Green & Remediation Progression

When you have to deal with a lot of vulnerabilities, the usual ask from executives and the rest of the business is how much and by when. Track progress toward risk-based objectives is key to keeping the whole business secure and executives aware of progress to risk reduction. 

Tracking metrics like vulnerability reduction, risk reduction, impact reduction, number of critical resolved, Vulnerabilities outside SLA, and number of tickets open helps business people to be more aware of the situation. 

Risk Based Objectives 

Businesses talk about risks and costs to reduce risk, they are good at evaluating risk-reward positions. Reporting on volumetrics and the number of vulnerabilities does not enable businesses to make risk-based decisions. 

Translating decisions into risk-based posture enables every application owner and executive to be aware of the security risks of their vulnerabilities. 

Translating risk-based objectives into several vulnerabilities to solve is key to linking the security engineering team and business together. 

Application security and Cloud Native Application deployment

Organisations nowadays focus on cloud-native deployments. Thinking and prioritising vulnerabilities in a vacuum is not effective and deliver a warped image. 

Vulnerability needs to be prioritised based on context

• Business context =  how important is the application that is being developed 
• Environment context = Cloud and non-cloud infrastructure have different challenges. Containers and Infrastructure elements have very different characteristics and challenges 
• Control Context = determining which system is protected by controls is critical in determining the mitigation of risks
• Deployment Relation = determining which application is deployed is critical to deciding the prioritisation and risk level of a vulnerability affecting software and infrastructure posture. 

Central Risk-based platform

Centralise the results for every team to determine the risk profile and how much work needs to be done to be secure.

Security insights 

Correlation and contextualisation provide valuable insights to the security team to organise security training and practical work to give the best return on effort for security remediations. 

Take the example of a single library with 100 vulnerabilities affecting 100 applications and 1000 developers. Would the security team effectively resolve the issue using all 1000 developers to solve the 100’000 vulnerabilities? 

It is more effective for the security team to have a central repository with the golden library or AMI, and solving the vulnerabilities centrally helps 1000 developers with a more focused effort. It removes the friction between security and the development environment.

Impact analysis

Understanding the position of your team and how much damage an application could suffer if a data breach happens or you lose productivity is key. 

Business is keener to listen to an impact and risk analysis of the business and business risk from a security executive rather than a report on vulnerabilities. 

How can Phoenix Security help?

Introducing Phoenix Security, a Cloud Native and Risk-based platform for vulnerability and posture management

Application and infrastructure testing tools output large amounts of data, and teams spend time and resources to aggregate this information into something actionable. ASOC tools should centralise this information into one location for teams to view and analyse, allowing them to craft better plans for future development. This information can be used for security teams and executives, SCA tracking, and more.

> Risk Posture & Risk-Based Vulnerability Management (RBVM) – We help organisations to understand the risk posture across application, infrastructure and cloud security in a prioritised and simple way

> Asset information, Software Bill of Materials, * (ANY) Bill of materials  – We help organisations understand where their assets are at from a risk and vulnerability angle

> CSPM/Vuln Management – Infrastructure/Cloud – we help you understand the posture of your endpoints and correlate the software developed. 

> Business Context and intelligence – we help organisations reflect the business context, criticality and data insights onto the remediation of vulnerabilities to reflect which application is more critical and needs attention first

> Real-Time Threat Intelligence applied directly to prioritisation – Phoenix Security applies cybersecurity threat intelligence like exploitability prediction based on honeypot feedback, exploit prediction based on the dark web and clean web chatter (like Twitter, LinkedIn, Reddit, Pastebin) 

> Security Insights – we help organisation security teams be more effective by identifying the work that is more significant and the security improvements that are more impactful across the organisation

> Correlation of vulnerability across domains – we help organisations correlate application security vulnerabilities into which environments are deployed (container, cloud, infrastructure) 

> DevSecOps automated workloads – We help security teams to scale across the organisation, enabling them to codify decision-making when suggesting which vulnerabilities need to be solved first