Phoenix Security Features – August/September 2023 – Risk-based formula, Magnitude, Application Security & Vulnerability Management Improvement

The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another set of new Phoenix Security features and improvements for vulnerability management across application and cloud security engines. This release builds on top of previous releases with key additions and progress across multiple areas of the platform.

We are sure that you’ll find these quite interesting!

  • Asset and Vulnerability Management
    • Associate assets with multiple Applications and Environments
    • Mapping of vulnerabilities to Installed Software
    • Find Assets/Vulns by Scanner
    • Detailed findings Location information
  • Risk-based Posture Management
    • Risk and Risk Magnitude for Assets
    • Filter assets and vulnerabilities by source scanner
  • Integrations
    • BurpSuite XML Import
    • Assessment Import API
  • Other Improvements
    • Improved multi-selection in filters
    • New CVSS Score column in Vulnerabilities

Asset and Vulnerability Management

Associate assets with multiple Applications and Environments

One of the key features of the Phoenix platform is its ability to use an easy and powerful rule mechanism to associate assets – and their vulnerabilities – with the organisation’s logical applications and environments. This allows our users to define once which assets are associated with which Apps/Envs, and let the platform keep track of them automatically. In a way, this forms the basis for our risk calculation and contextualisation.

Before one asset could only be “placed” inside one Component or Service (the groups of assets that form applications and environments); but that is changing.

Users can still select assets into groups through the usual rules, but now they are able to match the same asset with rules defined for different groups. This seemingly simple change makes the grouping mechanism much more flexible, and opens up a whole new set of possibilities. For example, now one asset could be grouped into a region-based group (e.g. “Europe servers”) and at the same time be part of a technology-based group (e.g. “Linux servers”). Now the same set of assets can be summarised using different criteria, by creating multiple groups.

Naturally, the platform now makes sure that the same asset’s risk is not aggregated multiple times into Applications and Environments, even if it has been matches by multiple rules inside them.

This change doesn’t bring any significant changes to the UI – things just work as per usual. But you will notice that now you can Assign assets from the All and Unassigned view in the asset screens; not just from the Unassigned view.

Mapping of vulnerabilities to Installed Software and concept of product in vulnerability management

Most Infra scanners will typically report the software installed in a host and the findings for that host separately. These two pieces of information are related – most vulnerabilities would come from the installed software – but that relationship is not always clear or explicit from the scanner data.

Phoenix Security combines scanner-provided data with external vulnerability and product databases to correlate installed software products and their vulnerabilities. This allows us to provide our users with insights and trends around the software and versions used across the state.

The first manifestation of these new insights is the Top 10 Products report, inside the Security Dashboard. But there are many more coming up in future releases.

Find Assets/Vulns by Scanner

Sometimes, you want to understand which assets or vulnerabilities are reported by each scanner with which you have integrated Phoenix. Other times, you might want to explore information you know is coming from a particular scanner.

Whatever the use case, our users can now filter assets and vulnerabilities by the scanner they came from. Just another step forward in our quest to make asset and vulnerability management as easy as possible.

Detailed findings Location information

When looking at lists of findings, it’s sometimes easy to get lost within the repetition of names and CVEs. At the end of the day, the same vulnerability is often found on multiple places across an organisation’s state, so there are multiple findings with very similar details.

To help user better differentiate one finding from another, and to provide as much information as possible at a glance, we have added the vulnerability list with more detailed information about the precise location of each finding.

This information is detailed a bit more in the expanded row view.

Risk-based Posture Management

Risk and Risk Magnitude for Assets

Assets are a natural grouping of findings since the represent a physical or logical entity susceptible to vulnerabilities. As such, they aggregate and contextualise the risk from their findings. This is reflected in their Risk and Risk Magnitude values, which are now displayed on the assets list pages.

While Risk represents the average risk from the vulnerabilities, modified by the asset’s density, the Risk Magnitude reflects the “amount of risk” represented by the asset. Or put another way, the Risk Magnitude is the sum of the risk from its vulnerabilities.


BurpSuite XML Import for appsec vulnerabilities

In parallel with its native scanner integrations, Phoenix Security offers a flexible Import functionality for assets and vulnerabilities. So far the format for this import was CSV only; however, users can now directly import BurpSuite XML reports in their native format.

The platform “knows” that these reports are for DAST scanning (Web/API), so it ensures that the option is offered in the right context. When importing a new assessment, you will now see both formats available to import.

Assessment Import API

Importing vulnerability assessments has become easier and more powerful than ever! Our API now supports importing assessment reports in JSON format.

Phoenix Security’s preferred report ingestion mechanism is still directly integrated with the scanner’s native API. However, there are situations where this is not possible or doesn’t fit our client’s workflows. This addition will enable our users to automate the importing of reports from external systems, using a straightforward JSON format that captures even more details than the manual imports.

In an upcoming release, the formats supported by this import mechanism will expand to cover most of the commonly used scanners and tools. Watch this space!

Other Improvements in Vulnerability and appsec

Improved multi-selection in filters

Whether for creating asset grouping rules or selecting a specific set of vulnerabilities, filtering is a key functionality of the Phoenix platform, and this release will bring a new quality-of-life improvement to our filters.

Users can easily select multiple options within those filters that support multi-selection. The new selection widget makes it very easy to find and select multiple options quickly and intuitively.

New CVSS Score column in Vulnerabilities

There are use cases where the “raw” severity of each vulnerability is important information to have at hand. In this release, we have included that information in the vulnerability list, under the “CVSS / Severity” column. This column can be sorted to help users focus on the vulnerabilities of interest.

Get an overview of your asset lineage

Alfonso brings experience running international teams for multi-million dollar, technologically advanced projects for Telefónica, IBM and Vodafone. Alfonso joins with two decades of experience working for tech leaders, including at Dell EMC, Yahoo! and Intershop.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.