blog

Phoenix Security Features – June 2023 – Application Security & Vulnerability Management Improvement

Phoenix Security Release 3.5

The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another set of new Phoenix Security Features and improvements for vulnerability management across application and cloud security engines. This release builds on top of previous releases with key additions and progress across multiple areas of the platform.

We are sure that you’ll find these quite interesting!

  • Manage your Vulnerabilities and Assets
    • Filter Vulnerabilities by Asset & Vulnerability Tags
    • Export Vulnerabilities page in CSV
    • Remove Tickets from External Platforms
    • Enhanced linking of Teams to Apps and Envs
    • Enable multi-selection in more filters
  • Risk-based Posture Management
    • Advanced Risk Configuration
    • Updated EPSS factor in risk calculation
  • Productivity and User Experience
    • Updated Vulnerability Detail Views
    • More reactive UI: asynchronous operations
    • Improved display of existing asset selection rules
  • Integrations
    • Improved Github Integration
    • Improved Snyk Integration
    • Improved Qualys Infra Integration
    • Improved Nessus Integration
    • Improved Rapid 7 Integration

Manage your Vulnerabilities and Assets across application security and cloud security.

Filter Vulnerabilities by Asset & Vulnerability Tags

Being able to filter vulnerabilities by tag is a flexible and powerful tool, but sometimes the most interesting tags are associated with the asset, rather than the vulnerability. That’s why now you have filters by both asset and vulnerability tags in the Vulnerabilities screen. Happy filtering!

Export Vulnerabilities page in CSV

Even though the extraction of information from the Phoenix platform hinges on the use of the API, we recognise that sometimes it’s easier or more useful to get a quick “snapshot” from the list of vulnerabilities already filtered in the user interface.

Now users can export the list of vulnerabilities – the current selection and page – as a CSV file for further processing and sharing.

Remove Tickets from External Platforms

At Phoenix Security we are quite cautious when it comes to deleting stuff, especially if that stuff lives on an external platform. However, being able to manage vulnerabilities from a centralised platform is one of the main reasons why users come to Phoenix, and that includes getting rid of stuff when it’s not required any more.

In this case we are talking about issue tickets created on external platforms (e.g. Jira, ADO, GitHub, ServiceNow). Now users can choose to delete the actual ticket on the external platform when they delete tickets in Phoenix, either manually or through the removal of a workflow integration.

Enhanced linking of Teams to Apps and Envs

So far it was fairly straightforward to add applications and environments to your teams: just find the entity you want to add – potentially using tags search to find it – and then add it to the list.

Now this process has gained additional flexibility and power. You can dynamically assign Apps and Envs to the team by selecting a set of tags; the platform will ensure that any application or environment that matches those tags is linked to the team.

Not only that, but you can now also link applications and environments to Teams through the users that are responsible for them. By selecting this option, any Apps/Envs that team members are responsible for (App/Env configuration) will be automatically linked to the team.

Enable multi-selection in more filters

Continuing with the filtering improvements, now users can easily select multiple values within the same category where it makes sense. This capability was present in some filters and has now been extended to even more of them.

Risk-based Posture Management

Advanced Risk Configuration

One of the cornerstones of the Phoenix platform is the contextualised calculation of risk for each vulnerability. This involves several factors like the Impact of the application affected by the vulnerability or the asset’s Locality (internal vs external).

These factors influence the final risk calculated in different proportions or weights, which the platform has previously predetermined. Now users can alter those weights to reflect the different levels of sensitivity of the organisation to each factor.

Not only that but users can “fine tune” those factors by observing how they modify the risk calculation for a set of vulnerabilities with different severities, impacts, localities, etc.

Updated EPSS factor in risk calculation

As part of our improvements to the risk calculation formula, we have modified the EPSS factor by fine-tuning its impact on the final risk. This better reflects the level of exploitability the EPSS represents.

Productivity and User Experience

Updated Vulnerability Detail Views

Our users have spoken, and we have listened. Through our constant engagement with users and stakeholders, we have identified several improvements to the vulnerability details display (partial and full views). These changes aim to make it even easier for engineers to have all the information they require where it’s easier to see at a glance.

More reactive UI: asynchronous operations

Phoenix Security platform performs several processing steps for information around assets and vulnerabilities. This means that each change in asset grouping involves updates to components, applications, environments, etc.

To ensure that UI actions provide immediate feedback while maintaining the sophistication of the internal recalculations, we have made some interactions asynchronous. In other words, the change (for example, creating a new Component directly from a list of assets) is captured and confirmed immediately; however, some of the action’s consequences would occur in the background. This is communicated so that users know what to expect.

Improved display of existing asset selection rules

Other visual improvements have been made to display asset selection rules defined for components and services. Now there is more consistent and detailed information about the rules already created.

Integrations

Improved scanner interaction

Each scanner has a different API, and a different approach as to how it’s assets and vulnerabilities can be fetched for it. In practical terms, this means that we have to deal with many different situations and look for strategies to optimise how we interact with each scanner.

Especially for those scanners with high numbers of assets (e.g. Infra and Cloud), breaking down the interaction in smaller, more manageable chunks brings benefits in terms of speed, resilience and user experience.

In the last few months, we have been improving our interaction with Tenable.io, Qualys VM and Rapid7 scanners. All of them are key elements within our client’s vulnerability discovery toolset.

Get an overview of your asset lineage

Alfonso brings experience running international teams for multi-million dollar, technologically advanced projects for Telefónica, IBM and Vodafone. Alfonso joins with two decades of experience working for tech leaders, including at Dell EMC, Yahoo! and Intershop.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.