The Cloud Security and AppSec teams at Phoenix Security are pleased to bring you another set of new Phoenix Security features and improvements for vulnerability management across application and cloud security engines. This release is full of key additions and progress across multiple areas of the platform.

We are sure that you’ll find these quite interesting!

• Asset and Vulnerability Management
  • Cyber Risk Navigation Graph
  • Improved Vulnerability Triage with Grouping
  • Improved CISA KEV Identification and Filtering
  • Link Finding to Scanner’s Page
  • Improved Exploitability and Fixability Data
• Risk-based Posture Management
  • Risk Exception and Mitigation Flow
  • Edit Component Asset Selection Rules
• Integrations
  • Microsoft Defender for Endpoint
  • Added Lacework Cloud support
  • Added Item Type option to ADO integration
• Other Improvements
  • Improved Cloud Account Visualisation
  • User control of Notifications and Email Alerts
  • And Many More

Asset and Vulnerability Management

Cyber Risk Navigation Graph

As organisations model their cybersecurity landscape in Phoenix Security, getting a birds-eye view of the overall set of applications and environments becomes increasingly important. With the new navigation graph, it’s now easier to get an overview of your applications, environments and their components. From there, you can quickly find the one of interest, jump to its details, or edit it.

Improved Vulnerability Triage with Grouping

One of the core areas of Phoenix Security’s user interface is its Vulnerabilities screen. Here users can find every single finding affecting their assets, search and filter, and act on them by opening tickets or requesting risk exceptions.

However, sometimes, getting lost amongst many similar findings can be easy, especially when the same vulnerability affects multiple assets. However, with the new views introduced to the Vulnerability screen, users can group findings by their vulnerability definition (e.g. CVE or scanner vulnerability ID) or by the location affected by the asset where location can be a more specific place within a wider asset (e.g. a file and line within a repository).

Improved CISA KEV Identification and Filtering

Phoenix Security is constantly checking your vulnerabilities against the CISA Known Exploited Vulnerabilities catalogue in order to flag those assets affected by any of these vulnerabilities.

With this new release we are surfacing this information for individual findings and making sure that users can quickly find them by including system-generated tags to support flexible filtering.

Link Finding to Scanner’s Page

Continuing with the theme of improved triaging capabilities, at Phoenix, we want to ensure that users have quick and easy access to all the vulnerability details they might need. More often than not, these details are available within the platform. Still, sometimes, users might want to have a look at the original vulnerability report in the scanner’s own user interface.

This is why we have started to include links to the vulnerability’s scanner page within the Phoenix user interface and in the details of the tickets open from the platform.

Improved Exploitability and Fixability Data

One of the key features of the Phoenix platform is its ability to provide additional details and context for the vulnerabilities reported by external scanners. When it comes to exploitability and fixability, we are going beyond the scanner data and extracting additional intelligence from the CISA-KEV catalogue and the vulnerability’s CVSS vector.

This ensures that exploitability and fixability details are as accurate as possible.

Risk-based Posture Management

Risk Exception and Mitigation Flow

Management of False Positive exceptions, with request/approval flow, has been part of Phoenix for quite some time now. In this release, we take risk exceptions management to the next level by introducing Risk Mitigation alongside the existing false positive option.

The new exception options allow users to partially mitigate vulnerability risks and define an expiration date for the mitigation. This allows for much more fine-grained control over the extent and duration of the exception.

Furthermore, we are releasing bulk acceptance and rejection functionality alongside the creation of bulk exception requests – which was already possible in Phoenix. This will allow security approvers to deal with groups of requests requiring similar treatment easily.

Edit Component Asset Selection Rules

With the release of the asset multi-assignment functionality, now it’s possible to edit existing asset selection (or aggregation) rules without the inconvenience of being unable to see previously selected assets during the process.

So far, it was possible to achieve the update effect by creating a new rule and deleting the old one. Now, users can edit existing rules directly and modify the conditions that match the right subset of assets for their applications and environments.

Integrations

Microsoft Defender for Endpoint

In this iteration we are extending the scope of our native integration with Microsoft/Azure vulnerability sources by adding Microsoft Defender for Endpoint to our extensive list of integrations. Check out the Microsoft detailed article for all the features and integration.

Added Lacework Cloud support

Another addition to our native integration capabilities is Lacework Cloud scanning.

In this case, users don’t have to configure a new integration since Lacework uses the same API credentials for Container and Cloud vulnerabilities. The scanner integration will now offer both container and cloud targets for vulnerability fetching if Lacework is scanning them. Check out the detailed article on Lacework integration.

Added Item Type option to ADO integration

Azure DevOps ticketing functionality allows users to create different types of “items” to represent traceable actions. By default, the type of item is “Issue”, but in some cases, organisations use a different type, whether from the standard catalogue or a custom one.

Now, Phoenix supports this use case by allowing users to define the type of ADO item that represents issue tickets. This new field is optional and returns to the default “Issue” type if left blank. Check out the Microsoft detailed article for all the features and integration.

Other Improvements

Improved Cloud Account Visualisation

Even though cloud account IDs are an everyday item in the life of many security engineers, it is much easier to identify cloud accounts by their friendly name or label.

With this release, and whenever the information is available from the source scanner, Phoenix platform always displays the account’s label in lists and filters – while internally working with the unique IDs that are required for accurate identification.

User control of Notifications and Email Alerts

At Phoenix, we are always mindful of the notifications that everybody gets every day. That’s why our email notifications and alerts have a conservative frequency.

However, sometimes that’s not enough, and users want to be able to disable notifications.

We release the first step by allowing users to disable notifications through their user profile configuration.

Other Improvements

• Improved risk calculation and vulnerability selection for False Positive/Risk Mitigation flow to cover some edge cases.
• Improved findings selection logic for non-fixable vulnerabilities to cover some edge cases.
• Improved the Vulnerability density factor for asset risk calculation to cover some edge cases.
• Now users can edit the Default Application and Environments to better suite their usage of these default asset holders.
• Keep issue tickets updated when vulnerabilities are closed or Risk Mitigated, with details of the changes happening in the Phoenix platform.
• Improved filtering by date ranges, with open and closed ranges at both ends.