Set rules on technologies discovered on your attack surface
AppSec teams often struggle to either validate or scale their security policies, like enforcing security headers or removing risky technologies. This job is easier said than done, and teams are feeling the pinch. To address these challenges, we launched Attack Surface Custom Policies – a powerful feature built directly into Surface Monitoring that makes it possible to set, enforce, and scale customizable security policies so you can focus on the issues that matter most.
We’ve made several improvements since launching Attack Surface Custom Policies. One of these improvements makes it possible to spot risks due to technologies discovered across your attack surface.
Today, you can set Attack Surface Custom Policies on technologies, such as X and Y. This release will make it possible for users to address the following jobs to be done:
“I’m tasked with ensuring our organization only uses approved technologies on our attack surface.”
Most organizations have a list of approved technologies that reflect their unique business context, such as how much risk they are able to accept due to industry, customer needs, and so on. Attack Surface Custom Policies will now make it easier for security teams to spot technologies that are not approved for use whenever that occurs.
“We have dozens of subsidiaries that have a slew of tech, including open-source tools. I need to ensure that we aren’t using open-source technologies that are known to be vulnerable.”
Identifying technologies that your subsidiaries are utilizing in their products requires a significant amount of resources from several stakeholders, like security, engineering, and infra. This is made even more difficult when you want to identify all instances of a particular piece of tech with a known issue. Now, you will be notified when a specific technology is discovered with Attack Surface Custom Policies.
“As part of our modernization efforts, I need to find all instances of a particular technology to deprecate.”
Whether you are going through a modernization process or just consolidating your tech, Attack Surface Custom Policies will now be able to accelerate that process by automating the discovery of technologies that you no longer want used in your organization.
Additional product updates:
- We’ve added a new column called “Last Scan Status” to Application Scanning.
- We’ve made it possible to remove a root asset. This is also available via the Detectify API.
Recently added crowdsourced vulnerabilities
Here is a list of all new modules recently added from our community of ethical hackers. You can find a complete list of new vulnerabilities added to Surface Monitoring and Application Scanning by viewing the “What’s New?” section in-tool.
- Content-Security-Policy Bypass via AOL
- CVE-2023-27159: Appwrite SSRF