Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

Four Questions to Minimize the Cyber Risk of Your Public-facing Assets and Web Apps

Four Questions to Minimize the Cyber Risk of Your Public-facing Assets and Web Apps

Ask the following four questions to help reduce cyber risk in your public-facing assets and web apps.

The constant drum of cyberattacks on your public-facing assets and web apps is not going to stop anytime soon: according to the 2020 Verizon Data Breach Investigation Report (DBIR), 43% of data breaches involved attacks on web apps. From new automated attack tools to well-funded sophisticated black hat hackers targeting specific security holes, it's now easier than ever for bad actors to test your defenses. 

Securing your web apps comes down to you and your understanding of the weaknesses that an attacker might find and leverage in your network. Once you have this understanding, you can then proactively apply relevant patches, code fixes and/or compensating controls to mitigate against threats.

Each of the following questions offers different lenses through which to view the security risk presented by your public-facing assets and web apps.

1. What is my organization’s risk for public-facing assets?

Firstly, let’s look at how you would assess the risk of a public-facing asset. In an ideal situation, you would want to expose as few assets as possible to the outside world. You can leverage a public risk scan to validate that you are restricting public visibility as much as possible. Another advantage of the scan is that it will also test the compensating controls on your network to make sure they are operational.

Unfortunately, even the simplest information exposed to the outside world, like the version of your file transfer protocol (FTP) server, can be exploited by easy “Google Hacking” techniques. It’s important to leverage a vulnerability management program to set up regular scanning of public-facing assets to help you minimize risk. The results of a risk scan are best used to configure your network and host-based compensating controls to avoid exposing any unwanted information.

2. What vulnerabilities exist in my network backends?

To understand a network’s weaknesses, we recommend scanning it locally from a vulnerability scanner hosted in your environment or an agent installed on the host. A local scanner in your environment using an authenticated scan can provide the most thorough results. To obtain that level of detail, you will need to provide credentials to assess the target. If this is difficult, you have the option of using agents, which don’t require credentials as they are already running on the host itself.

Once the authenticated scan is complete, you will have a full list of the vulnerabilities to which the asset is susceptible. The next step is to understand the context around the threat of each of these vulnerabilities. Understanding the current real-world risk information for each vulnerability can help you better prioritize your remediation efforts based on the likelihood a vulnerability is to be used, allowing you to utilize your scarce security resources more effectively.

It is just as important to be aware of configuration and compliance issues. You want a vulnerability management solution that includes the ability to audit the configuration of a target against a number of compliance standards and best practice templates, including those from the Center for Internet Security (CIS), the Defense Information Systems Agency Security Technical Implementation Guides (DISA/STIG) and payment card industry (PCI) standards, as well as your organization’s own internal standards.

 3. How do I know that my web apps are secure from an attack?

One of the fastest and most efficient ways to secure your web apps from an attack is to deploy an automated web app scanning program. Dynamic Application Security Testing (DAST), for example, is an automated penetration test that will interact with the web app in a safe way and assess the response to show if there are weaknesses in the coding of the web app. 

A DAST tool can go deeper than an operating system (OS) and application-level vulnerability and configuration audit to dynamically assess a web app. It helps ensure that the app is not vulnerable to an unanticipated action, or logic flaws. It also helps validate the running environment, like structured query language (SQL) injection, to find any coding flaws and misconfigurations. It is also important to point out that some legacy web app scanners can’t keep up with the modern applications. A modern DAST tool not only can scan traditional HTML web apps, but also supports dynamic web apps built using HTML5, JavaScript and AJAX frameworks, including single-page applications.

Shift Left” is a best practice that integrates web app security into the software development life cycle (SDLC). Doing full testing of your web apps in a pre-production environment, and automating security scanning every time the code changes can help increase your organization's overall security posture. This helps expose vulnerabilities in your web apps sooner, reduces the cost of fixing those problems and limits the potential for damages due to a compromise. 

4. How do I scan for PCI compliance?

The PCI Data Security Standard (DSS) includes a requirement (11.2.2) for a quarterly external scan and an attestation provided by an Approved Scanning Vendor (ASV). You should combine both the public risk scan result with a web app scanning solution from an ASV to provide attestation against public web apps and assets. Using these scan results, you can go through the process of gaining compliance certification against the 11.2.2 requirement to share with any interested parties. Leveraging pre-configured PCI templates and defined dispute processes can help streamline this effort.

Summary

As you can tell, there is no silver bullet to assess your public facing assets and web apps to determine the risk of cyber criminals. That said, there are best practices that can help you understand and minimize your risk. To find out more, please check out the “Top 5 Web Application Security Practices” eBook.

Learn more

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.