Scalable Security Controls
The scope of this engagement consisted of delivering continuous vulnerability management of 3000+ web applications deployed globally across a large media company. The deployment was across both cloud and data centre hosted systems.
- The client company required a continuous assessment of its entire global Internet facing cyber-estate in order to detect current security issues and detect new issues into the future. Internal applications were also in scope.
- Given the volume of assets under management the client needed to baseline the security posture of all Internet facing web applications and in addition, understand the security controls surrounding internal web applications.
- The client required a false positive-free list of actionable findings which they could simply apply to the internal workflow for ownership and remediation.
- The client required API integration for target assignment, alerting and integration into business systems and GRC systems.
- The client required continuous scheduled and on demand testing, to assess the sites so they could track progress and mitigation of discovered security risks.
- The associated hosting infrastructure was also in scope in order to detect CVE’s, patching and configuration issues.
- The client required retest on demand capability where required and also alerting of any new high risk issues discovered.
The on-boarding phase consisted of validating each site and server for stability and criticality such that the continuous assessment could provide coverage and depth of testing as expected. Once an application is onboarded technical assessment can commence and the application is subject to technical security assessment on an ongoing basis.
Edgescan provided continuous assessment on an ongoing basis for the 3000+ web applications under management. All of the vulnerabilities discovered are manually validated helping our client focus on issues which cause a real risk. Assessments occurred on a scheduled and an ad-hoc basis as required by the client. Alerting and data transfer to the clients systems (GRC/ITSM -ServiceNow) were ongoing and continuous. Retest on demand was also delivered via the edgescan portal and API.
Internal Assessment with Edgescan CloudControl™
By deploying both physical or virtual appliances Edgescan was able to assess and discover vulnerabilities on internal, non public Internet-facing systems (web applications and hosting servers).
Within the first number of weeks, Edgescan onboarded and assessed over 1000+ web applications and associated hosts. The discovered issues were validated and published on the clients edgescan portal. The client proceeded to fix the discovered issues over the coming months and the fixes were verified and closed by edgescan. The client could display the improvement of its security posture and streamlining of security control processes over time.