Release Notes

 

Dec 15, 2023
  • Improvements
    • New Filters and Columns
      • instance.port = You can now query by the port scanned by your specific scanner.
        • Ex. instance.port == 443
        • instance.port >= 80
      • instance.age = You can query by the age of a vuln instance calculated as:
        • Fist Detected Date - Today = X days
  • New Features
    • New Widget named NopSec Threat Based Prioritization
      • This widget aims to showcase how NopSec has prioritized your scanner data by showcasing a before and after view of your vulnerabilities now that they have been re-prioritized by NopSec.
      • In general, we've seen that NopSec's threat based machine learning model tends to dramatically reduce the prioritization of many vulnerabilities coming from the scanner while also elevating a few low priority items from the scanner to High, Critical, or Urgent severity within NopSec.
      • This should help showcase the value of leveraging NopSec compared to other products and showcase the immediate Return on Investment through the reduction of time spent by your teams by ensuring they are focusing on the truly important items based on risk.
    • We are releasing our second Insights page; CISA KEV!
      • CISA publishes a list of Known Exploitable Vulnerabilities (KEV) which are given a Due Date to provide organizations with a date that vulnerabilities should be remediated by.
      • Users can view the Insights Page and see if any existing vulnerability instance is associated as a CISA KEV. If so you can determine which of them are Managed or Unmanaged in order to be able to take action to resolve the ones that are unmanaged.
        • Managed vulnerabilities are any vulns that have been placed into an Exception of Risk Accepted, False Positive or have been placed in a Remediation Plan.
        • Unmanaged vulnerabilities are any vulns that are not in a Remediation Plan and have not been Risk Accepted or marked False Positive meaning there is no intention to resolve this vulnerability detected by the platform so these are items we believe you should focus on determining next steps.We are releasing our second Insight page with the release of CISA KEV.Insights Page!
    • Vuln Instance Details now include:
      • Threat Intel
        • If you have configured Crowdstrike Falcon Insight or Qualys as an integration NopSec will attempt to associate a Threat Intelligence report or data to the vuln instance.
          • Qualys Real Time Threat Indicators (RTI) are now shown as a Threat Intel card to showcase all of the RTI values Qualys has associated with the vulnerability.
          • Crowdstrike Falcon Insight provides a wealth of data for specific vulnerability instances such as:
            • Threat Name
            • Short Description ( Crowdstrike limits the description string and users will need to view the external link to view the full details )
            • Origins
            • Motivations
            • Capabilities
            • Objectives
            • Other metadata
  • New Integrations
    • Qualys PCI
      • You can now integrate with Qualys PCI to capture all of your current vuln instances that have been scanned by Qualys PCI.
      • Items that have failed a PCI check will be given a Category Label of PCI. You can find these items using:
        • vuln.categories == "PCI"

 

Dec 1, 2023
  • Bug Fixes
    • Remediation Plans will now load faster.
    • Users tables will now display > 100 users.
  • Improvements
    • Bulk assignment of users to teams.
      • User Management has gotten a little easier by allowing admins to bulk select users from the Users table and assign them to a Team rather than only being able to do it from the Team card manually.
    • User Status - Active vs Inactive
      • Admins can now mark users as inactive by selecting one or more users and changing their status.
        • Inactive - User data (reports, queries, etc.) are still available but user is unable to login. They will receive an error when attempting to login.
        • Active - Users can login as normal.
  • New Features
    • Insights Page!
      • We are releasing our first Insight page with the release of Celebrity Vulns.
        • Celebrity Vulnerabilities are vulnerabilities NopSec has researched and identified to be prevalent and important vulnerabilities our clients should be aware of. They may be vulnerabilities that are being talked about widely in the news; ie. Celebrity, but they may also be vulnerabilities our security team believes are worthy of mention based on our threat analysis.
        • Users can view the Insights Page and see if any Celebrity Vuln exists in the network, if so which of them are Managed or Unmanaged in order to be able to take action to resolve the ones that are unmanaged.
          • Managed vulnerabilities are any vulns that have been placed into an Exception of Risk Accepted, False Positive or have been placed in a Remediation Plan.
          • Unmanaged vulnerabilities are any vulns that are not in a Remediation Plan and have not been Risk Accepted or marked False Positive meaning there is no intention to resolve this vulnerability detected by the platform so these are items we believe you should focus on determining next steps.
      • Insights will continue to grow as this is where we will focus on delivering new value to our clients so keep an eye out for future Insights. If you have any ideas of an insight or a question you're hoping to be able to reliably answer with the data in our platform please reach out to us by submitting a feature request!
        • The next Insight is CISA KEV.
    • Remediation Plans with Destinations
      • Jira - You can now configure an Integration with Jira Cloud and configure multiple destinations (Jira Projects) in order to allow users to create remediation plans to create remote tickets in Jira. NopSec Customer Success can configure and format how tickets should be formatted (data mapping) please work with your CS team to ensure your formatting is correct.
      • ServiceNow - You can now configure an Integration with SNOW and configure multiple destinations (SNOW Tables such as Incidents or other tables) in order to allow users to create remediation plans to create remote tickets in SNOW. NopSec Customer Success can configure and format how tickets should be formatted (data mapping) please work with your CS team to ensure your formatting is correct.
      • For both, NopSec will continue querying your remote destinations to capture any ticket status changes and assignment changes.
        • NopSec prioritizes your Scanner as the source of truth for the remediation of vulnerability instances and remediation plans will remain open if one or more vuln instances are still open from the scanner's perspective even if the remote ticket status is closed.
    • Target Details now include:
      • Controls
        • If you have configured Crowdstrike XDR/EDR as an integration NopSec will associate the controls deployed to your Targets and displays them in the Target Details view under the Controls Tab.
          • A control can be a policy or set of settings deployed to an endpoint. In the case of Crowdstrike EDR controls are configured with specific settings. We display all settings and their status per control.
          • On top of that all Mitigating Controls within NopSec are assessed for the type of policies/settings enabled and if applied NopSec will apply a risk reduction to the Target which affects all vulnerability instances found on that target. The risk reduction is limited to 25% for all controls as we believe there is no perfect solution to truly reduce your risk to 0, however, we believe there is a sizable benefit for deploying mitigating controls such as an EDR as long as it's configured to properly enforce prevention policies.
          • Reminder, vuln instances will leverage the Target's Criticality, NopSec Vuln Risk Score (based on our Threat Model), and Control Risk Reduction, to calculate the final Vuln Instance risk score. On top of that NopSec aggregates all of the vuln instances to form the Target Risk Score. Finally, NopSec aggregates all of the Target Scores in your network to calculate your Overall Risk Score. This means by applying mitigating controls across as many Targets you can potentially reduce your overall risk up to 25%.