Assets

Purpose

This document provides users with an overview of the Assets. It is assumed that the reader has basic access to the OUTSCAN/HIAB account with an Appsec subscription.

Introduction

Assets are groups of unique hosts or agents found during the discovery stage or added automatically while creating a configuration. An asset can also be linked to a group of configurations, and one asset can have hundreds of configurations which are being scheduled and scanned independently.

These assets are defined based on their IP, Docker Registry, or hostname. Their risk profile in form of top recommended solutions and risk charting provide a quick way of assessing the criticality of an asset, its association with other assets and already performed scans.

Assets

What are Assets?

Assets are groupings of one or several identifiers such as IP addresses and host names that represent distinct resources customers wants to secure. As such, an asset may represent entities such as:

• An employee's laptop

• A publicly available website, hosted on a domain for example example.com and served from one or more physical or virtual servers

• A database server only accessible from within an internal, protected network

• An OCI image served from a private container registry

• Resources hosted on a cloud service provider

• An Outpost24 agent

As Outpost24 services scan and analyze targets, findings are generated and associated with the corresponding assets.

How are Assets Created and Updated?

Assets are created dynamically when discovered during scans.

Valid Asset Composition

Not all identifier types may exist within the same asset simultaneously. The below matrix summarizes how assets may be composed.

Asset Composition Constraints

There are a few constraints for how many asset identifiers can compose an asset and which asset identifier types can co-exist within an asset:

Green - Asset identifiers that must exist in an asset
Amber - Asset identifiers that may exist in an asset
Red - Asset identifiers that must not exist in an asset

Asset Sources

Each asset contains one or more sources visible in the source column which describe where the asset comes from:

	Scout
	Scale is an automated Dynamic Application Security Testing scanner (DAST) designed to analyze web applications for vulnerabilities at volume and speed.
	Cloud security assessment
	SWAT is a combination of web application scanning technology and Security Consultants to provide the most accurate and reliable solution for dynamic security testing of web applications.
	Assure is a point in time security assessment of an web application designed to provide customers an assurance of the security level of their application.
	Netsec solutions provide capabilities to identify, categorize, manage, and report on network-attached Information Technology (IT) assets and their security vulnerabilities such as insecure system configurations or missing security updates.
	Snapshot is a point in time security assessment of a web application designed to provide customers a detailed overview of the security level of their application.

Subscription Type

The Active subscription column indicates whether the asset has one or more currently active subscriptions or if it is inactive.

Asset Naming

Assets names is auto-generated by the system and is derived from underlying identifiers.

The asset names is a customizable attribute and can be changed.

See Managing Assets for information on how to managed your assets.

Changes from Previous Versions of Portal

Previously the Assets view provided access to individual identifiers. In addition to flooding the view with many top-level records, this frequently meant having to traverse between linked records (for example hostname -> IP) in order to review updated information.

Grouping related identifiers together as assets allows for accessing information of importance faster and more coherently; for example, findings obtained from distinct IP addresses may all be united under the overarching webshop which they all serve.

Customizing the Asset View

The Assets view lists all tracked assets. 

Configuring the Columns

The Columns can be configured in several ways. Columns can be added and removed and the order in which they are displayed can be changed.

Selecting Columns

By clicking on the column icon a drop-down list is displayed where columns can be selected and deselected to configure the view.

The content in the column menu changes depending on which view it is opened in.

Changing Column Width

All the columns are configurable in width by dragging the dotted area on the right side of the column head.

Changing Column Presentation

By dragging the dotted area on bottom of the column head, the order in which the columns are presented can be changed.

Multi Select

You can select several rows by checking multiple boxes at a time. This enables you to use the tools from the blue tool bar beneath the table on all the selected rows simultaneously.

For example, to use the tagging tool on three rows at once, select the rows an click the edit tags icon and fill in the tag name. The three selected will get the same tag.

The toolbar varies between different views. For example, the Asset toolbar contains different tools than the toolbar in the findings view.

Date Picker

Each column containing a date have a date picker where dates can be set to filter the column accordingly.

To customize the view,

1. Click on filter icon to see the available columns and filtering options. See Common Settings Panel for more information. 
   
   

   

   
   
   
   

2. Add desired columns by clicking on the Show/Hide Column icon.

Filtering Assets

Adding Selections

To access the filters

1. Open Findings and then Vulnerabilities.

2. Open the Assets panel by clicking the assets icon.
   
   

   

   
   
   

3. Clicking on a row selects single items.
   
   
   
   Using Ctrl + click selects multiple non-contiguous items or Shift + click selects multiple contiguous items.
   

   

   
   If a selected asset is clicked again, it is unselected and unfiltered.

Selection Counters

When assets are selected, a badge is displayed that informs that there is an asset filter applied with a counter.

In the image, three assets are selected, which is indicated by the badge on the Assets groups & Assets icon. The badge on the Filter icon indicates that one filter has been added.

Clearing Selections

The clear all button unselects all selections.

Assets - Details

Select an asset to view its details on the right side of the window.

Risk Profile

The Risk Profile tab displays the information about the name and source of the asset, and the CVSS v3 risk categories of the findings associated with that specific asset.

Severity chart

The chart offers an overview of all findings, sorted by severity. Clicking on an item in each severity list reveals more details about the severity, while clicking on a severity slice in the chart leads to the filtered Findings view.

Each list item can be expanded to reveal more detailed information of each segment such. Hovering over the chart also displays more information about each part.

Top Recommended Actions

The Top Recommended Actions provides suggestions of actions needed to remedy most of the high risk findings.

OWASP top 10

The OWASP Top 10 provides an indication on where on the scale of the most critical security risks the findings are located.

Tags

The Tagging button allows you to add or remove tags from the selected asset.

View Related Findings

The View Related Findings button redirects you to a filtered findings table containing the findings associated to the selected asset.

Scans

Displays list of scans along with the status and results of each scan of that asset.

URLS

STATUS

If you have a SWAT, Assure, or Snapshot type subscriptions and open the detail view of those assets, the empty state message in the Scans tab should display "This is a SWAT/Assure/Snapshot asset, it's continuously monitored by Outpost24 Appsec team and therefore no scans can be shown here".

Note that in assets view, configurations and scans tabs are hidden if the asset only has NETSEC and/or CLOUDSEC sources.

Configurations

Takes you to Scan Configurations.

Note that in assets view, configurations and scans tabs are hidden if the asset only has NETSEC and/or CLOUDSEC sources.

Associations

Displays the IPs, host names, instances, and services associated with the selected asset.

Subscriptions

Subscriptions represent the customer's engagement with Outpost24 and each entry corresponds to an already purchased and paid subscription.

Shows you active or inactive subscription on assets.

The Subscription tab list the current subscriptions assigned to the selected asset.

If no subscription is available for the selected asset, this message is displayed.

Agents

Technical Preview

This section is a technical preview of a feature that is currently under development. This feature is hidden behind a feature flag.

The Agents view lists all asset-identifiers that are of the Agent type.

The same columns that are available in the Asset view are also present in Agent view, with an addition of columns that are specific to the agent type such as:

• Agent version

• Agent last synchronized

• Agent retired

• Agent id

Columns that show Agent asset data within Agent view is also added such as:

• Asset IDs: a list of ids of associated Agent assets, separated by commas and each id is a hyperlink that link to the asset in Asset view

• Asset names: a list of names of associated Agent assets, separated by commas and in alphabetically ascending order

allowing filtering on those columns.

Logs

Selecting an agent provides a view with logs for that Agent.

Managing Agents

Right clicking on a agent provides a menu where you can add and remove tags.

Edit Tags

The Edit tags action displays a popup providing the user with the ability to link, or create and then link, tags to the Agent’s assets and in the Agent view, displaying these tags as "This tag is inherited".

Update External Tags

The Update external tags action displays a popup, telling the user how many assets will have their tags updated. 

Removing Tags from Agents

To remove a tag from the Agent, click on the X on the right hand side in the tag.

Managing Assets

The assets can be managed using the tools in the context menu.

To manage the assets in the table:

1. Right click an asset to open the Tools menu.
   
   

   

   
   
   

2. Click the preferred task.

Rename

Assets names is auto-generated by the system and is derived from underlying identifiers. The asset names is a customizable attribute and can be changed by using the Rename function in the context menu.

To rename the asset:

1. Right click on the assets in question to open the context menu.

2. Click Rename.
   

   

3. Fill in a new name in the Rename assets form.
   

   

4. Click the blue Rename button to rename the asset.

When multiple assets are selected, the new name is applied to all of the selected assets.

Edit Tags

Tagging helps to create more custom filtering options by adding specific tags to various entities. Customize the asset view by adding or removing the tags and by applying filters.

To edit the tags of an asset:

1. Right click on the assets in question to open the context menu.
   

   

2. Click Edit tags in the menu.

The Update external tags function adds all custom attributes of Agent asset identifiers as tags on the asset, except MAC attribute.

See Tags document for more information.

View Related Findings

The View related findings opens a view over findings linked to the selected asset.

Generate Report

Generates reports containing all vulnerability findings associated with the selected assets.

See Reports for more information

Edit the Asset Environmental Vectors

Different environments can have a big impact on the risk that some vulnerabilities pose to your company. The CVSS environmental metric group captures vulnerability characteristics associated with a user's IT environment. Environmental metrics are optional, each metric can be set to "Not defined" for that metric to not affect the score. This value is used when a user thinks a particular metric is not applicable and wants to "skip" it.

These metrics allow the analyst to tailor the CVSS score based on the value of the affected IT asset to the user's organization, as measured by the presence of complementary/alternative security controls, Confidentiality, Integrity, and Availability. Metrics are modifications of base metrics that assign metric values based on the placement of assets within an organization's infrastructure.

1. Select the asset you want to edit.

2. Click the Edit Environmental CVSS Vector icon in the right click menu.
   

   

3. In the pop up that are displayed you can edit the Environmental Vectors for both CVSSv2 and CVSSv3.
   
   

   

¹⁾ See https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html for a description of the evil maid attack.

4. Click Save.

References

1. https://www.first.org/cvss/v2/guide

2. https://www.first.org/cvss/v3.0/specification-document

Related Articles

_Copyright

_{© 2024 Outpost24® All rights reserved. This document may only be redistributed unedited and unaltered. This document may be cited and referenced only if clearly crediting Outpost24® and this document as the source. Any other reproduction and redistribution in print or electronically is strictly prohibited without explicit permission.}

_Trademark

_{Outpost24® and OUTSCAN™ are trademarks of Outpost24® and its affiliated companies. All other brand names, product names or trademarks belong to their respective owners.}