Assets

AWS_ACCOUNT_ID

Not

Must

Not

Not

Not

AWS_REGION

Not

Must

Not

Not

Not

DOCKER_IMAGE

Not

Not

Must

Not

Not

DOCKER_REGISTRY

Not

Not

Must

Not

Not

GCP_PROJECT_ID

Not

Not

Not

Must

Not

HOSTNAME

May

Not

Not

Not

Not

IP

May

Not

Not

Not

Not

MAC

May

Not

Not

Not

Not

MAZ_TENANT_ID

Not

Not

Not

Not

Must

MAZ_SUBSCRIPTION

Not

Not

Not

Not

May

MAZ_RESOURCE_GROUP

Not

Not

Not

Not

May

MAZ_RESOURCE

Not

Not

Not

Not

May

NETBIOS

May

Not

Not

Not

Not

SEED_PATH

May

May

May

May

May

SERIAL_MACHINE_ID

Must

Not

Not

Not

Not

SERIAL_PRODUCT_ID

Must

Not

Not

Not

Not

SERIAL_DISK_ID

Must

Not

Not

Not

Not

Scout

Scale is an automated Dynamic Application Security Testing scanner (DAST) designed to analyze web applications for vulnerabilities at volume and speed.

Cloud security assessment

SWAT is a combination of web application scanning technology and Security Consultants to provide the most accurate and reliable solution for dynamic security testing of web applications.

Assure is a point in time security assessment of an web application designed to provide customers an assurance of the security level of their application.

Netsec solutions provide capabilities to identify, categorize, manage, and report on network-attached Information Technology (IT) assets and their security vulnerabilities such as insecure system configurations or missing security updates.

Snapshot is a point in time security assessment of a web application designed to provide customers a detailed overview of the security level of their application.

Collateral Damage potential (CDP)

Not Defined (ND)

This value does not affect the score and is skipped by the equation.

None (N)

There is no potential for loss of assets, productivity, or revenue.

Low (light loss) (L)

A successful exploit of this vulnerability may result in a slight loss of revenue or productivity to the organization.

Low-Medium (LM)

A successful exploit of this vulnerability may result in a moderate loss of revenue or productivity to the organization.

Medium High (MH)

A successful exploit of this vulnerability may result in  a significant loss of revenue or productivity.

High (Catastrophic loss) (H)

A successful exploit of this vulnerability may result in a catastrophic loss of revenue or productivity.

 Target Distribution (TD)

Not Defined (ND)

This value does not affect the score and is skipped by the equation.

None [0%] (N)

No target resources  exist, or targets are so highly specialized that they only exist in a laboratory setting. Effectively 0% of the environment is at risk.

Low [0-25%] (L)

Targets exist inside the environment, but on a small scale. Between 1% - 25% of the total environment is at risk.

Medium [26-75%] (M)

Targets exist inside the environment, but on a medium scale. Between 26% - 75% of the total environment is at risk.

High [76-100%] (H)

Targets exist inside the environment on a considerable scale. Between 76% - 100% of the total environment is considered at risk.

Confidentiality Requirement (CR),

Integrity Requirement (IR),

Availability Requirement (AR)

Not Defined (ND)

This value does not affect the score and is skipped by the equation.

Low (L)

Loss of [confidentiality/integrity/availability] is likely to have only a limited effect on the organization and associates.

Medium (M)

Loss of [confidentiality/integrity/availability] is likely to have a serious effect on the organization and associates.

High (H)

Loss of [confidentiality/integrity/availability] is likely to have a catastrophic effect on the organization and associates.

Metric

Option

Description

Confidentiality Requirement (CR),

Integrity Requirement (IR),

Availability Requirement (AR)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

Low (L)

Loss of [confidentiality/integrity/availability] is likely to have only a limited effect on the organization and associates.

Medium (M)

Loss of [confidentiality/integrity/availability] is likely to have a serious effect on the organization and associates.

High (H)

Loss of [confidentiality/integrity/availability] is likely to have a catastrophic effect on the organization and associates.

Modified Attack Vector (MAV)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

Network (N)

Network rated vulnerabilities are remotely exploitable through the network layer of the OSI model, from several hops away, up to, and including, remote exploitation over the Internet.

See also CVE 2004 0230 for more information.

Adjacent Network (A)

The Adjacent Network rated vulnerability requires that the exploit  must be launched from the same physical or logical network and cannot be performed across an OSI layer 3 boundary.

See also CVE 2013 6014 for more information.

Local (L)

Vulnerabilities with this rating are not exploitable over a network. The attacker must access the system locally, remotely through protocol such as SSH or RDP, or requires use of social engineering or other techniques to trick an user to help initiate the exploit.

Physical (P)

In this type of attack, the attacker must physically interact with the target asset. Physical interaction can be brief like an attack from an evil maid [1]) or persistent.

Modified Attack Complexity (MAC)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

Low (L)

There are no specific pre-conditions available to exploit.

High (H)

There are conditions beyond the attackers control for successful attack. For this type of attack, the attacker must complete some number of preparatory steps in order to get access.
This might include:

• gather reconnaissance data

• overcoming mitigations

• becoming a man-in-the-middle

Modified Privileges Required (MPR)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

None (N)

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.

Low (L)

The attacker is authorized with required privileges that provide basic user functions that typically only affect settings and files owned by a user. Alternatively, a low-privilege attacker can only affect non-sensitive resources.

High (H)

The attacker is authorized with required privileges that provide significant administrative control over the vulnerable asset that could affect asset-wide settings and files.

Modified User Interaction (MUI)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

None (N)

The vulnerable resources can be exploited without user interaction.

Required (R)

A user must complete some steps for the exploit to succeed.

For example, a successful exploit may only be possible during the installation of an application by a system administrator.

Modified Scope (MS)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

Unchanged (U)

An exploited vulnerability could only affect resources controlled by the same authority.

In this case, the impacted asset and the vulnerable asset are the same.

Changed (C)

An exploited vulnerability could affect resources beyond the authorization rights provided by the vulnerable asset.

In this case, the vulnerable asset and the affected asset are different.

Modified Confidentiality (MC)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

None (N)

There is no loss of confidentiality within the impacted asset.

Low (L)

There is some confidentiality loss leading to that limited information can be accessed, but with no control over what, specifically, they are able to access. The disclosure of information does not cause direct and serious damage to the affected asset.

High (H)

The attacker has full access to all resources in the impacted asset, including highly sensitive information such as encryption keys, or access is obtained to limited information, but the information disclosed has a direct and serious impact.

Modified Integrity (MI)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

None (N)

There is no loss of confidentiality within the impacted asset.

Low (L)

Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is constrained. A limited amount of information might be tampered with or modified, the modification of the data does not have a direct and serious impact on the targeted asset.

High (H)

The attack can modify information on the targeted assets, resulting in a complete loss of integrity or protection. This can lead to modified files, resulting in a direct and serious consequence to the impacted asset.

Modified Availability (MA)

Not Defined (X)

This value does not affect the score and is skipped by the equation.

None (N)

There is no loss of confidentiality within the impacted asset.

Low (L)

Performance is degraded or resource availability is disrupted. Although this vulnerability could be exploited repeatedly, the attack would not completely deny service to legitimate users.

The affected asset are either partially available or fully available intermittently, but in general this does not have any direct and significant consequences for the affected asset.

High (H)

There is a complete loss of availability of the affected asset, where access to the resources of the assets is denied. This loss is either temporary during the attack or permanent leaving the asset unreachable even after the attack.

Alternatively, the attack can deny some availability, but the consequence of the lost availability is severe.

Active subscriptions

Subscriptions that are actively being consumed by the asset.

Asset group IDs

Clickable asset group IDs where this asset is assigned. Clicking an ID opens the Asset Groups view with that group selected.

Asset groups

Clickable names of asset groups where this asset is assigned. Clicking a name navigates to the Asset Groups view with that group selected.

Asset Identifiers

List of asset identifiers defining this asset. Asset identifiers are the most atomic elements defining the scanned assets. Asset identifiers can be associated with each other through special attributes. See Asset Identifier section.

Created

When the asset was first created. Counted from when a scan first resulted in this asset or when the Appsec team created it.

Created by

Who created the asset:

• System if it was from a scan

• Appsec team if they created it

• User name if user created it

Customer ID

ID of the Outpost24 customer account this asset belongs to.

ID

Unique identifier of the asset.

Name

The name of the asset. Assets names are auto-generated by the system and are derived from underlying identifiers. The asset name is a customizable attribute and can be changed. To rename an asset see Rename section under Managing Assets.

Platform

What operating system is running on the asset.

Source

Which source scanner or product type does the asset originate from. See Asset sources for more information.

Tags

Displays the available tags associated with the asset.

Updated

Timestamp of when the asset was last updated at all for any reason, system- or user-initiated.

Updated by

Who did the last updating action, system, user, or AppSec team and so on.

UUID

Unique asset ID used in conjunction with asset definition and deduplication.