Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/11/2012
02:58 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Core Security/NT OBJECTives Spider Integrated Solution

Automated solution helps ensure that enterprise security professionals quickly identify application vulnerabilities

Boston, MA and Irvine, CA –September 6, 2011 – CORE Security®, a leading provider of predictive security intelligence solutions, and NT OBJECTives (NTO) a provider of automated, comprehensive and accurate web application security software and services today announced the immediate availability of a bundled solution combining CORE Insight with NTOSpider to deliver richer predictive security intelligence. The new, integrated and automated solution helps ensure that enterprise security professionals quickly identify application vulnerabilities and understand the precise business and operational risks posed by the vulnerabilities.

Today’s enterprises have hundreds or even thousands of web applications that are mission critical to the modern day business environment, continuously storing and accessing sensitive customer, financial and corporate information. Unfortunately, security measures have not kept pace with malicious attackers and, as a result, web applications are more vulnerable than ever before. CORE Insight with NTOSpider is designed to give security teams the tools and intelligence to make progress against their backlog of vulnerabilities and help them prioritize and address risk by identifying the most critical vulnerabilities.

“CORE Insight includes application scanning from NTO and combines it with simulation, reporting and vulnerability remediation, allowing for the delivery of actionable security intelligence in a single platform,” said Charles Kolodgy, research vice president, Secure Products, IDC. “This combination helps to alleviate the longstanding problem of too much disparate data to process and analyze. The interconnection of capabilities via automation will allow resource-constrained organizations to focus on other critical areas of security.”

As of means of identifying and managing potential threats, security teams use application security scanners such as NTOSpider to identify the application vulnerabilities. Once identified, they can use CORE’s Insight threat simulation and real-world threat replication technology to model out and test how an attacker would exploit these vulnerabilities pivoting off each internal asset, such as databases and servers, to find which can lead to a breach of critical data. But, it takes time to feed the vulnerabilities into CORE Insight, until now.

Through the automation of vulnerability identification, validation and risk prioritization, companies are now able to efficiently monitor their application security posture, allowing security teams to spend their time remediating the most material risks and threats to the business.

How the Combined Solution Works CORE Insight validates and prioritizes application vulnerabilities discovered by NTOSpider in the following way:

1. Vulnerability identification: NTOSpider discovers a comprehensive list of application security vulnerabilities

2. Vulnerability analysis: CORE Insight consumes that input and combines it with your network scan results to validate which critical assets can be breached by pivoting and traversing off of each asset to find the exploit. These multi-vector attacks are an increasingly popular technique used by attackers today.

3. Business risk summary: The combined result articulates the specific potential impact of a breach from a discovered vulnerability.

For more information about the solution visit http://www.coresecurity.com/content/CORE-INSIGHT-Enterprise

About CORE Security CORE Security is the leading provider of predictive security intelligence solutions for enterprises and government organizations. We help more than 1,400 customers worldwide preempt critical security threats throughout their IT environments, and communicate the risk the threats pose to the business. Our patented, proven, award-winning enterprise solutions are backed by more than 15 years of applied expertise from CORE Labs, the company’s innovative security research center. For more information, visit www.coresecurity.com.

About NT Objectives NT OBJECTives (NTO), Inc brings together an innovative collection of experts in information security to provide a comprehensive suite of technologies and services to solve today’s toughest application security challenges. NTO solutions are well known as the most comprehensive and accurate Web Application security solutions available. NTO is privately held with headquarters in Irvine, CA.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Average Cost of a Data Breach: $3.86 Million
Jai Vijayan, Contributing Writer,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15109
PUBLISHED: 2020-08-04
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the ship...
CVE-2020-16847
PUBLISHED: 2020-08-04
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
CVE-2020-15135
PUBLISHED: 2020-08-04
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-13522
PUBLISHED: 2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.
CVE-2020-15943
PUBLISHED: 2020-08-04
An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability, an attack...