Synack PTaaS Platform Reporting for Practitioners

00:05 Hello, and welcome to the next episode of Cut to the Chase. Today, we'll be talking about reporting for practitioners. My name is Nick Bartosh, one of the solutions architects here at Synack. Reporting is one of the key capabilities and core competencies that you really need to look for in any PTAS platform. Reporting is what helps us understand how well we're doing with our vulnerability management that comes out of the d fast capabilities.

00:35 Without reporting, we aren't able to pick a direction, we aren't able to prioritize, and we're really not able to really get a good handle on what our vulnerability management program looks like from an external perspective. So here at SYNNAC, we have added some additional reporting features into our platform that are really built around the day to day for our practitioners to help them understand what the assessments are doing, how they're able to find those vulnerabilities and exploits,

01:06 and how well their organization is doing at managing the vulnerabilities and hardening their attack surface. So let's dive in and let's talk a little bit about what Synack has on the table. Before we dive in, we're going take a look a brief look at some of the capabilities that Synack has brought to the market that our organizations and our friends in security really find useful. Starting with attack surface discovery, this is the beginning of the lifecycle here at SYNNAC where

01:37 we're able to take a look at the external attack surface for our partners and help them understand the unknown unknowns, the things that they don't yet know about that are lurking in their external attack surface. This helps them understand where which assets they have, which URLs, which domains, which IPs, along with the various services that are running under each. With this information that we generate, we're able to then analyze their attack surface through

02:07 something that we call our asset insights, which we'll show you in a minute, where we're then able to show you the various risks, potential vulnerabilities, and exploits that are associated with the various assets under TESS. This allows us to help our organizations prioritize risks, discover areas where they have risk that they may not have known about before, and work towards managing the risk to either put in the mitigations or help fix those

02:38 risks through working with their development teams, through working with their infrastructure teams, and ultimately building a hardened platform and a hardened environment. We do this through the capabilities of our SRT, the Synact Red Team, who are our human led researchers that are able to find any of these vulnerabilities in these exploits through the open vulnerability discovery that we allow them to do. With these open vulnerabilities, we're then able to verify and validate that the vulnerabilities exist.

03:11 And through our reporting and through our platform, we're able to verify that any of the patches, any of the mitigations that were put in place are then able to ultimately fix those vulnerabilities and those exploits that we found. But as I mentioned at the beginning, in order to understand whether or not we're successful, we really need to see the reporting to see how that is done. So diving in, we thought we'd show you today really quickly some of those new features that we have.

03:42 So starting at the beginning with our asset discovery capabilities, this allows us to really understand what the external attack surface looks like. From an overview perspective, we can show you what we found when we ran those scans and allow you to start to understand where your suspected vulnerabilities are, where your potential risks are inside your organization, and what you can do about it. This is done through discovering assets from the URLs and the IPs that you provide us,

04:14 where we're then able to take a look and create these lists for you. With this information and the assessments that we create, we can then dive into those vulnerabilities that the Synact Red Team is able to find and understand what those exploits look like and start to put together a plan on how we want to mitigate them. So if we were to find an exploit, we can dive in. We can see what exploit means, how it was created,

04:44 the steps to reproduce so that we can talk to our development team on where we found this and what they need to do to fix it. We have the vulnerability locations so that you're able to find vulnerabilities in the places that we looked rather than hunting and pecking through your attack surface. And then finally, with the recommended fixes, once we're able to once we've fixed the vulnerability, we can then also request a patch verification of the SRT such that once the

05:18 verification is put in place, you can go back to the Synack Redeemer, ask them to please verify this. Can you still exploit the system after we patched it? And they they can then tell you whether or not it was worked it has worked. So with that, once we have done all of those steps, we really want to start to focus in on reporting to understand, well, how well are we really doing with those assessments and with those vulnerabilities and exploits that we found.

05:48 So here in our analytics, some of the new reporting that we're able to offer now, we're able to show you the total number of vulnerabilities, what your vulnerabilities will look like over time. So are you increasing or decreasing the number of categories and a variety of other good information to help you out. From a graphical perspective, we're also able to show you what the top ten categories so you can know where to focus in your organization, know how to help train your team, know where those vulnerabilities are so that you

06:20 can understand what matters most. So we take a look and we can see then our own environment here at SYNNAC authentication session and our demo environment is something that we really need to be thinking about in our own demo dev teams. It looks like for them, it takes them a hot second to figure out how to harden our authentication session capabilities inside our applications. We can also take a look at the subcategories within each of those major categories to understand as well where we are weak.

06:50 And here we can kind of see that JSON injection and IDOR are two things that we really need to be focusing on from an application and a content perspective. We can also dive in by vulnerability by severity, which allows us to see of the total vulnerabilities, what the severity is. And so now as we dive in and we know what we're interested in, which vulnerabilities matter and the criticality of those vulnerabilities, we can start to focus in and focus a program around those

07:21 pieces of information so that we can focus on where the risks are in the environment. So as we can see in our own demo environments here, authentication session is definitely something we need to take a look at. We have several criticals, several highs, several lows, and several mediums. And then finally, with the information we found earlier, we can start to dive in by assessment as well. So now not only do we know which vulnerabilities really matter to us and the criticality,

07:52 we can go find them by assessment as well and dive in that way. And what that finally allows us to do is close the loop and say, found these critical vulnerabilities in this assessment with these assets, which we can assign either back to a group or a set of assets or a development or area that we can then fix take a look and fix. So now we've got a full life cycle on how we're able to do that. And not only that, each of the graphics that we show here are

08:25 able to be split out as either PDFs or graphics that you can drop into your own reports. Or if you choose, you can hit the easy button here where you're then able to download the various reports that we have as well. And so with this information, you can go back to your teams, you can build out your remediation strategies and your vulnerability management programs and become more efficacious as you move forward with what we're here doing here at Synack. Wanted to thank you for your time today.

08:56 Again, my name is Nick Bartosh, and you can find more information at w w w dot cenac dot com. Thank you.