In the following section, we detail the main services provided and how they are interconnected, ensuring a thorough grasp for all involved parties.
Version Number: v1.0.1
Published Date: 13 May 2024
____________________________________________________________________________
Understanding License Services in Vulnerability Management
License services encompass the array of security and vulnerability management features accessible to an organization, determined by their selected licensing agreement. These services play a crucial role in pinpointing, evaluating, and addressing vulnerabilities present within your digital assets.
Core License Services and Dependencies
- Vulnerability Scanning: This service conducts external and unauthenticated scans to detect vulnerabilities across web applications, APIs, and network/cloud devices. It serves as the foundation for a robust vulnerability management program.
-
Dependencies: None. Serves as a base for other services.
-
- Internal Scanning: Offers in-depth assessment of internal networks, identifying vulnerabilities invisible to external scans.
-
Dependencies: Vulnerability Scanning.
-
- Authenticated Scanning: Enhances scanning depth by using credentials to identify vulnerabilities that are only visible post-authentication.
-
Dependencies: Vulnerability Scanning.
-
- On-Demand Scanning: Allows users to initiate scans as needed, providing flexibility to address immediate security concerns.
-
Dependencies: Vulnerability Scanning.
-
- Scheduled Scanning: Automates the scanning process, running at predetermined times to ensure continuous security assessment.
-
Dependencies: Vulnerability Scanning.
-
- Vulnerability Validation: Each detected vulnerability is verified by certified experts, ensuring the accuracy and relevance of alerts.
-
-
Dependencies: None. Integral to the Edgescan platform.
-
- Retesting: Offers the ability to retest vulnerabilities post-remediation, supporting continuous improvement in security posture.
-
-
Dependencies: Vulnerability Scanning.
-
Specialized License Services
Penetration Testing as a Service (PTaaS): Combines manual and automated techniques for a comprehensive vulnerability assessment, with risks validated against extensive databases.
-
-
Constraints: Scanning allowances may apply.
-
Vulnerability Retests: Enables focused retesting on specific vulnerabilities, offering flexibility in remediation efforts.
-
-
Constraints: Retest allowances and dependencies on Vulnerability Scanning.
-
PCI Certification: As a PCI Approved Scanning Vendor (ASV), Edgescan can perform PCI assessments and provide reports per the standards of the PCI standards council.
-
- Dependencies: Vulnerability Scanning.
Microservice Scanning: Targets the security of web application and API microservices with continuous or on-demand assessments.
-
-
Dependencies: Vulnerability Scanning.
-
Attack Surface Management (ASM): Provides visibility into all publicly exposed services, enhancing external threat awareness.
-
-
Dependencies: None. Foundation for API Discovery.
-
API Discovery: Identifies and monitors APIs across your external digital estate, highlighting new or unknown APIs.
-
-
Dependencies: Attack Surface Management.
-
Support and Integration Services
Key Support and Integration Services:
Technical Account Manager (TAM): Serves as a dedicated contact for managing service delivery and monitoring success.
Premium Support: Provides 24/7 assistance for prompt resolution of critical incidents.
Cloudhook Integration: Streamlines the inclusion of cloud-based assets into the Edgescan platform for comprehensive visibility.
External Attack Surface Management (EASM): Dynamically evaluates external digital footprints from a primary domain, integrating results into the Edgescan platform.
Understanding Service Dependencies
Understanding service dependencies is crucial as it highlights the need for certain foundational services to be in place before others can be effectively utilized. For example, most scanning-related services depend on the core Vulnerability Scanning service. While standard licenses typically include essential services, additional features, upgrades, and special bundles may introduce specific dependencies. This modular approach allows organizations to customize their vulnerability management solutions to meet their unique needs and address specific threats.
By choosing the right combination of license services, organizations can establish a strong defence against digital vulnerabilities that is tailored to their specific infrastructure and risk profile.